Tool reference

Twenty-eight email tools. What each one does.

This is the whole surface. Eleven tools that only read, nine that change something you can change back, and eight your AI client stops and asks about before it runs them. A mailbox with a calendar connected gets up to twenty-one calendar tools as well. Each one is listed with what it does and where it refuses.

  • Tool surface 28 email, up to 21 calendar
  • Messages a call Up to 500
  • Calls a day 5 free, 1,000 on Pro

Reference

The twenty-eight email tools, by what they change

Every one of the email tools this server registers, taken from its own registration code, and every mailbox gets all of them. A tool that is not on this list cannot be called, by any client, however it is asked. Each row also carries the capability it belongs to, so the filing tools are still findable in a list ordered by consent. A Microsoft 365 mailbox gets twenty-one calendar tools on top of these.

Read 11 tools

Nothing in the mailbox changes

Your client can run these without stopping to ask, because there is nothing to undo afterwards. Reading a message does not even mark it read: every one of these that opens a folder opens it read-only and fetches with BODY.PEEK, the IMAP command that deliberately leaves the Seen flag alone. That costs an extra round trip, and most integrations do not pay it.

  • list_mailboxes Read

    Lists every folder in the mailbox with the role the server reports for each. Roles come from the server's own LIST flags rather than from folder names, so it works on an account whose Sent folder is not called Sent.

  • list_emails Read

    Lists the most recent messages in a folder, newest first. Summaries only, never message bodies.

  • read_email Read

    Opens one message in full, with its body, recipients and attachments. Does not mark it read, and exposes the sender's Reply-To header where there is one, because that is where a reply will actually go.

  • read_thread Read

    Reads a whole conversation in one call, oldest first, from any single message in it. Long threads are capped and the result says so rather than quietly returning the newest few.

  • search_emails Read

    Searches up to 25 folders in one call, by sender, recipient, subject, body, date range, read state, flag state and attachment presence. Results are capped, and the response reports the total, the number returned and whether it capped.

  • find_contact Read

    Resolves a person's email address from the mailbox's own history. An address you have sent to outranks one that merely arrived from somebody using that name, because a display name on inbound mail can say anything.

  • check_bounces Check

    Finds messages that came back undelivered, in Inbox and Junk, and says whether each failure is permanent or temporary. Resending fixes one of those and duplicates the other.

  • check_deliverability Check

    Checks the SPF, DKIM, DMARC and MX records of the connected mailbox's own domain. It says when a DMARC record is set to p=none and is therefore doing nothing, and it keeps a failed lookup apart from a missing record.

  • check_upload Check

    Looks for what an upload link received, and hands the assistant a reference to each file so it can attach them. Says plainly when nothing has arrived yet, which usually means the upload is not finished rather than that anything failed.

  • check_receipts Check

    Finds the confirmations that came back for messages you sent: a delivery confirmation, meaning the recipient's server accepted it, and a read receipt, meaning their mail program reported it was opened. It says in the result that a missing receipt is evidence of nothing, because most mail programs never send one and most people decline when asked. A receipt reporting that a message was deleted unopened is reported as exactly that.

  • list_identities Send

    Lists the addresses this mailbox is allowed to send as, and says which one is used when none is named. Aliases are added by the mailbox owner in their account rather than through the connector, and each carries its own name and signature. It opens no connection and changes nothing.

Write, reversible 9 tools

Changes something you can change back

A flag can be cleared, a message marked read can be marked unread, and a draft sits in Drafts until you send or delete it. Whether your client asks before running one of these is its decision rather than ours, and clients differ.

  • create_folder File

    Creates a folder, applying the server's own hierarchy and naming rules, and subscribes it so mail clients that list only subscribed folders actually show it.

  • draft_email Send

    Saves a message to the real Drafts folder without sending it, so it appears in Outlook or webmail to edit, send or delete. A real draft, not a record of one.

  • draft_reply Send

    Saves a reply to Drafts instead of sending it, with the original quoted underneath and the hidden headers that attach it to the conversation. That second part is why it is a separate tool: a draft written as an ordinary message can carry a "Re:" subject and still arrive as a brand new conversation, and nobody notices until the thread does not group. This is the one to use when you want to read a reply over before it goes. The message it answers is not marked as replied to, because it has not been yet.

