Tool reference
Twenty-eight email tools. What each one does.
This is the whole surface. Eleven tools that only read, nine that change something you can change back, and eight your AI client stops and asks about before it runs them. A mailbox with a calendar connected gets up to twenty-one calendar tools as well. Each one is listed with what it does and where it refuses.
- Tool surface 28 email, up to 21 calendar
- Messages a call Up to 500
- Calls a day 5 free, 1,000 on Pro
The split
What your AI client asks you about
Every tool this server publishes arrives with more than a name and a set of arguments. It also carries an annotation saying what running it would do to the mailbox: whether it only reads, whether the change it makes can be put back, or whether it is irreversible or leaves the mailbox altogether. Your client reads those annotations and uses them to decide whether to run a tool quietly or stop and ask you first.
That is why this page is organised the way it is. Grouping by reading, writing and filing describes the product. Grouping by what your client will interrupt you for describes what is about to happen in your inbox. One of those is more useful before you connect a mailbox than after.
Eleven email tools only read, and nothing in the mailbox changes when they run. Nine make a change you can undo: a flag can be cleared, a message marked read can be marked unread, a draft can be deleted out of Drafts. Eight are irreversible or outward-facing, and those are the ones a host application stops on. The calendar tools are split on the same axis by the same annotations, and the line falls in a different place: booking a meeting is reversible, because cancelling it reaches everybody the invitation did.
Reading a message never marks it read. Every read tool
that opens a folder opens it read-only, and fetches with
BODY.PEEK, the IMAP command that deliberately leaves the
Seen flag alone. That costs an extra round trip on every fetch and most
integrations do not pay it, which is why an assistant going through your
inbox on this server does not quietly clear the unread markers you were
relying on. Marking read is a separate tool and needs a separate
instruction.
Clients differ in how strictly they apply the annotations, and some ask about more than others. The annotation is the fact; your own client's behaviour is the thing to check, in the same way that its connector settings, not our list, is what decides whether it can reach a remote server at all.
Reference
The twenty-eight email tools, by what they change
Every one of the email tools this server registers, taken from its own registration code, and every mailbox gets all of them. A tool that is not on this list cannot be called, by any client, however it is asked. Each row also carries the capability it belongs to, so the filing tools are still findable in a list ordered by consent. A Microsoft 365 mailbox gets twenty-one calendar tools on top of these.
Nothing in the mailbox changes
Your client can run these without stopping to ask, because there is nothing to undo afterwards. Reading a message does not even mark it read: every one of these that opens a folder opens it read-only and fetches with BODY.PEEK, the IMAP command that deliberately leaves the Seen flag alone. That costs an extra round trip, and most integrations do not pay it.
-
list_mailboxesReadLists every folder in the mailbox with the role the server reports for each. Roles come from the server's own LIST flags rather than from folder names, so it works on an account whose Sent folder is not called Sent.
-
list_emailsReadLists the most recent messages in a folder, newest first. Summaries only, never message bodies.
-
read_emailReadOpens one message in full, with its body, recipients and attachments. Does not mark it read, and exposes the sender's Reply-To header where there is one, because that is where a reply will actually go.
-
read_threadReadReads a whole conversation in one call, oldest first, from any single message in it. Long threads are capped and the result says so rather than quietly returning the newest few.
-
search_emailsReadSearches up to 25 folders in one call, by sender, recipient, subject, body, date range, read state, flag state and attachment presence. Results are capped, and the response reports the total, the number returned and whether it capped.
-
find_contactReadResolves a person's email address from the mailbox's own history. An address you have sent to outranks one that merely arrived from somebody using that name, because a display name on inbound mail can say anything.
-
check_bouncesCheckFinds messages that came back undelivered, in Inbox and Junk, and says whether each failure is permanent or temporary. Resending fixes one of those and duplicates the other.
-
check_deliverabilityCheckChecks the SPF, DKIM, DMARC and MX records of the connected mailbox's own domain. It says when a DMARC record is set to p=none and is therefore doing nothing, and it keeps a failed lookup apart from a missing record.
