@ni-c/imap-mcp 0.2.0

package/dist/tool-filter.d.ts

@@ -0,0 +1,45 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * A tool list that names something this server does not have.
+ *
+ * Thrown rather than `process.exit(1)`: `createServer` is called in-process by
+ * the tests, and an exiting constructor cannot be tested. `src/index.ts` turns
+ * it back into an exit code.
+ */
+export declare class ToolFilterError extends Error {
+    constructor(message: string);
+}
+export interface ToolFilter {
+    /** False when neither variable was set — then nothing is wrapped at all. */
+    readonly active: boolean;
+    /** The tools that survive. Only meaningful while `active`. */
+    readonly selected: ReadonlySet<string>;
+}
+/**
+ * Reads `<PREFIX>_ALLOW_TOOLS` / `<PREFIX>_DENY_TOOLS` and works out which
+ * tools survive.
+ *
+ * Every entry has to match at least one tool in the catalogue. An entry that
+ * matches nothing is fatal rather than ignored, because the failure it produces
+ * otherwise — a tool quietly missing from `tools/list` — is invisible: nobody
+ * looks for the cause of an absence in an environment variable.
+ */
+export declare function buildToolFilter(config: {
+    allowTools: string | undefined;
+    denyTools: string | undefined;
+    readOnly: boolean;
+}): ToolFilter;
+/**
+ * Makes `server` register only the tools the filter selected.
+ *
+ * The tool is registered and then removed again rather than skipped. Skipping
+ * looks cheaper and breaks one case: the SDK installs its `tools/list` handler
+ * from inside the registration path, so a server whose every tool was skipped
+ * would answer `tools/list` with "method not found" instead of an empty list.
+ * `remove()` deletes the entry from the SDK's tool map outright, which makes a
+ * filtered tool answer `Tool X not found` — exactly what a tool the read-only
+ * mode never registered already does. `disable()` would be wrong: it hides the
+ * tool from `tools/list` but still answers a call with "disabled", which is the
+ * advertising-a-refusal this server avoids everywhere else.
+ */
+export declare function installToolFilter(server: McpServer, filter: ToolFilter): void;