  • draft_forward Send

    Saves a forward to Drafts instead of sending it, carrying the original message and its files exactly as a sent forward would. A forward is the message where reading it over first matters most, because the part you are passing on is not yours. It names the files travelling with it, and names any the size limit would not take, which is worth more here than on a send: you still have time to do something about a missing one. The original is not marked as forwarded, because it has not been.

  • mark_read Flag

    Marks up to 500 messages read in one call. This is the deliberate act; reading a message never does it.

  • mark_unread Flag

    Marks up to 500 messages unread again in one call.

  • flag_email Flag

    Sets the flag or star marker that Outlook and Gmail show, on up to 500 messages in one call.

  • unflag_email Flag

    Clears that flag or star marker, on up to 500 messages in one call.

Write, destructive 8 tools

Irreversible, or seen by somebody else

A sent message cannot be recalled and a moved message is no longer where it was, so hosts prompt before these run. No mail is destroyed here: deleting moves a message to Trash exactly as pressing Delete in Outlook would, and there is deliberately no tool that empties a folder. The single exception is not mail at all. Updating a draft removes the version it replaces, because the alternative is a bin filling up with drafts you abandoned, and the new version is saved before the old one goes.

  • move_email File

    Moves up to 500 messages to another folder in one call, using the IMAP MOVE command, so read state, flags and the original dates all survive the move.

  • delete_email File

    Moves up to 500 messages to Trash in one call, exactly as pressing Delete would. Recoverable: nothing on this surface erases mail permanently.

  • update_draft Send

    Rewrites a draft that is already in the Drafts folder, so changing your mind about the wording replaces the draft rather than leaving the old version behind. IMAP cannot edit a message in place, so this saves the new version and removes the previous one, which is what your own mail client does when you edit a draft and save it. The alternative would put every abandoned version in your bin. The files already attached and the hidden headers that hold a reply in its conversation both survive the edit. It is grouped with the destructive tools because the version it replaces is gone rather than recoverable, and your assistant should ask before it runs.

  • rename_folder File

    Renames a folder and moves it under a different parent in one operation, the way a mail client's folder editor does. Sub-folders travel with it, and their subscriptions are carried across.

  • delete_folder File

    Deletes a folder, and refuses one that still holds messages or has sub-folders inside it. It unsubscribes as well as deleting, so no phantom folder is left behind.

  • send_email Send

    Sends a new message from the connected address, or from any alias on the mailbox when one is named, with files attached if any are passed. Exactly one copy is filed in the real Sent folder.

  • reply_email Reply

    Replies inside the original thread, quotes the original below the new text, files a copy in Sent and marks the original answered. A Reply-To pointing somewhere the message did not come from is refused until the caller names that address.

  • forward_email Forward

    Forwards a message, carrying the original's attachments and inline images, under the forwarded-message block a real mail client produces. A carried file that will not fit the 10 MB message ceiling is reported as skipped by name. Recipients are exactly the addresses supplied.

A capped result says that it capped

Two of the read tools can match more than fits in one answer, and both say so rather than handing back the first few and letting the model assume that was everything. A search reports the total it matched, the number it returned, and whether it capped. Checked against a folder of 500 messages, it reported a total of 500, fifty returned, and capped set true. Reading a thread behaves the same way, and trims the quoted text from earlier replies so the same paragraph is not repeated twelve times.

Connected separately

The twenty-one calendar tools

Connect a Microsoft 365 mailbox and approve calendar access, and your AI client is handed these as well: forty-nine tools in all. Every other mailbox has two ways to a diary and can take either, whoever hosts the mail: sign in to Google for a Google calendar, or give the address of a CalDAV calendar server. How many of these arrive then depends on the route, because Google answers for the permissions you approved and a CalDAV server for what it turns out to implement. Until a calendar is connected you get none of them, and your client is told nothing about a diary this mailbox does not have.

An absent tool is a better answer than a tool that always refuses. One that is certain to fail still spends a call against your daily allowance to say so, still invites the model to try again a different way, and still advertises something you did not buy. So the server reads what your connection actually covers and registers accordingly, and the list your client shows you is the list that will work.

That is why the number below is a ceiling rather than a promise. Microsoft 365 answers for all of them. A calendar server reached by its address answers for as many as it implements, which is asked when the calendar connects rather than assumed: one will send invitations to other people and report who is free, another only stores events. Two customers on the same protocol can legitimately be offered different lists, and each list is the one that works.