-
check_uploadCheckLooks for what an upload link received, and hands the assistant a reference to each file so it can attach them. Says plainly when nothing has arrived yet, which usually means the upload is not finished rather than that anything failed.
-
check_receiptsCheckFinds the confirmations that came back for messages you sent: a delivery confirmation, meaning the recipient's server accepted it, and a read receipt, meaning their mail program reported it was opened. It says in the result that a missing receipt is evidence of nothing, because most mail programs never send one and most people decline when asked. A receipt reporting that a message was deleted unopened is reported as exactly that.
-
list_identitiesSendLists the addresses this mailbox is allowed to send as, and says which one is used when none is named. Aliases are added by the mailbox owner in their account rather than through the connector, and each carries its own name and signature. It opens no connection and changes nothing.
Changes something you can change back
A flag can be cleared, a message marked read can be marked unread, and a draft sits in Drafts until you send or delete it. Whether your client asks before running one of these is its decision rather than ours, and clients differ.
-
create_upload_linkFileProduces a one-off link for putting a file from your own computer into the mailbox, for when it is not already there and has no web address. No sign-in: an assistant that can run commands uploads to it directly, and one that cannot hands you the link to drop files on. The files land in your own Drafts as a draft you can open, keep or delete.
-
create_folderFileCreates a folder, applying the server's own hierarchy and naming rules, and subscribes it so mail clients that list only subscribed folders actually show it.
-
draft_emailSendSaves a message to the real Drafts folder without sending it, so it appears in Outlook or webmail to edit, send or delete. A real draft, not a record of one.
-
draft_replySendSaves a reply to Drafts instead of sending it, with the original quoted underneath and the hidden headers that attach it to the conversation. That second part is why it is a separate tool: a draft written as an ordinary message can carry a "Re:" subject and still arrive as a brand new conversation, and nobody notices until the thread does not group. This is the one to use when you want to read a reply over before it goes. The message it answers is not marked as replied to, because it has not been yet.
-
draft_forwardSendSaves a forward to Drafts instead of sending it, carrying the original message and its files exactly as a sent forward would. A forward is the message where reading it over first matters most, because the part you are passing on is not yours. It names the files travelling with it, and names any the size limit would not take, which is worth more here than on a send: you still have time to do something about a missing one. The original is not marked as forwarded, because it has not been.
-
mark_readFlagMarks up to 500 messages read in one call. This is the deliberate act; reading a message never does it.
-
mark_unreadFlagMarks up to 500 messages unread again in one call.
-
flag_emailFlagSets the flag or star marker that Outlook and Gmail show, on up to 500 messages in one call.
-
unflag_emailFlagClears that flag or star marker, on up to 500 messages in one call.
Irreversible, or seen by somebody else
A sent message cannot be recalled and a moved message is no longer where it was, so hosts prompt before these run. No mail is destroyed here: deleting moves a message to Trash exactly as pressing Delete in Outlook would, and there is deliberately no tool that empties a folder. The single exception is not mail at all. Updating a draft removes the version it replaces, because the alternative is a bin filling up with drafts you abandoned, and the new version is saved before the old one goes.
-
move_emailFileMoves up to 500 messages to another folder in one call, using the IMAP MOVE command, so read state, flags and the original dates all survive the move.
-
delete_emailFileMoves up to 500 messages to Trash in one call, exactly as pressing Delete would. Recoverable: nothing on this surface erases mail permanently.
-
update_draftSendRewrites a draft that is already in the Drafts folder, so changing your mind about the wording replaces the draft rather than leaving the old version behind. IMAP cannot edit a message in place, so this saves the new version and removes the previous one, which is what your own mail client does when you edit a draft and save it. The alternative would put every abandoned version in your bin. The files already attached and the hidden headers that hold a reply in its conversation both survive the edit. It is grouped with the destructive tools because the version it replaces is gone rather than recoverable, and your assistant should ask before it runs.