package/dist/tool-filter.js

@@ -0,0 +1,171 @@
+import { ALL_TOOLS, ESSENTIAL_TOOLS, READ_TOOLS } from './tools/catalogue.js';
+/**
+ * A tool list that names something this server does not have.
+ *
+ * Thrown rather than `process.exit(1)`: `createServer` is called in-process by
+ * the tests, and an exiting constructor cannot be tested. `src/index.ts` turns
+ * it back into an exit code.
+ */
+export class ToolFilterError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ToolFilterError';
+    }
+}
+/** The `essential` preset is spelled out here so it cannot collide with a tool name. */
+const PRESET = 'essential';
+/**
+ * Splits a comma-separated value into entries.
+ *
+ * Empty entries are dropped, so `a,,b` and a trailing comma are both fine, and
+ * a value that is empty or only whitespace counts as *unset* — `X_ALLOW_TOOLS=`
+ * in a compose file must not mean "allow nothing". Entries are lowercased: the
+ * catalogue is entirely lowercase, so this is lossless, and a shell that
+ * upper-cased a name should not take the server down.
+ */
+function entriesOf(raw) {
+    if (raw === undefined)
+        return undefined;
+    const entries = raw
+        .split(',')
+        .map((entry) => entry.trim().toLowerCase())
+        .filter((entry) => entry.length > 0);
+    return entries.length > 0 ? entries : undefined;
+}
+/**
+ * Expands one entry to the catalogue tools it names.
+ *
+ * A pattern is a literal prefix plus exactly one trailing `*`. Anything else is
+ * rejected outright: `*_zone` and `list_*_x` look plausible, match nothing, and
+ * would otherwise be silent forever.
+ */
+function expand(entry, variable) {
+    const star = entry.indexOf('*');
+    if (star !== -1) {
+        if (star !== entry.length - 1) {
+            throw new ToolFilterError(`${variable}: "${entry}" is not a valid entry — a pattern is a prefix ` +
+                'followed by a single trailing "*", for example "list_*". Everything ' +
+                'else is an exact tool name.');
+        }
+        const prefix = entry.slice(0, -1);
+        return ALL_TOOLS.filter((tool) => tool.startsWith(prefix));
+    }
+    return ALL_TOOLS.filter((tool) => tool === entry);
+}
+/** The full catalogue, for the "these are the names that exist" half of an error. */
+function catalogueList() {
+    return [...ALL_TOOLS].sort().join(', ');
+}
+/**
+ * Reads `<PREFIX>_ALLOW_TOOLS` / `<PREFIX>_DENY_TOOLS` and works out which
+ * tools survive.
+ *
+ * Every entry has to match at least one tool in the catalogue. An entry that
+ * matches nothing is fatal rather than ignored, because the failure it produces
+ * otherwise — a tool quietly missing from `tools/list` — is invisible: nobody
+ * looks for the cause of an absence in an environment variable.
+ */
+export function buildToolFilter(config) {
+    const allow = entriesOf(config.allowTools);
+    const deny = entriesOf(config.denyTools);
+    if (allow === undefined && deny === undefined) {
+        return { active: false, selected: new Set() };
+    }
+    // What would be registered without any filter. In read-only mode the write
+    // tools never reach `registerTool`, but they stay in the catalogue so that a
+    // name from that half is answered with "read-only suppresses it", never with
+    // "no such tool".
+    const registered = new Set(config.readOnly ? READ_TOOLS : ALL_TOOLS);
+    // Set when an allow entry named real tools and read-only suppressed all of
+    // them, so that "nothing is left" can name the reason rather than shrugging.
+    let suppressedByReadOnly = false;
+    let selected;
+    if (allow === undefined) {
+        selected = new Set(registered);
+    }
+    else {
+        selected = new Set();
+        for (const entry of allow) {
+            if (entry === PRESET) {
+                // Preset members are not names the operator typed, so a member that
+                // read-only suppresses is dropped silently rather than being an error.
+                for (const tool of ESSENTIAL_TOOLS) {
+                    if (registered.has(tool))
+                        selected.add(tool);
+                }
+                continue;
+            }
+            const matches = expand(entry, 'IMAP_ALLOW_TOOLS');
+            if (matches.length === 0) {
+                throw new ToolFilterError(`IMAP_ALLOW_TOOLS: no tool matches "${entry}". ` +
+                    `Valid tools: ${catalogueList()}. "${PRESET}" selects the curated preset.`);
+            }
+            const survivors = matches.filter((tool) => registered.has(tool));
+            if (survivors.length === 0) {
+                if (entry.endsWith('*')) {
+                    // A pattern is a template, not a claim about one tool: warn, continue.
+                    console.error(`imap-mcp: IMAP_ALLOW_TOOLS: "${entry}" matches only write ` +
+                        'tools, which IMAP_READ_ONLY suppresses — it contributes nothing.');
+                    suppressedByReadOnly = true;
+                    continue;
+                }
+                // An exact name, though, was typed by someone who believes it is exposed.
+                throw new ToolFilterError(`IMAP_ALLOW_TOOLS: "${entry}" is a write tool, but IMAP_READ_ONLY ` +
+                    'is set — it is never registered. Remove it from IMAP_ALLOW_TOOLS, ' +
+                    `or unset IMAP_READ_ONLY. Available in read-only mode: ${[...READ_TOOLS].sort().join(', ')}.`);
+            }
+            for (const tool of survivors)
+                selected.add(tool);
+        }
+    }
+    for (const entry of deny ?? []) {
+        // Deny lists are written defensively — "never expose delete_*, whatever
+        // else is on" — so matching nothing that survives is fine. Matching nothing
+        // in the catalogue is still a typo.
+        const matches = expand(entry, 'IMAP_DENY_TOOLS');
+        if (matches.length === 0) {
+            throw new ToolFilterError(`IMAP_DENY_TOOLS: no tool matches "${entry}". Valid tools: ${catalogueList()}.`);
+        }
+        for (const tool of matches)
+            selected.delete(tool);
+    }
+    if (selected.size === 0) {
+        throw new ToolFilterError(suppressedByReadOnly
+            ? 'IMAP_ALLOW_TOOLS selects only write tools, but IMAP_READ_ONLY is ' +
+                'set — the server would start with an empty tool list.'
+            : 'IMAP_ALLOW_TOOLS/IMAP_DENY_TOOLS leave no tools registered — the ' +
+                'server would start with an empty tool list.');
+    }
+    return { active: true, selected };
+}
+/**
+ * Makes `server` register only the tools the filter selected.
+ *
+ * The tool is registered and then removed again rather than skipped. Skipping
+ * looks cheaper and breaks one case: the SDK installs its `tools/list` handler
+ * from inside the registration path, so a server whose every tool was skipped
+ * would answer `tools/list` with "method not found" instead of an empty list.
+ * `remove()` deletes the entry from the SDK's tool map outright, which makes a
+ * filtered tool answer `Tool X not found` — exactly what a tool the read-only
+ * mode never registered already does. `disable()` would be wrong: it hides the
+ * tool from `tools/list` but still answers a call with "disabled", which is the
+ * advertising-a-refusal this server avoids everywhere else.
+ */
+export function installToolFilter(server, filter) {
+    if (!filter.active)
+        return;
+    const register = server.registerTool.bind(server);
+    // An object literal rather than a plain function so the method picks up the
+    // SDK's generic signature by contextual typing — the call sites keep their
+    // typed handler arguments and nothing needs a cast.
+    const wrapper = {
+        registerTool(name, config, cb) {
+            const tool = register(name, config, cb);
+            if (!filter.selected.has(name))
+                tool.remove();
+            return tool;
+        },
+    };
+    server.registerTool = wrapper.registerTool;
+}
+//# sourceMappingURL=tool-filter.js.map