Two things about this surface are worth knowing before you read the rows. Every time comes back in your mailbox's own timezone, stated rather than assumed, because a diary answer with an unstated timezone is a wrong answer waiting for a plane journey. And when somebody's free/busy cannot be read, the answer is unknown and never free - Microsoft reports those one attendee at a time inside an otherwise successful response, which is precisely how an integration ends up booking over an afternoon it could not see.

Read 8 tools

Nothing in the mailbox changes

Your client can run these without stopping to ask. They read the diary and the mailbox's own settings, and nothing in either changes. What comes back about other people is their busy and free blocks, never the subjects of their meetings.

  • list_calendars Read the diary

    Lists every calendar the mailbox can see, including shared ones, and reports the mailbox's timezone and working hours. A calendar that can be read and not written to is marked as such, so nothing is offered that would then be refused. This is the call that makes every other time on this surface statable: without the timezone, "three o'clock" is a guess.

  • list_events Read the diary

    Lists what is in the diary between two dates, newest first within the window. A recurring meeting appears on every date it falls on, each one carrying the id of the series it belongs to. Each event says whether the mailbox owner organises it and how many people are invited, so a block of your own time is never mistaken for a meeting. A capped result says it capped.

  • read_event Read the diary

    Opens one event in full: everybody invited and how each of them answered, the recurrence written out in words rather than as a rule, the join link for an online meeting, the body, the categories and the reminder. It says whether you are holding one date of a series or the series itself, which is what decides what a later change would apply to.

  • search_events Read the diary

    Finds events between two dates by free text, matched against the subject, the location and the organiser. The window is required rather than optional: a diary has no end, so "when did I last meet Alice" means nothing without one, and the result repeats back the window it searched so the answer can be trusted or widened.

  • check_availability Find a time

    Asks when a group of people are free, returning busy blocks rather than what is in their diaries. Somebody whose calendar cannot be read comes back as unknown and never as free: those are different answers, and treating the first as the second is how a meeting gets booked over somebody's afternoon.

  • find_meeting_times Find a time

    Asks Microsoft for times a meeting would actually fit, ranked, honouring each attendee's working hours and each one's answer to whether they are needed. Where no time works it says which attendees are the reason, rather than returning nothing.

  • list_categories Reminders and categories

    Lists the categories this mailbox has defined, with the colour Outlook shows for each, so an event can be filed under the labels its owner already uses instead of new ones invented by an assistant.

  • read_out_of_office Out of office

    Reads the out-of-office reply as it currently stands: whether it is on, the period it runs for if it is scheduled, and both messages - the one people inside your organisation get and the one everybody else gets.

Write, reversible 11 tools

Changes something you can change back

These change something, and every change can be changed again. That includes the ones that send email: a meeting can be rescheduled or cancelled, and the message reaches everybody the first one did. Each tool that will email somebody says so, and says who, before your client runs it.

  • create_event Book your own time

    Blocks time in your own calendar, optionally repeating daily, weekly or monthly, with a reminder, a category and a show-as state. Nobody is invited and no email is sent: this is the tool for your own time, and inviting people is a different tool that says so.

  • update_event Book your own time

    Changes an event you own - the time, the subject, the location, the reminder. Where the event is part of a series it requires you to say whether the change is to this occurrence or to the whole series, and will not guess, because guessing wrong rewrites a year of Mondays.

  • schedule_meeting Meet other people

    Invites people to a meeting, optionally as an online meeting with a join link, marking each attendee required or optional. Real invitations go out from your address, so the result says who received one. Repeating the same request does not create a second meeting.

  • update_meeting Meet other people

    Changes a meeting other people are on, and tells them. Moving the time or adding an attendee sends the update Outlook would send, and the result names everybody it reached rather than reporting a bare success.

  • respond_to_invitation Answer invitations

    Accepts, tentatively accepts or declines an invitation, with an optional note to the organiser, and lets you choose whether the organiser is told at all - which is the difference between declining a meeting and declining it publicly.

  • propose_new_time Answer invitations

    Declines an invitation and suggests a different time in the same action, which is the answer most people actually want to give. Where the organiser has turned proposals off, that is reported plainly instead of being attempted and failing.

  • forward_event Meet other people

    Forwards an invitation to somebody who was not on it, with a comment. The organiser is told, exactly as Outlook tells them, so nobody is quietly added to a meeting.