-
rename_folderFileRenames a folder and moves it under a different parent in one operation, the way a mail client's folder editor does. Sub-folders travel with it, and their subscriptions are carried across.
-
delete_folderFileDeletes a folder, and refuses one that still holds messages or has sub-folders inside it. It unsubscribes as well as deleting, so no phantom folder is left behind.
-
send_emailSendSends a new message from the connected address, or from any alias on the mailbox when one is named, with files attached if any are passed. Exactly one copy is filed in the real Sent folder.
-
reply_emailReplyReplies inside the original thread, quotes the original below the new text, files a copy in Sent and marks the original answered. A Reply-To pointing somewhere the message did not come from is refused until the caller names that address.
-
forward_emailForwardForwards a message, carrying the original's attachments and inline images, under the forwarded-message block a real mail client produces. A carried file that will not fit the 10 MB message ceiling is reported as skipped by name. Recipients are exactly the addresses supplied.
A capped result says that it capped
Two of the read tools can match more than fits in one answer, and both say so rather than handing back the first few and letting the model assume that was everything. A search reports the total it matched, the number it returned, and whether it capped. Checked against a folder of 500 messages, it reported a total of 500, fifty returned, and capped set true. Reading a thread behaves the same way, and trims the quoted text from earlier replies so the same paragraph is not repeated twelve times.
Connected separately
The twenty-one calendar tools
Connect a Microsoft 365 mailbox and approve calendar access, and your AI client is handed these as well: forty-nine tools in all. Every other mailbox has two ways to a diary and can take either, whoever hosts the mail: sign in to Google for a Google calendar, or give the address of a CalDAV calendar server. How many of these arrive then depends on the route, because Google answers for the permissions you approved and a CalDAV server for what it turns out to implement. Until a calendar is connected you get none of them, and your client is told nothing about a diary this mailbox does not have.
An absent tool is a better answer than a tool that always refuses. One that is certain to fail still spends a call against your daily allowance to say so, still invites the model to try again a different way, and still advertises something you did not buy. So the server reads what your connection actually covers and registers accordingly, and the list your client shows you is the list that will work.
That is why the number below is a ceiling rather than a promise. Microsoft 365 answers for all of them. A calendar server reached by its address answers for as many as it implements, which is asked when the calendar connects rather than assumed: one will send invitations to other people and report who is free, another only stores events. Two customers on the same protocol can legitimately be offered different lists, and each list is the one that works.
Two things about this surface are worth knowing before you read the rows. Every time comes back in your mailbox's own timezone, stated rather than assumed, because a diary answer with an unstated timezone is a wrong answer waiting for a plane journey. And when somebody's free/busy cannot be read, the answer is unknown and never free - Microsoft reports those one attendee at a time inside an otherwise successful response, which is precisely how an integration ends up booking over an afternoon it could not see.
Nothing in the mailbox changes
Your client can run these without stopping to ask. They read the diary and the mailbox's own settings, and nothing in either changes. What comes back about other people is their busy and free blocks, never the subjects of their meetings.
-
list_calendarsRead the diaryLists every calendar the mailbox can see, including shared ones, and reports the mailbox's timezone and working hours. A calendar that can be read and not written to is marked as such, so nothing is offered that would then be refused. This is the call that makes every other time on this surface statable: without the timezone, "three o'clock" is a guess.
-
list_eventsRead the diaryLists what is in the diary between two dates, newest first within the window. A recurring meeting appears on every date it falls on, each one carrying the id of the series it belongs to. Each event says whether the mailbox owner organises it and how many people are invited, so a block of your own time is never mistaken for a meeting. A capped result says it capped.
-
read_eventRead the diaryOpens one event in full: everybody invited and how each of them answered, the recurrence written out in words rather than as a rule, the join link for an online meeting, the body, the categories and the reminder. It says whether you are holding one date of a series or the series itself, which is what decides what a later change would apply to.
-
search_eventsRead the diaryFinds events between two dates by free text, matched against the subject, the location and the organiser. The window is required rather than optional: a diary has no end, so "when did I last meet Alice" means nothing without one, and the result repeats back the window it searched so the answer can be trusted or widened.
