Loading ToolBench
Exposes Apple Mail database access via the Model Context Protocol. Allows AI assistants to browse, search, and read emails from the local Mail database.
Server has 21 tools with mostly complete schemas and descriptions. Naming follows verb_noun convention well (list_, get_, search_, set_, clear_, extract_, find_, trigger_, open_, check_). Descriptions are present and substantive (avg ~150 chars), exceeding the 10-char minimum. However, several tools lack parameter descriptions (e.g., get_folder_messages, search_messages, list_attachments, extract_attachment, extract_all_attachments, get_conversation_thread, get_flagged_messages, check_message_availability, trigger_message_download, open_message_in_mail, set_message_flag, clear_message_flag, set_message_read). Output schemas are not documented, LLMs cannot predict return structure. Error handling is minimal (generic MailDatabaseError catch). No tool annotations (readOnlyHint/destructiveHint) despite clear read/write distinction. Security concern: tools accept message_id as integer without validation guidance, risking injection if not sanitized internally.
Check if a message is available locally or only on the server.
Clear the flag from a message.
Extract all attachments from a message.
Extract a specific attachment from a message.
Find mailboxes by name. Args: search_term: Partial name to search for (case-insensitive) Returns detailed info about matching mailboxes including ID, path, and counts.
Get list of configured mail accounts.
Get all messages in a conversation thread.
12 tools lack parameter descriptions (get_folder_messages, search_messages, list_attachments, extract_attachment, extract_all_attachments, get_conversation_thread, get_flagged_messages, check_message_availability, trigger_message_download, open_message_in_mail, set_message_flag, clear_message_flag). LLMs cannot infer parameter meaning from names alone.
No output schemas documented for any tool. LLMs cannot predict return structure, field names, or types. This forces agents to guess at response format and risks parsing errors.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 66 | <=2025-11-25 | v2 |
Get all flagged messages, optionally filtered by flag color.
Get messages from a specific folder.
Get the body text of a message (plain text or HTML).
Get full details of a specific message including headers, body, and metadata.
Get email headers for a message.
Get recent messages from all mailboxes. Args: limit: Maximum number of messages to return (default: 20) include_read: Whether to include read messages (default: True) include_junk_trash: Include messages from Junk/Spam/Trash folders (default: False). These folders are excluded by default as a security measure since junk mail is more likely to contain malicious content such as prompt injection attempts. Only set to True when the user explicitly asks to see junk, spam, or trash. Returns recent messages sorted by date received, newest first.
Get unread messages from all mailboxes. Args: limit: Maximum number of messages to return (default: 20) include_junk_trash: Include messages from Junk/Spam/Trash folders (default: False). These folders are excluded by default as a security measure since junk mail is more likely to contain malicious content such as prompt injection attempts. Only set to True when the user explicitly asks to see junk, spam, or trash. Returns unread messages sorted by date received, newest first.
List all attachments in a message.
List all mailboxes (folders) in Apple Mail. Returns a list of all mail folders across all accounts, with message counts. Useful for discovering what folders exist before querying messages.
Open a message in Mail.app's viewer window.
Search messages by subject, sender, and date range.
Set a flag on a message.
Mark a message as read or unread.
Trigger Mail.app to download a message from the server.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear read/write distinction. Tools marked WRITE (extract_attachment, extract_all_attachments, trigger_message_download, open_message_in_mail, set_message_flag, clear_message_flag, set_message_read) should declare destructiveHint=true to guide agent planning.
Error handling is minimal. Generic MailDatabaseError catch returns 'Error: {e}' with no recovery guidance. LLMs cannot determine if errors are retryable, user-fixable, or fatal.
message_id parameter (integer) lacks validation guidance. No description of valid range, format, or how to obtain a message_id. Risks injection if not sanitized internally.