MCP map

30 tools. Each one with a risk class.

This is everything an agent can call when it connects to GigaMail over MCP, and the rule each call follows. The list is generated from the server, so it matches the version you install.

Two surfaces, one core

MCP server

For your agent. Runs over stdio: no network port to reach or protect.

Console

For you. A local HTTP API on 127.0.0.1 with a session token. Optional.

Neither has an AI of its own: the reasoning is always your agent’s.

Four risk classes

READ

Free

Reading, search, listings. Mail content is treated as untrusted data.

WRITE_SAFE

Free, logged

Small reversible changes, written to the audit log.

DANGEROUS

Two-phase approval

Anything that sends, deletes or invites. It waits for a person.

ADMIN

CLI only

Logins, credentials, accounts. Never exposed to the agent.

How two-phase approval works

1
The agent asks
It calls send_mail as usual. Nothing runs.
2
GigaMail answers with a preview
Recipients, subject, body, attachments, plus an inert request_id valid for 15 minutes.
3
You approve, outside the agent
From the console, the CLI, Telegram or a Windows notification, confirmed with Windows Hello or Touch ID.
4
Then it runs
The agent calls again with the request_id. What runs is the payload you approved, not one the agent passes back. Until then you can revoke it.

The tools

READ18 · free

Tool	What it does
`list_accounts`	Configured accounts, never credentials.
`get_identity`	Who you are, what you do, your tone: context for drafts in your voice.
`list_knowledge_files`	The files you registered: price lists, terms, product sheets.
`read_knowledge_file`	Text of one registered file. Only paths you registered, nothing else on disk.
`search_knowledge`	Best passages from your files, from a local full-text index.
`list_messages`	Messages of a folder, as summaries without bodies.
`list_unread`	Unread mail of the last days.
`read_message`	One message as visible text only: hidden text is left out and flagged, links come as a list.
`read_attachment`	Text of an attachment (pdf, docx, xlsx…). The binary never reaches the agent.
`list_folders`	The folders of an account.
`search_mail`	Search across GigaMail’s archive, the provider and the local index.
`sender_history`	What the local index knows about a sender: tone, topics, last exchanges.
`observer_context`	Patterns from the corrections you made to past drafts.
`memory_stats`	Health of the local mail index.
`list_events`	Calendar events, from Microsoft or Google.
`find_free_slots`	Free slots to propose in a reply.
`drive_list_files`	Files on your Google Drive.
`drive_read_file`	Text of a Drive file.

WRITE_SAFE2 · free, logged

Tool	What it does
`mark_read`	Read or unread. Reversible, runs at once, written to the audit log.
`create_folder`	A new empty folder. Runs at once, written to the audit log.

DANGEROUS10 · two-phase approval

Tool	What it does
`send_mail`	Send a new email.
`reply_mail`	Reply in a thread.
`move_message`	Move a message to another folder.
`delete_message`	Delete a message.
`delete_folder`	Delete a folder and what it holds.
`create_event`	Create a calendar event (it can invite people).
`delete_event`	Delete a calendar event.
`create_zoom_meeting`	Create a Zoom meeting and get its link.
`drive_upload_file`	Upload a file to Google Drive.
`drive_delete_file`	Move a Drive file to the trash.

What the agent can never do

ADMIN

Sign in or out, add or remove accounts, set up CalDAV, run the indexer, configure masking, delete data. These live in the gigamail CLI only. Credentials never travel through the agent’s channel, so a prompt injection hidden in a mail cannot add an account, read a token or change the setup.

Design choices

stdio, not HTTP

There is no local port for another program to call.

`account_id` on every tool

No “active account” state that the agent could switch behind your back.

Append-only action log

Every WRITE_SAFE and DANGEROUS call is written with time, tool, parameters and outcome. Append-only means GigaMail never rewrites past entries; it does not make the file tamper-proof against someone with access to your disk.

Mail is data, not instructions

A DANGEROUS tool can never confirm itself: the approval comes from a person, outside the agent.

The full map, with every endpoint of the console and the tools still being designed, is in MAPPA_MCP.md on GitHub.