-
check_availabilityFind a timeAsks when a group of people are free, returning busy blocks rather than what is in their diaries. Somebody whose calendar cannot be read comes back as unknown and never as free: those are different answers, and treating the first as the second is how a meeting gets booked over somebody's afternoon.
-
find_meeting_timesFind a timeAsks Microsoft for times a meeting would actually fit, ranked, honouring each attendee's working hours and each one's answer to whether they are needed. Where no time works it says which attendees are the reason, rather than returning nothing.
-
list_categoriesReminders and categoriesLists the categories this mailbox has defined, with the colour Outlook shows for each, so an event can be filed under the labels its owner already uses instead of new ones invented by an assistant.
-
read_out_of_officeOut of officeReads the out-of-office reply as it currently stands: whether it is on, the period it runs for if it is scheduled, and both messages - the one people inside your organisation get and the one everybody else gets.
Changes something you can change back
These change something, and every change can be changed again. That includes the ones that send email: a meeting can be rescheduled or cancelled, and the message reaches everybody the first one did. Each tool that will email somebody says so, and says who, before your client runs it.
-
create_eventBook your own timeBlocks time in your own calendar, optionally repeating daily, weekly or monthly, with a reminder, a category and a show-as state. Nobody is invited and no email is sent: this is the tool for your own time, and inviting people is a different tool that says so.
-
update_eventBook your own timeChanges an event you own - the time, the subject, the location, the reminder. Where the event is part of a series it requires you to say whether the change is to this occurrence or to the whole series, and will not guess, because guessing wrong rewrites a year of Mondays.
-
schedule_meetingMeet other peopleInvites people to a meeting, optionally as an online meeting with a join link, marking each attendee required or optional. Real invitations go out from your address, so the result says who received one. Repeating the same request does not create a second meeting.
-
update_meetingMeet other peopleChanges a meeting other people are on, and tells them. Moving the time or adding an attendee sends the update Outlook would send, and the result names everybody it reached rather than reporting a bare success.
-
respond_to_invitationAnswer invitationsAccepts, tentatively accepts or declines an invitation, with an optional note to the organiser, and lets you choose whether the organiser is told at all - which is the difference between declining a meeting and declining it publicly.
-
propose_new_timeAnswer invitationsDeclines an invitation and suggests a different time in the same action, which is the answer most people actually want to give. Where the organiser has turned proposals off, that is reported plainly instead of being attempted and failing.
-
forward_eventMeet other peopleForwards an invitation to somebody who was not on it, with a comment. The organiser is told, exactly as Outlook tells them, so nobody is quietly added to a meeting.
-
set_out_of_officeOut of officeTurns on the out-of-office reply, either indefinitely or for a date range, with a different message for people outside your organisation. It is the same setting Outlook writes, so it appears in Outlook and turns itself off at the end of the period.
-
clear_out_of_officeOut of officeTurns the out-of-office reply off, and says what it was set to before it was cleared.
-
snooze_reminderReminders and categoriesSnoozes an event's reminder until a time you state, the way pressing Snooze in Outlook does.
-
dismiss_reminderReminders and categoriesDismisses an event's reminder so it does not fire again.
Irreversible, or seen by somebody else
Two, and only two, cannot be taken back. Deleting an event refuses outright the moment anybody else is invited, and points at the tool that cancels a meeting properly instead - so an invitation is never quietly removed from your own diary while everybody else keeps holding the time.
-
delete_eventBook your own timeDeletes an event nobody else was invited to. It refuses the moment anybody is on it and names the tool that cancels a meeting properly instead, so an invitation is never removed from your own diary while everybody else keeps holding the time.
-
cancel_meetingMeet other peopleCancels a meeting and emails everybody invited, with a message if you want one. This is the only correct way to remove a meeting other people hold, and it cannot be taken back once the cancellations are out.