  • set_out_of_office Out of office

    Turns on the out-of-office reply, either indefinitely or for a date range, with a different message for people outside your organisation. It is the same setting Outlook writes, so it appears in Outlook and turns itself off at the end of the period.

  • clear_out_of_office Out of office

    Turns the out-of-office reply off, and says what it was set to before it was cleared.

  • snooze_reminder Reminders and categories

    Snoozes an event's reminder until a time you state, the way pressing Snooze in Outlook does.

  • dismiss_reminder Reminders and categories

    Dismisses an event's reminder so it does not fire again.

Write, destructive 2 tools

Irreversible, or seen by somebody else

Two, and only two, cannot be taken back. Deleting an event refuses outright the moment anybody else is invited, and points at the tool that cancels a meeting properly instead - so an invitation is never quietly removed from your own diary while everybody else keeps holding the time.

  • delete_event Book your own time

    Deletes an event nobody else was invited to. It refuses the moment anybody is on it and names the tool that cancels a meeting properly instead, so an invitation is never removed from your own diary while everybody else keeps holding the time.

  • cancel_meeting Meet other people

    Cancels a meeting and emails everybody invited, with a message if you want one. This is the only correct way to remove a meeting other people hold, and it cannot be taken back once the cancellations are out.

A series is not one of its dates

A weekly meeting is two different things at once: the series, and each Tuesday it lands on. Outlook keeps them apart and so does this. Changing an occurrence needs you to say which you meant, and it will not guess, because guessing wrong rewrites a year of Tuesdays and the person finds out in a meeting they no longer have.

Batching

Five hundred messages in one call

Every tool that changes messages takes a set rather than a single message, and it will take up to 500 of them at once.

That is mark_read, mark_unread, flag_email, unflag_email, move_email and delete_email. Filing a morning's inbox of forty messages is one call rather than forty, and clearing a year of newsletters is one call rather than several hundred.

Under a plan with a daily ceiling that is the whole difference between a limit you meet and one you never see. Free is 5 MCP calls a day and Pro is 1,000 a day, both per mailbox, and Pro is a published ceiling rather than an unlimited plan. Pro is £2.92 a month, paid annually at £34.99 + VAT, per mailbox; the pricing page states both ceilings and the same figures.

  • mark_read, 500 messages 340 ms
  • flag_email, 500 messages 252 ms
  • move_email, 500 messages 187 ms
  • delete_email, 500 messages 175 ms

Those four were timed on 2026-08-27 against a real server, at 500 messages a call, and they are the reason the batch limit is worth having rather than a number in a specification.

A request for 501 is refused rather than quietly truncated. Acting on the first 500 of 501 and reporting success is the failure that actually matters at a ceiling: you would have no way of knowing which message was left behind, and the report would tell you nothing was.

Partial failure is named the same way. IMAP has no transaction, so a batch really can half-work, and every result lists which messages succeeded and which did not and why, rather than returning a clean success. Verified live with one real message and 499 that did not exist: it did the real work, said so, and named what it could not touch.

What this looks like in practice is covered by the guide to triaging a full inbox and the guide to filing and folders, which also explains why a move keeps the read state, the flags and the original date instead of stamping everything with today's.

Batching is the part you can only judge on your own mailbox. The free tier is 5 MCP calls a day, with no card, and one of them will file a few hundred messages.

Delivery

Email that bounced, and what to do next

A send is reported successful when the sending server accepts the message, which is not the same as delivered. Delivery happens minutes later, on somebody else's server, and if it fails the bounce comes back as an ordinary message in your inbox long after the send tool answered. Every mail system works this way. Most tools stop at the acceptance and leave the rest to you.

check_bounces is the tool that goes and looks. A panel listing bounces is something nobody opens. An assistant noticing, inside the same conversation, that the quote you sent an hour ago came straight back is the part worth having.

Each result says which kind of failure it was, and the two want opposite responses. An assistant told only that something bounced gets one of them wrong, and it is a coin flip which.

Failure What it means What resending does
Permanent The address is wrong, or the mailbox no longer exists. Nothing. The same message comes back again.
Temporary The receiving server was busy and the sending server is still retrying. Delivers the message twice.

Junk is scanned as well as Inbox, by default. A bounce is automated mail arriving from an unfamiliar server with no prior correspondence, which is close to a description of what a spam filter is built to catch, so searching only the inbox would miss the ones you most need to see.

