37 email tools. What each one does.

37 email tools on every mailbox. A connected calendar adds up to 21, and an address book up to 5 contact tools: 63 at most on a Microsoft 365 mailbox with its calendar and Outlook contacts. Team Access adds 6 claim and approval tools, up to 69 in all. Of the email tools, 16 only read, 9 make a change you can undo, and 12 can't be undone or reach someone else, so your AI client asks first.

Every tool carries an annotation saying whether it only reads, makes a reversible change, or does something irreversible. Your client reads those annotations and decides whether to run a tool quietly or stop and ask you. That is why the reference is organised by what a tool changes rather than by topic. Clients differ in how strictly they apply it, so the annotation is the fact and your client's behaviour is the thing to check.

Yes, in 2 places. Each connection gets a permission level when you approve it: at Read only it can list, read and search (16 of the 37 email tools) and change nothing. Change it later in the control panel, on the mailbox's Connector tab, without reconnecting. The mailbox also has its own limit there, which no connection can exceed: set it to Read only and every AI client is read-only, even one using the access token. The server enforces both.

Up to 500. Marking read or unread, flagging, unflagging, moving, archiving, reporting spam, rescuing it and deleting all take a set of messages, so filing a morning's inbox of 40 is one call, not 40. A request for 501 is refused, not quietly cut to the first 500. If part of a batch fails, the result names which messages didn't work and why. IMAP has no transaction, so a batch really can half-work.

Yes, and it goes wherever your own mail client's Archive button would put it. Microsoft 365 has a folder called Archive. Many IMAP hosts have none, so one is created and subscribed for you, and it shows in Outlook. Gmail has no archive folder: the message leaves your inbox and lives on in All Mail. The reply names the folder it used. Read state, flags and the original dates survive, so an archived backlog keeps the dates it arrived on.

Yes to both. Reporting spam moves the message into your junk folder, as your mail client's spam button does. Microsoft 365, Gmail and IMAP hosts with spam training learn from that folder, so the move is what teaches the filter. No "junk" keyword is set: few servers read one, and a refusal would make a working move look like a failure. If the filter gets one wrong, rescuing it returns it to the inbox with its original date.

No. Your AI client doesn't store the tool list when you connect. It asks the server at the start of each session, so a new tool appears in your next conversation, on the connector you already have. If a chat was left open across the change, start a new one. Nothing you set changes either. A new tool is placed in a permission level by hand before it's offered, so a connection you set to read only stays read only.

No. Deleting a message moves it to Trash, exactly as pressing Delete in Outlook would, and you can take it back out. There is no tool that empties a folder and no tool that purges Trash, deliberately. Deleting a folder is refused outright while that folder still holds messages or has sub-folders inside it, and the refusal says what to do instead.

Because IMAP can't edit a message once it exists. "Edit this draft" really means saving the new version and removing the old one, which is what Outlook does too. The old version is gone, not in Trash, so your bin doesn't fill with every wording you rejected. It only ever touches unsent drafts, and the new version is saved first, so a failure leaves 2 drafts, never none. It sends nothing, but it's marked so your client asks you first.

Not on its own: nothing watches your mail as it arrives. Ask, and it looks in Inbox and Junk, because a bounce often looks like spam. A send counts as successful when the sending server accepts it, which isn't the same as delivered, and a bounce can arrive minutes later. It says whether each failure is permanent or temporary. That matters: a wrong address will bounce again, and resending a delayed message delivers it twice.

Yes, including inline images, and the result names the files it sent. Anything you attach yourself goes in addition to the original's files rather than instead of them. The ceiling is 20 MB for the whole message rather than per file, so 3 files of 7 MB each are refused, and a carried file too large to fit is reported as skipped by name so you know the recipient will not get it.

read_attachment reads PDF, Word, PowerPoint, Excel, plain text, CSV, HTML and forwarded messages as text, and JPEG, PNG and GIF images as pictures. A scanned page comes back as a picture, up to 4 pages a call. Up to 20 files fit in one call. A file is judged by its first bytes, not its name. A zip, an RTF, an old .doc or .xls, or anything over 25 MB gets a sentence saying so, and its download link.

Yes. It checks the SPF, DKIM, DMARC and MX records of the connected mailbox's own domain, and only that one. 2 results deserve a careful read. A DMARC record at p=none passes every checkbox but tells receiving servers to do nothing, so the tool flags it rather than showing a pass. And a DKIM key it can't find is a failed lookup, not a missing record: it may be published under a selector the check doesn't know.

Yes, through your AI. Save the email as a draft, then ask Claude or ChatGPT something like "send my draft to Tom on Monday at 8". Your AI schedules that as a task in its own app, and at that time sends the draft exactly as it stands, edits and all. Our server doesn't hold the email, so it goes when your AI's task runs, and ChatGPT may ask you to approve the send first.

3 kinds. A Microsoft 365 mailbox, once its owner approves calendar access when connecting. Any mailbox with a Google calendar, connected by a Google sign-in of its own, because an app password can't reach a diary. And any mailbox whose owner gives the address of a CalDAV calendar server, which Fastmail, iCloud, Nextcloud and most mail hosts run. A mailbox with no calendar gets no calendar tools at all, rather than tools that would refuse.

Not on an answer it couldn't read. If a person's free/busy can't be seen, because they're in another organisation or never granted permission, they come back as unknown, and unknown is never treated as free. Microsoft reports those one attendee at a time inside an otherwise successful reply, which is how an integration ends up booking over an afternoon it couldn't see. For everyone else it gets busy and free blocks, never meeting subjects.

It will not guess. A weekly meeting is 2 things at once, the series and each date it falls on, and Outlook keeps them apart. So does this: changing an event that is part of a series requires you to say which you meant, and there is no default. Reading the diary shows a repeating meeting on every date it falls on, the way Outlook does, with the id of the series each occurrence belongs to.

Every tool that puts a message in somebody else's inbox says so in its description, names the recipients in its result, and is marked so your AI client asks first. Inviting people to a meeting, rescheduling or cancelling one, and forwarding or answering an invitation all send email from your address. Blocking your own time sends nothing. Deleting an event refuses if anybody else is invited, so it's never removed from your diary while they keep the time.