A series is not one of its dates
A weekly meeting is two different things at once: the series, and each Tuesday it lands on. Outlook keeps them apart and so does this. Changing an occurrence needs you to say which you meant, and it will not guess, because guessing wrong rewrites a year of Tuesdays and the person finds out in a meeting they no longer have.
Batching
Five hundred messages in one call
Every tool that changes messages takes a set rather than a single message, and it will take up to 500 of them at once.
That is mark_read, mark_unread,
flag_email, unflag_email,
move_email and delete_email. Filing a
morning's inbox of forty messages is one call rather than forty, and
clearing a year of newsletters is one call rather than several hundred.
Under a plan with a daily ceiling that is the whole difference between a limit you meet and one you never see. Free is 5 MCP calls a day and Pro is 1,000 a day, both per mailbox, and Pro is a published ceiling rather than an unlimited plan. Pro is £2.92 a month, paid annually at £34.99 + VAT, per mailbox; the pricing page states both ceilings and the same figures.
- mark_read, 500 messages 340 ms
- flag_email, 500 messages 252 ms
- move_email, 500 messages 187 ms
- delete_email, 500 messages 175 ms
Those four were timed on 2026-08-27 against a real server, at 500 messages a call, and they are the reason the batch limit is worth having rather than a number in a specification.
A request for 501 is refused rather than quietly truncated. Acting on the first 500 of 501 and reporting success is the failure that actually matters at a ceiling: you would have no way of knowing which message was left behind, and the report would tell you nothing was.
Partial failure is named the same way. IMAP has no transaction, so a batch really can half-work, and every result lists which messages succeeded and which did not and why, rather than returning a clean success. Verified live with one real message and 499 that did not exist: it did the real work, said so, and named what it could not touch.
What this looks like in practice is covered by the guide to triaging a full inbox and the guide to filing and folders, which also explains why a move keeps the read state, the flags and the original date instead of stamping everything with today's.
Batching is the part you can only judge on your own mailbox. The free tier is 5 MCP calls a day, with no card, and one of them will file a few hundred messages.
Delivery
Email that bounced, and what to do next
A send is reported successful when the sending server accepts the message, which is not the same as delivered. Delivery happens minutes later, on somebody else's server, and if it fails the bounce comes back as an ordinary message in your inbox long after the send tool answered. Every mail system works this way. Most tools stop at the acceptance and leave the rest to you.
check_bounces is the tool that goes and looks. A panel
listing bounces is something nobody opens. An assistant noticing, inside
the same conversation, that the quote you sent an hour ago came straight
back is the part worth having.
Each result says which kind of failure it was, and the two want opposite responses. An assistant told only that something bounced gets one of them wrong, and it is a coin flip which.
| Failure | What it means | What resending does |
|---|---|---|
| Permanent | The address is wrong, or the mailbox no longer exists. | Nothing. The same message comes back again. |
| Temporary | The receiving server was busy and the sending server is still retrying. | Delivers the message twice. |
Junk is scanned as well as Inbox, by default. A bounce is automated mail arriving from an unfamiliar server with no prior correspondence, which is close to a description of what a spam filter is built to catch, so searching only the inbox would miss the ones you most need to see.
This was proven end to end on 2026-08-27 against real bounces from a real mail transfer agent, rather than against hand-written test fixtures, and the distinction is not pedantry. A parser and the fixtures that test it, written by the same person in the same afternoon, agree with each other whether or not either agrees with a real mail server. Sixteen unit tests passed while the tool could not read a bounce produced by the mail server this project itself sends through. It was found by sending mail that could not be delivered and then reading the mailbox with something other than the tool under test.
Addressing
Finding an email address in your own history
find_contact resolves a person's email address out of the
mailbox's own history, from a name or part of one. There is no address
book of ours behind it and nothing is uploaded anywhere: it is your own
mail, searched.
