Gmail Postmaster Tools v2 MCP server (stdio, zero dependencies)
The server defines 7 tools with explicit schemas and descriptions in server/index.js. Most tools have clear, actionable descriptions (100-200 chars range), and all input schemas are properly declared with type definitions and additionalProperties guards. However, several critical gaps prevent a higher score: (1) output schemas are entirely undocumented, tool descriptions state what they call (GET /v2/domains, POST /v2/domains/{domain}/domainStats:query) but do not describe the response structure, fields, or which IDs/references are included for chaining; (2) error handling is minimal, responses are formatted with HTTP status labels but lack recovery guidance (e.g., 'run gpt_authenticate' is mentioned for auth issues, but other 400/403/404 responses offer generic instructions); (3) several tool descriptions embed example values (e.g., 'mail.example.com', 'example.com') which LLMs may reuse literally; (4) the three auth tools (gpt_authenticate, gpt_auth_status, gpt_sign_out) have empty input schemas and vague parameter documentation is absent, these are acceptable given they take no parameters, but descriptions could reference prerequisites more explicitly; (5) query_domain_stats has a complex metrics array parameter with anyOf union types, but the description mixes prose explanations of metric names and filter requirements rather than documenting the response format or pagination.
Get the sender compliance status for a domain — verdicts for SPF, DKIM, DMARC, alignment, message formatting, DNS records, encryption, user-reported spam rate, and one-click / honored unsubscribe. Calls GET /v2/domains/{domain}/complianceStatus.
Get metadata for a single registered domain (verification state, permission, timestamps). Calls GET /v2/domains/{domain}.
Check whether you are signed in to Gmail Postmaster Tools and when the access token expires.
Sign in to Gmail Postmaster Tools. Opens your browser for a Google account login (OAuth 2.0 authorization-code + PKCE over a 127.0.0.1 loopback) using the Google OAuth client you configured, and caches the tokens. Run this once before fetching data.
Delete the cached Google tokens (sign out).
No output schemas documented for any tool. Tool descriptions state which API endpoints they call (GET /v2/domains, GET /v2/domains/{domain}/complianceStatus, POST /v2/domains/{domain}/domainStats:query) but do not describe response fields, types, or which IDs/references are returned for chaining subsequent calls.
Error handling lacks recovery guidance. Responses labeled with HTTP 403, 400, 404 include minimal actionable advice. For example, 403 mentions 'enable the Postmaster Tools API' or 're-run gpt_authenticate to widen scope', but 404 returns only 'domain not registered' without suggesting how to discover valid domains. LLMs cannot infer the next step without explicit recovery hints.
Tool descriptions embed example values (e.g., 'mail.example.com', 'example.com') that LLMs may reuse literally in actual calls, causing failures. These should be replaced with formal constraints (format declarations, enum constraints, or parameter documentation).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 68 | 2026-07-28+ | v2 |
List the domains registered in your Gmail Postmaster Tools account, with verification state and your permission level. Calls GET /v2/domains.
Query Gmail traffic metrics for a domain over a date range. Metrics include SPAM_RATE, AUTH_SUCCESS_RATE (filter auth_type=spf|dkim|dmarc), TLS_ENCRYPTION_RATE (filter traffic_direction=inbound|outbound), DELIVERY_ERROR_RATE/COUNT (optional filter error_type=...), FEEDBACK_LOOP_SPAM_RATE/ID. Defaults to SPAM_RATE over the last ~7 days, daily. Calls POST /v2/domains/{domain}/domainStats:query.
query_domain_stats parameter 'metrics' uses anyOf union type allowing both strings and objects, with complex filter semantics (e.g., 'AUTH_SUCCESS_RATE requires filter auth_type=spf|dkim|dmarc'). The description mixes prose examples rather than formally documenting the response structure or which metrics return which fields.
list_domains supports pagination (pageSize, pageToken) but does not document the expected response structure (whether 'nextPageToken' is returned, total count, or list field name). Without response schema documentation, LLMs cannot extract pagination tokens or know when to stop iterating.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) declared in tool schemas. gpt_sign_out is destructive (deletes cached tokens) and should carry a destructiveHint annotation to signal this to agents.