This was proven end to end on 2026-08-27 against real bounces from a real mail transfer agent, rather than against hand-written test fixtures, and the distinction is not pedantry. A parser and the fixtures that test it, written by the same person in the same afternoon, agree with each other whether or not either agrees with a real mail server. Sixteen unit tests passed while the tool could not read a bounce produced by the mail server this project itself sends through. It was found by sending mail that could not be delivered and then reading the mailbox with something other than the tool under test.

Addressing

Finding an email address in your own history

find_contact resolves a person's email address out of the mailbox's own history, from a name or part of one. There is no address book of ours behind it and nothing is uploaded anywhere: it is your own mail, searched.

The interesting part is the order it puts the candidates in. An address you have sent to always outranks one that merely arrived from somebody using that name.

Signal Rank Why it ranks there
An address you have sent to First Nobody but you can put an entry in your Sent folder.
An address that arrived using that name Second A display name on inbound mail can say anything the sender likes.
Two candidates carrying the same signal Recency decides The more recent correspondence is the one still in use.

That is a security property rather than a convenience. Anyone can put any display name they like on a message they send you, and plenty of people do it deliberately. Nobody can put an entry in your Sent folder. Rank those two the other way round and an assistant asked to reply to a colleague addresses the mail to whoever last impersonated one.

reply_email guards the same corner from the other side. Recipients come from the original message, using its Reply-To header where the sender set one and From otherwise, and if a message carries a Reply-To pointing somewhere it did not come from, the tool refuses to send until the caller names that address explicitly. That is the exact shape of a common phishing technique: mail that looks like it came from someone you know, with the replies quietly routed elsewhere. The security page sets out what is held, what is encrypted and what is never stored.

Reputation

SPF, DKIM and DMARC on your own domain

check_deliverability reads the four DNS records that decide whether the servers you send to believe your mail is really yours. It checks the connected mailbox's own domain and only that domain: it cannot look anyone else's up, which is deliberate.

Record What it decides Where it lives
SPF Which servers are allowed to send using your domain. A TXT record on the domain itself.
DKIM Whether a message really left your domain unaltered, proved by a signature. A TXT record on a selector subdomain, which is why a check has to know the selector to find it.
DMARC What a receiving server should do when SPF or DKIM fails. A TXT record at _dmarc on the domain.
MX Where mail addressed to your domain is delivered. The domain's own MX records.

A DMARC record can pass and still do nothing

A DMARC record set to p=none is present, valid, and instructs receiving servers to take no action at all when a message fails. It passes every checkbox a deliverability checker has. The tool says so in a note instead of showing it as a pass, because a green tick there is worse than no check: it tells you a thing is protected when what you have is a record that reports and enforces nothing.

The second trap is quieter. A DKIM key the check could not find is reported as a failed lookup rather than as a missing record, because those mean opposite things and the tool keeps them apart. A key may simply be published under a selector the check does not know about, and telling you that your signing is missing when it is working is how somebody ends up rebuilding a mail setup that was fine.

None of this is unique to us as information. What is different is that an assistant can ask for it in the middle of working out why a customer never replied, rather than you opening a separate tool and pasting a domain into it.

Limits

What these tools will not do

Twenty-eight is the whole list, so everything absent from it is absent on purpose. These are the ones people ask for.

  • Nothing is scheduled

    It cannot schedule a send. Everything happens when you ask for it, and nothing runs while you are away.

  • Results are capped

    Search results and long threads are capped. The response reports the total, the number returned and whether it capped, but a very broad search will meet the cap.

  • 10 MB a message

    Attachments are capped at 10 MB per message in total across every file attached, which is our limit rather than a provider's.

  • Search is literal

    Search is substring matching over IMAP. There is no stemming and no ranking, so a search for invoices does not find a message that only ever says invoice.

  • Your own domain only

    The deliverability check reads the connected mailbox's own domain only. It will not look up a customer's domain, or a competitor's.

  • Folders with mail in them

    Deleting a folder is refused while it still holds messages or has sub-folders inside it. There is no Trash to recover a folder from, and what reaches this tool is a model acting on a sentence rather than a person looking at the folder.

  • Deleted mail is gone

    It cannot recover mail that has already been deleted.

  • Not a backup tool

    It does not archive, back up or export a mailbox, and it is not a migration tool.