The interesting part is the order it puts the candidates in. An address you have sent to always outranks one that merely arrived from somebody using that name.
| Signal | Rank | Why it ranks there |
|---|---|---|
| An address you have sent to | First | Nobody but you can put an entry in your Sent folder. |
| An address that arrived using that name | Second | A display name on inbound mail can say anything the sender likes. |
| Two candidates carrying the same signal | Recency decides | The more recent correspondence is the one still in use. |
That is a security property rather than a convenience. Anyone can put any display name they like on a message they send you, and plenty of people do it deliberately. Nobody can put an entry in your Sent folder. Rank those two the other way round and an assistant asked to reply to a colleague addresses the mail to whoever last impersonated one.
reply_email guards the same corner from the other side.
Recipients come from the original message, using its
Reply-To header where the sender set one and
From otherwise, and if a message carries a
Reply-To pointing somewhere it did not come from, the tool
refuses to send until the caller names that address explicitly. That is
the exact shape of a common phishing technique: mail that looks like it
came from someone you know, with the replies quietly routed elsewhere.
The security page sets out
what is held, what is encrypted and what is never stored.
Reputation
SPF, DKIM and DMARC on your own domain
check_deliverability reads the four DNS records that decide
whether the servers you send to believe your mail is really yours. It
checks the connected mailbox's own domain and only that domain: it
cannot look anyone else's up, which is deliberate.
| Record | What it decides | Where it lives |
|---|---|---|
| SPF | Which servers are allowed to send using your domain. | A TXT record on the domain itself. |
| DKIM | Whether a message really left your domain unaltered, proved by a signature. | A TXT record on a selector subdomain, which is why a check has to know the selector to find it. |
| DMARC | What a receiving server should do when SPF or DKIM fails. | A TXT record at _dmarc on the domain. |
| MX | Where mail addressed to your domain is delivered. | The domain's own MX records. |
A DMARC record can pass and still do nothing
A DMARC record set to p=none is present, valid, and
instructs receiving servers to take no action at all when a message
fails. It passes every checkbox a deliverability checker has. The tool
says so in a note instead of showing it as a pass, because a green
tick there is worse than no check: it tells you a thing is protected
when what you have is a record that reports and enforces nothing.
The second trap is quieter. A DKIM key the check could not find is reported as a failed lookup rather than as a missing record, because those mean opposite things and the tool keeps them apart. A key may simply be published under a selector the check does not know about, and telling you that your signing is missing when it is working is how somebody ends up rebuilding a mail setup that was fine.
None of this is unique to us as information. What is different is that an assistant can ask for it in the middle of working out why a customer never replied, rather than you opening a separate tool and pasting a domain into it.
Limits
What these tools will not do
Twenty-eight is the whole list, so everything absent from it is absent on purpose. These are the ones people ask for.
-
Nothing is scheduled
It cannot schedule a send. Everything happens when you ask for it, and nothing runs while you are away.
-
Results are capped
Search results and long threads are capped. The response reports the total, the number returned and whether it capped, but a very broad search will meet the cap.
-
10 MB a message
Attachments are capped at 10 MB per message in total across every file attached, which is our limit rather than a provider's.
-
Search is literal
Search is substring matching over IMAP. There is no stemming and no ranking, so a search for invoices does not find a message that only ever says invoice.
-
Your own domain only
The deliverability check reads the connected mailbox's own domain only. It will not look up a customer's domain, or a competitor's.
-
Folders with mail in them
Deleting a folder is refused while it still holds messages or has sub-folders inside it. There is no Trash to recover a folder from, and what reaches this tool is a model acting on a sentence rather than a person looking at the folder.
-
Deleted mail is gone
It cannot recover mail that has already been deleted.
-
Not a backup tool
It does not archive, back up or export a mailbox, and it is not a migration tool.
-
A calendar has to be connected separately
Calendar tools appear once a diary is connected, which is its own step: calendar access approved on a Microsoft 365 sign-in, a Google sign-in for Google Calendar, or the address of a CalDAV calendar server. A mailbox with none of the three gets the email tools and no calendar tools at all.
-
No contacts, no files
It does not manage a contacts list or a file store. Addresses are resolved from the mailbox's own history rather than from an address book, and attachments are handled as mail rather than as documents.
