Loading ToolBench
Model Context Protocol server for Postern: read tools over the mailbox API (search/list/get/thread/get_attachment), plus optional send tools (mailbox_send / mailbox_reply, with attachments) behind a send-scoped token.
Postern MCP demonstrates solid definition quality with well-structured tool schemas and comprehensive parameter documentation. All 7 tools have explicit descriptions (194 - 450 chars, within baseline 34 - 392 range) and detailed input schemas with typed parameters. Naming follows verb_noun convention (mailbox_search, mailbox_send, mailbox_reply). However, output schemas are not documented, the rubric requires explicit return type documentation for A+ tools (100% baseline). Error handling is minimal; tools lack recovery guidance or actionable error messages. No tool annotations (readOnlyHint/destructiveHint) despite clear risk profiles (5 READ_ONLY, 2 WRITE). Parameter descriptions are thorough but could benefit from explicit format constraints (e.g., ISO date format for 'after'/'before' is stated but not formalized). Composition is strong: tools chain well (search → get → reply), and output includes necessary IDs for downstream calls.
Fetch one message by ID: headers, body, thread ID, and read state. Returns the full message object with all metadata.
Fetch one attachment by message ID and attachment index. Returns the file bytes as base64. Capped at POSTERN_MCP_MAX_ATTACHMENT_BYTES (default 5 MiB, max 25 MiB) to prevent blowing past MCP client tool-result limits.
List messages with optional filters (to, from, direction, thread, mailbox) newest-first, paginated via cursor. `direction` is the STORED fact, so to=<addr> with direction=inbound answers 'what actually ARRIVED for this address' and never returns our own sent copy; to=<addr> alone returns everything delivered to it, and to=<addr> with lens=inbox is that address's INBOX view (arrivals plus same-domain mail others sent it). `mailbox` filters by durable folder (archive, trash, junk, or all). Use mailbox_search for topic search; use this to browse or filter by participant/folder. seenFor names whose read state the seen field renders, for a shared address (e.g. a role queue) with no single reader of its own.
Reply to a message by thread ID. Requires a send-scoped token. mode='reply' sends to the original sender only; mode='replyAll' derives To/Cc from the stored original message, excluding the sender. Supports attachments (base64 content + optional filename/mimeType).
Output schemas not documented. Rubric baseline: 100% of A+ tools have documented return types. Tools return message objects, arrays, or base64 content, but no explicit schema is provided in tool definitions.
No tool annotations (readOnlyHint/destructiveHint). 5 tools are READ_ONLY, 2 are WRITE operations. Annotations enable agents to reason about side effects and retry safety. Current spec (2026-07-28) rewards tool annotations.
Error handling lacks recovery guidance. Tools do not document what errors are retryable, user-fixable, or fatal. No actionable error messages (e.g., 'Invalid recipient: must match domain rule. Allowed domains: example.com').
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 68 | 2026-07-28+ | v2 |
Search the mailbox (subject + body) and return matching messages newest-first. mode defaults to 'hybrid' (semantic + keyword). Optionally filter by direction ('inbound' = received, 'outbound' = what we sent) -- direction is the stored fact, so an inbound filter never returns a sent copy. For one address's own view pass to=<address> plus lens=inbox|sent. mode 'fts' is exact keyword matching: every word must appear, so no match means no result (use it to prove a message is NOT there). Also filter by sender (from), durable folder (mailbox), date range (after/before, inclusive ISO), attachment presence (hasAttachment), and read state (seen) -- e.g. seen=false plus mailbox=archive answers 'unread mail in Archive'. seenFor names whose read state seen/results render, for a shared address (e.g. a role queue) with no single reader of its own. This is the primary tool for finding mail by topic.
Send a message to one or more recipients. Requires a send-scoped token. Supports attachments (base64 content + optional filename/mimeType). The worker validates each recipient against its address rule and enforces the recipient cap.
Fetch all messages in a thread by thread ID, newest-first. Returns an array of message objects.
Attachment size cap (5 MiB default, 25 MiB max) documented in description but not as a parameter constraint. LLMs cannot parse this from text; should be a formal limit in schema or error response.
mailbox_send and mailbox_reply lack dry-run or confirmation step. Sending email is irreversible; agents should be able to preview before committing. No confirmation-request pattern.