Skip to content

feat(mcp): write tools — compose, undo-send, mailbox ops, triage, settings - #321

Open
salmonumbrella wants to merge 4 commits into
maathimself:mainfrom
salmonumbrella:feat/mcp-write-tools
Open

feat(mcp): write tools — compose, undo-send, mailbox ops, triage, settings#321
salmonumbrella wants to merge 4 commits into
maathimself:mainfrom
salmonumbrella:feat/mcp-write-tools

Conversation

@salmonumbrella

@salmonumbrella salmonumbrella commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Follow-up to #296, stacked on #294 → #295 → #296 — the diff shows their commits until they merge; review the last commit only (feat(mcp): write tools — compose, undo-send, mailbox ops, triage, settings). I'll rebase as the stack lands. No new backend dependencies.

Summary

  • Token scopes (read/write/send/settings, migration 0042): enforced fail-closed at one dispatch choke point, tools/list filtered per token, existing tokens stay read-only. Per-class rate limits + a daily send cap.
  • 33 new tools (58 total): drafts, send/reply/reply-all/forward with hard alias validation and receipts, unsend via a real outbox (0–120s window, SKIP LOCKED worker, race-safe cancel), honest best-effort recall, folders/move/archive/trash/flags/spam/snooze/category/GTD with refuse-unbounded guards, an inbox-triage loop (triage_inbox/get_triage_context/mark_triaged, embedding-derived signals), and settings tools — add_account is staged and never accepts secrets over MCP.
  • Undo-send in the UI: countdown toast with Undo, preference defaults to off so upgrades never change send behavior.
  • The send/draft/reply/mailbox logic moved out of routes into services shared by REST and MCP, fixing real bugs on the way: alias silent-fallback, the References chain (compose never used thread_references), drafts dropping threading headers. New synchronous POST /api/accounts/:id/test-connection.
  • Migrations 0042–0046; every tool def carries MCP annotations (readOnly/destructive/idempotent/openWorld).

Testing

  • Backend: 1,839 passed / 52 skipped (DB-gated), lint clean
  • Frontend: 1,476 passed / 0 failed, lint clean, production build clean
  • Exercised end-to-end against a live Docker stack: scope-filtered tools/list (18 read-only vs 58 full), permission gate on send_email, outbox cancel, triage feed, staged account-add secret rejection

Contributor License Agreement

By submitting this pull request I confirm that:

  • I have read and agree to the Contributor License Agreement.
  • My contribution is my own original work (or I have identified any third-party material and confirmed it is compatible with the CLA).
  • I have the right to submit this contribution under the terms of the CLA.

🤖 Generated with Claude Code

salmonumbrella and others added 4 commits July 18, 2026 21:42
@salmonumbrella @claude
feat(search): weighted FTS ranking + searchable message bodies
42fc2d4 
Results ranked by relevance instead of date-only: subject > sender > body
(setweight A-D + ts_rank_cd), prefix matching as you type, quoted phrases,
served by a GIN index over a trigger-maintained search_fts column. Backfill
runs as a resumable background drainer (fast-DDL migrations 0035-0037, no
boot-blocking rewrite); not-yet-backfilled rows fall back to the previous
query path. Body text is materialized by a provider-gated background IMAP
drainer with circuit breakers, poison-message forward progress, and
progress reporting. Filter-only queries stay date-ordered.

No infrastructure changes - runs on stock postgres:16-alpine.

Split 1/3 of maathimself#283.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@salmonumbrella @claude
feat(search): optional semantic embeddings with hybrid ranking (pgvec…
741c142 
…tor)

Explicit opt-in embeddings pipeline against any OpenAI-compatible
/v1/embeddings endpoint (key encrypted at rest, host-validated, masked on
read). Fingerprinted generations (config change => clean rebuild), a
crash-safe fill worker, per-dimension HNSW partial indexes, re-embedding of
late-arriving bodies. Query side adds hybrid BM25+ANN reciprocal-rank
fusion behind an in-input Semantic toggle; lexical stays the default, with
silent fallback while the index builds. Settings UI with explicit privacy
copy and live Test/Build progress, in all 7 locales. Migrations 0038-0039.
Includes the search-eval harness that produced the published quality
numbers, and its explain/total diagnostics seams.

Infra: compose moves postgres:16-alpine -> pgvector/pgvector:pg16 (same
PG16 major). Run REINDEX DATABASE once after the first boot: the
musl -> glibc collation change can misorder existing text btree indexes;
the app logs a loud warning when it detects this.

Split 2/3 of maathimself#283, stacked on the weighted-FTS PR.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@salmonumbrella @claude
feat(mcp): bearer-tokened MCP server exposing search to agents
c736171 
Streamable-HTTP /mcp endpoint (SHA-256-hashed tokens minted in Profile,
Origin-validated, rate-limited) exposing 12 tools including
semantic_search_messages and search_in_message. Every call is scoped to
the token owner's accounts; deletion is staged-only. Adds the MCP-only
search seams (trusted account scoping, body-scope FTS leg, strictVector,
loadVector), the chunk-excerpt read path, migrations 0040-0041, and one
new backend dependency: @modelcontextprotocol/sdk.

Split 3/3 of maathimself#283, stacked on the semantic-embeddings PR. The stacked
tree is byte-identical to the reviewed maathimself#283 head (3773150).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@salmonumbrella @claude
feat(mcp): write tools — compose, undo-send, mailbox ops, triage, set…
025b531 
…tings

Extends the read-only MCP server (maathimself#296) to the full mail client:

- Token scopes (read/write/send/settings) enforced fail-closed at one dispatch
  choke point; tools/list filtered per token; existing tokens stay read-only.
  Per-class rate limits plus a daily send cap.
- 33 new tools (58 total): drafts, send/reply/reply-all/forward with hard
  alias validation and receipts, unsend via a real outbox (0-120s window,
  SKIP LOCKED worker, race-safe cancel), honest best-effort recall, folders/
  move/archive/trash/flags/spam/snooze/category/GTD with refuse-unbounded
  guards, an inbox-triage loop (triage_inbox / get_triage_context /
  mark_triaged) with embedding-derived signals, and settings tools including
  a staged add_account that never accepts secrets over MCP.
- Undo-send frontend: countdown toast with Undo, user preference (0-120s,
  default off so upgrades never change send behavior).
- Service extractions shared by REST and MCP (send/draft/reply/mailbox),
  fixing real bugs en route: alias silent-fallback, the References chain
  (thread_references was never used by compose), drafts dropping threading
  headers, and a new synchronous account test-connection endpoint.
- Migrations 0042-0046. Every tool def carries MCP annotations.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@salmonumbrella

salmonumbrella commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

@maathimself 🍒 cherry on top to let agents pilot MailFlow.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@salmonumbrella