  • A calendar has to be connected separately

    Calendar tools appear once a diary is connected, which is its own step: calendar access approved on a Microsoft 365 sign-in, a Google sign-in for Google Calendar, or the address of a CalDAV calendar server. A mailbox with none of the three gets the email tools and no calendar tools at all.

  • No contacts, no files

    It does not manage a contacts list or a file store. Addresses are resolved from the mailbox's own history rather than from an address book, and attachments are handled as mail rather than as documents.

  • Unknown is not free

    When somebody's calendar cannot be read, the answer is unknown rather than free. Free/busy across organisations depends on an arrangement between them, and a name that comes back blank has told you nothing.

  • No room browsing

    It cannot list the meeting rooms an organisation has. Reading a room directory needs a permission only an IT administrator can approve, and asking every customer for that to power one convenience is the wrong trade. A room with an email address can still be invited and its free/busy checked, exactly like a person.

  • No files on calendar events

    Files attached to a calendar event are not read or written yet. Attachments on email are, and event attachments are a separate piece of work rather than an oversight.

  • No shared mailboxes

    Shared and delegated mailboxes are not supported. A shared CALENDAR is a different thing and is supported on Microsoft 365: one that has been shared with you can be read, and written to where the person who shared it allowed that.

  • Both plans have a ceiling

    Both plans have a daily ceiling on MCP calls: 5 a day on Free and 1,000 a day on Pro, per mailbox. Pro is a published limit, not an unlimited plan.

  • Only this server's tools

    These limits describe the tools this server registers. Another vendor's mail MCP server has a different list, and the only way to know theirs is to read it.

Where the figures on this page come from

The timings, the attachment behaviour and the batch ceiling were measured while the engine was built, against a live mailbox of 26,930 messages across 6.63 GB. How it works gives each measurement with the method beside it, and follows one request from your sentence to your mailbox and back. If a claim here cannot be checked on your own mail with a free account, it should not be here.

Questions

Questions about the tools

How many tools are there, and what does each kind do?

Twenty-eight email tools on every mailbox, plus up to twenty-one calendar tools once a calendar has been connected, so at most forty-nine in all. A Microsoft 365 mailbox with calendar access approved gets every one of the calendar tools; a Google calendar gets as many as the permissions you approved cover, and never the out-of-office or the counter-proposal, which Google has no equivalent of; a calendar reached at a CalDAV address gets as many as that server supports, which is asked when it connects. Taking the email tools, the split that matters is what each one changes. Eleven only read, so nothing in the mailbox moves when they run. Nine make a change you can put back: creating a folder, saving a draft, marking read or unread, flagging or unflagging, and asking for a link to upload a file. Eight are irreversible or leave your mailbox: sending, replying, forwarding, moving, deleting a message, updating a draft, and renaming or deleting a folder. That split is carried in the tool definitions themselves rather than written on this page.

How does my AI client know which tools to check with me about first?

Every tool carries an annotation saying whether it only reads, makes a reversible change, or does something irreversible. Your client reads those annotations and decides whether to run a tool quietly or stop and ask you. That is why the reference is organised by what a tool changes rather than by topic. Clients differ in how strictly they apply it, so the annotation is the fact and your client's behaviour is the thing to check.

How many messages can it act on in one call?

Up to 500. Marking read, marking unread, flagging, unflagging, moving and deleting all take a set of messages rather than one, so filing a morning's inbox of forty is a single call rather than forty. A request for 501 is refused outright rather than quietly acted on for the first 500. If part of a batch fails, the result names which messages did not work and why, because IMAP has no transaction and a batch really can half-work.

Can it delete my email permanently?

No. Deleting a message moves it to Trash, exactly as pressing Delete in Outlook would, and you can take it back out. There is no tool that empties a folder and no tool that purges Trash, deliberately. Deleting a folder is refused outright while that folder still holds messages or has sub-folders inside it, and the refusal says what to do instead.

Why is changing a draft listed as destructive?

Because IMAP cannot edit a message once it exists. Only its flags can change, so "edit this draft" is really "save the new version and remove the old one", which is exactly what Outlook does when you edit a draft and save it. The version you replaced is gone rather than sitting in Trash, and that is deliberate: the alternative fills your bin with every wording you rejected. It is the only thing on this surface that removes something outright, it only ever applies to unsent drafts, and the new version is saved before the old one goes, so a failure halfway through leaves you with two drafts rather than none. The annotation is set honestly so your client asks you first, even though the tool sends nothing and reaches nobody.