-
Unknown is not free
When somebody's calendar cannot be read, the answer is unknown rather than free. Free/busy across organisations depends on an arrangement between them, and a name that comes back blank has told you nothing.
-
No room browsing
It cannot list the meeting rooms an organisation has. Reading a room directory needs a permission only an IT administrator can approve, and asking every customer for that to power one convenience is the wrong trade. A room with an email address can still be invited and its free/busy checked, exactly like a person.
-
No files on calendar events
Files attached to a calendar event are not read or written yet. Attachments on email are, and event attachments are a separate piece of work rather than an oversight.
-
No shared mailboxes
Shared and delegated mailboxes are not supported. A shared CALENDAR is a different thing and is supported on Microsoft 365: one that has been shared with you can be read, and written to where the person who shared it allowed that.
-
Both plans have a ceiling
Both plans have a daily ceiling on MCP calls: 5 a day on Free and 1,000 a day on Pro, per mailbox. Pro is a published limit, not an unlimited plan.
-
Only this server's tools
These limits describe the tools this server registers. Another vendor's mail MCP server has a different list, and the only way to know theirs is to read it.
Where the figures on this page come from
The timings, the attachment behaviour and the batch ceiling were measured while the engine was built, against a live mailbox of 26,930 messages across 6.63 GB. How it works gives each measurement with the method beside it, and follows one request from your sentence to your mailbox and back. If a claim here cannot be checked on your own mail with a free account, it should not be here.
Questions
Questions about the tools
How many tools are there, and what does each kind do?
Twenty-eight email tools on every mailbox, plus up to twenty-one calendar tools once a calendar has been connected, so at most forty-nine in all. A Microsoft 365 mailbox with calendar access approved gets every one of the calendar tools; a Google calendar gets as many as the permissions you approved cover, and never the out-of-office or the counter-proposal, which Google has no equivalent of; a calendar reached at a CalDAV address gets as many as that server supports, which is asked when it connects. Taking the email tools, the split that matters is what each one changes. Eleven only read, so nothing in the mailbox moves when they run. Nine make a change you can put back: creating a folder, saving a draft, marking read or unread, flagging or unflagging, and asking for a link to upload a file. Eight are irreversible or leave your mailbox: sending, replying, forwarding, moving, deleting a message, updating a draft, and renaming or deleting a folder. That split is carried in the tool definitions themselves rather than written on this page.
How does my AI client know which tools to check with me about first?
Every tool carries an annotation saying whether it only reads, makes a reversible change, or does something irreversible. Your client reads those annotations and decides whether to run a tool quietly or stop and ask you. That is why the reference is organised by what a tool changes rather than by topic. Clients differ in how strictly they apply it, so the annotation is the fact and your client's behaviour is the thing to check.
How many messages can it act on in one call?
Up to 500. Marking read, marking unread, flagging, unflagging, moving and deleting all take a set of messages rather than one, so filing a morning's inbox of forty is a single call rather than forty. A request for 501 is refused outright rather than quietly acted on for the first 500. If part of a batch fails, the result names which messages did not work and why, because IMAP has no transaction and a batch really can half-work.
Can it delete my email permanently?
No. Deleting a message moves it to Trash, exactly as pressing Delete in Outlook would, and you can take it back out. There is no tool that empties a folder and no tool that purges Trash, deliberately. Deleting a folder is refused outright while that folder still holds messages or has sub-folders inside it, and the refusal says what to do instead.
Why is changing a draft listed as destructive?
Because IMAP cannot edit a message once it exists. Only its flags can change, so "edit this draft" is really "save the new version and remove the old one", which is exactly what Outlook does when you edit a draft and save it. The version you replaced is gone rather than sitting in Trash, and that is deliberate: the alternative fills your bin with every wording you rejected. It is the only thing on this surface that removes something outright, it only ever applies to unsent drafts, and the new version is saved before the old one goes, so a failure halfway through leaves you with two drafts rather than none. The annotation is set honestly so your client asks you first, even though the tool sends nothing and reaches nobody.
