Loading ToolBench
Local-first MCP server exposing Outlook / Microsoft 365 as tools for any MCP-capable LLM client. The Anti-Copilot for the BYOM market.
Strong foundation with 12 well-named tools, comprehensive parameter schemas, and clear descriptions. All tools have explicit input schemas with type definitions and parameter descriptions. Tool names follow verb_noun convention (list_emails, read_email, create_event, etc.). Descriptions average ~150 chars and explain WHAT the tool does and WHEN to use it. However, output schemas are not documented, LLMs cannot predict response structure. Error handling is basic (tool crashes return generic messages). No tool annotations (readOnlyHint, destructiveHint) despite clear risk levels. Some parameter descriptions could be more prescriptive about constraints (e.g., folder parameter accepts 'well-known names' but doesn't enumerate them in the description, only in the help text).
Create a draft email in the user's Drafts folder — NEVER sends. If replyToMessageId is set, the draft is created as a threaded reply; if `body` is provided it replaces Graph's quoted original so the caller fully controls the outgoing text. Otherwise a new standalone draft is created. The user must review and send manually in Outlook; this server has no ability to send.
Create a calendar event. If attendees are provided, Microsoft Graph will automatically send meeting invitations. Time zone defaults to UTC if unspecified. Returns the event id and a web link to open it in Outlook.
Delete a calendar event. DESTRUCTIVE: if the event has attendees, Microsoft Graph automatically sends a meeting cancellation to each one — there is no silent-delete mode. Solo events are simply removed. The operation is not reversible from this server. Make the implication explicit to the user before invoking. Returns the deleted event id on success.
List calendar events within a time window.
List emails from a folder with optional filtering by sender, date range, and read status.
Output schemas not documented. LLMs cannot predict response structure (fields, types, pagination). Forces agents to guess what data is returned and how to chain tools.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Tools marked as READ_ONLY, WRITE, or DESTRUCTIVE in comments but not in schema. Clients cannot auto-detect safety properties.
Error handling is generic. Tool crashes return 'Tool {name} crashed: {msg}' with no recovery guidance. LLMs cannot determine if error is retryable, user-fixable, or fatal.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
List mail folders in the user's mailbox, optionally filtered to subfolders of a parent folder.
Mark an email as read or unread.
Move an email to a different folder.
Read the full content of a specific email message, including body and attachments.
Download and save an email attachment to the local filesystem. The destination directory is controlled by the server's OUTLOOK_MCP_ALLOWED_DIR setting.
Full-text search across emails using Microsoft Graph search syntax. Supports complex queries with filters like 'from:', 'subject:', 'hasAttachment:', and date ranges.
Update a calendar event. All fields besides eventId are optional; only provided fields are sent to Graph. If attendees are provided, the entire attendee list is REPLACED — Graph does not merge. Graph will email update notifications to affected attendees automatically.
Parameter descriptions lack prescriptive constraints. 'folder' parameter accepts 'well-known names' but doesn't enumerate them in the description (only in help text). LLMs cannot infer valid values without reading external docs.
No pagination guidance in list tool descriptions. list_emails, list_folders, list_calendar_events accept 'limit' but don't explain what happens when results exceed limit or how to fetch next page.