Does it tell me when a message I sent bounced?

It can find the bounce when you ask. A send is reported successful when the sending server accepts the message, which is not the same as delivered: delivery happens minutes later on somebody else's server, and the bounce comes back as a separate message long after the send finished. The tool looks in Inbox and Junk, because a bounce is automated mail from an unfamiliar server and that is close to a description of what a spam filter targets, and it says whether each failure is permanent or temporary. That difference matters: resending fixes one of them and delivers the message twice on the other.

Does forwarding keep the original attachments?

Yes, including inline images, and the result names the files it sent. Anything you attach yourself goes in addition to the original's files rather than instead of them. The ceiling is 10 MB for the whole message rather than per file, so three 4 MB files are refused, and a carried file too large to fit is reported as skipped by name so you know the recipient will not get it.

Can it check whether my own domain is set up to be trusted?

It checks the SPF, DKIM, DMARC and MX records of the connected mailbox's own domain, and only that domain. Two results are worth reading rather than skimming. A DMARC record set to p=none passes every checkbox and instructs receiving servers to do nothing, so the tool says so in a note instead of showing a pass. And a DKIM key that could not be found is reported as a failed lookup rather than as a missing record, because those mean opposite things and a key may simply be published under a selector the check does not know.

Can it schedule a message to send later?

No. There is no scheduling tool and nothing runs while you are away. Every tool on this server acts inside a conversation, when you ask for it. If you want a message to go out on Tuesday morning, save it as a draft and send it on Tuesday morning, or use whatever your mail client already offers. Setting an out-of-office reply for a future date range is not an exception: that is a setting Microsoft applies at the time, exactly as it would if you had set it in Outlook, and nothing of ours is running when it does.

Which mailboxes get the calendar tools?

Three kinds. A Microsoft 365 mailbox, once its owner has approved calendar access when connecting. A Google calendar on any mailbox, connected by signing in to Google once, which is separate from the mail because an app password cannot reach a diary. And any mailbox at all whose owner gives the address of a CalDAV calendar server, which Fastmail, iCloud, Nextcloud and most mail hosts run - on Fastmail and iCloud the same app password opens the mail and the diary. How many tools arrive differs by route: Microsoft answers for all of them, a CalDAV server for as many as it implements, and Google for what you left ticked on its consent screen. A mailbox with no calendar connected gets the email tools and no calendar tools at all - not tools that would refuse, but no tools. That is deliberate: one certain to fail still spends a call against your daily allowance to say so, invites the model to try again a different way, and advertises a capability you did not buy.

Will it book a meeting over somebody who is busy?

Not on the strength of an answer it could not read. When a person's free/busy cannot be seen - a different organisation, or permission never granted - that person comes back as unknown, and unknown is never rendered as free. Microsoft reports those one attendee at a time inside an otherwise successful response, which is exactly how an integration ends up booking over an afternoon it could not see. What comes back for people who can be read is their busy and free blocks, never the subjects of their meetings.

Can it change a whole recurring meeting by accident?

It will not guess. A weekly meeting is two things at once, the series and each date it falls on, and Outlook keeps them apart. So does this: changing an event that is part of a series requires you to say which you meant, and there is no default. Reading the diary shows a repeating meeting on every date it falls on, the way Outlook does, with the id of the series each occurrence belongs to.

Will it email people without me knowing?

Every tool that puts a message in somebody else's inbox says so in its own description, names who will receive it in the result, and carries the annotation that makes your AI client stop and ask first. Inviting people to a meeting, rescheduling one, cancelling one, forwarding an invitation and answering an invitation all send real email from your address. Blocking time in your own calendar sends nothing, and the tool that deletes an event refuses the moment anybody else is invited rather than quietly removing it from your diary while everybody else keeps holding the time.

Keep going

Read next

How a request reaches your mailbox

One request followed from your sentence to your mail server and back, with the tools grouped by capability instead.

What an email MCP server is

The protocol underneath all of this, quoted from the current specification rather than recalled.

Replies an AI writes that people actually get

Threading headers, quoting, the answered flag, and what a reply looks like at the other end.

What is held, and what is never stored

Credentials, encryption at rest, and the things this server has no database to keep.

Twenty-eight tools, on your own mail.

A list is a list until it runs against a real mailbox. 5 calls a day free, on any mailbox, with no card.