Does it tell me when a message I sent bounced?
It can find the bounce when you ask. A send is reported successful when the sending server accepts the message, which is not the same as delivered: delivery happens minutes later on somebody else's server, and the bounce comes back as a separate message long after the send finished. The tool looks in Inbox and Junk, because a bounce is automated mail from an unfamiliar server and that is close to a description of what a spam filter targets, and it says whether each failure is permanent or temporary. That difference matters: resending fixes one of them and delivers the message twice on the other.
Does forwarding keep the original attachments?
Yes, including inline images, and the result names the files it sent. Anything you attach yourself goes in addition to the original's files rather than instead of them. The ceiling is 10 MB for the whole message rather than per file, so three 4 MB files are refused, and a carried file too large to fit is reported as skipped by name so you know the recipient will not get it.
Can it check whether my own domain is set up to be trusted?
It checks the SPF, DKIM, DMARC and MX records of the connected mailbox's own domain, and only that domain. Two results are worth reading rather than skimming. A DMARC record set to p=none passes every checkbox and instructs receiving servers to do nothing, so the tool says so in a note instead of showing a pass. And a DKIM key that could not be found is reported as a failed lookup rather than as a missing record, because those mean opposite things and a key may simply be published under a selector the check does not know.
Can it schedule a message to send later?
No. There is no scheduling tool and nothing runs while you are away. Every tool on this server acts inside a conversation, when you ask for it. If you want a message to go out on Tuesday morning, save it as a draft and send it on Tuesday morning, or use whatever your mail client already offers. Setting an out-of-office reply for a future date range is not an exception: that is a setting Microsoft applies at the time, exactly as it would if you had set it in Outlook, and nothing of ours is running when it does.
Which mailboxes get the calendar tools?
Three kinds. A Microsoft 365 mailbox, once its owner has approved calendar access when connecting. A Google calendar on any mailbox, connected by signing in to Google once, which is separate from the mail because an app password cannot reach a diary. And any mailbox at all whose owner gives the address of a CalDAV calendar server, which Fastmail, iCloud, Nextcloud and most mail hosts run - on Fastmail and iCloud the same app password opens the mail and the diary. How many tools arrive differs by route: Microsoft answers for all of them, a CalDAV server for as many as it implements, and Google for what you left ticked on its consent screen. A mailbox with no calendar connected gets the email tools and no calendar tools at all - not tools that would refuse, but no tools. That is deliberate: one certain to fail still spends a call against your daily allowance to say so, invites the model to try again a different way, and advertises a capability you did not buy.
Will it book a meeting over somebody who is busy?
Not on the strength of an answer it could not read. When a person's free/busy cannot be seen - a different organisation, or permission never granted - that person comes back as unknown, and unknown is never rendered as free. Microsoft reports those one attendee at a time inside an otherwise successful response, which is exactly how an integration ends up booking over an afternoon it could not see. What comes back for people who can be read is their busy and free blocks, never the subjects of their meetings.
Can it change a whole recurring meeting by accident?
It will not guess. A weekly meeting is two things at once, the series and each date it falls on, and Outlook keeps them apart. So does this: changing an event that is part of a series requires you to say which you meant, and there is no default. Reading the diary shows a repeating meeting on every date it falls on, the way Outlook does, with the id of the series each occurrence belongs to.
Will it email people without me knowing?
Every tool that puts a message in somebody else's inbox says so in its own description, names who will receive it in the result, and carries the annotation that makes your AI client stop and ask first. Inviting people to a meeting, rescheduling one, cancelling one, forwarding an invitation and answering an invitation all send real email from your address. Blocking time in your own calendar sends nothing, and the tool that deletes an event refuses the moment anybody else is invited rather than quietly removing it from your diary while everybody else keeps holding the time.
Keep going
Read next
Twenty-eight tools, on your own mail.
A list is a list until it runs against a real mailbox. 5 calls a day free, on any mailbox, with no card.