package/dist/tool-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-filter.js","sourceRoot":"","sources":["../src/tool-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AASD,wFAAwF;AACxF,MAAM,MAAM,GAAG,WAAW,CAAC;AAE3B;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,KAAa,EAAE,QAAgB;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,IAAI,IAAI,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,GAAG,QAAQ,MAAM,KAAK,iDAAiD;gBACrE,sEAAsE;gBACtE,6BAA6B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa;IACpB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,MAI/B;IACC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,kBAAkB;IAClB,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAE,SAA+B,CAChE,CAAC;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,oBAAoB,GAAG,KAAK,CAAC;IAEjC,IAAI,QAAqB,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,oEAAoE;gBACpE,uEAAuE;gBACvE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;oBACnC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC/C,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CACvB,sCAAsC,KAAK,KAAK;oBAC9C,gBAAgB,aAAa,EAAE,MAAM,MAAM,+BAA+B,CAC7E,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,uEAAuE;oBACvE,OAAO,CAAC,KAAK,CACX,gCAAgC,KAAK,uBAAuB;wBAC1D,kEAAkE,CACrE,CAAC;oBACF,oBAAoB,GAAG,IAAI,CAAC;oBAC5B,SAAS;gBACX,CAAC;gBACD,0EAA0E;gBAC1E,MAAM,IAAI,eAAe,CACvB,sBAAsB,KAAK,wCAAwC;oBACjE,oEAAoE;oBACpE,yDAAyD,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChG,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;QAC/B,wEAAwE;QACxE,4EAA4E;QAC5E,oCAAoC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACvB,qCAAqC,KAAK,mBAAmB,aAAa,EAAE,GAAG,CAChF,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,oBAAoB;YAClB,CAAC,CAAC,mEAAmE;gBACjE,uDAAuD;YAC3D,CAAC,CAAC,mEAAmE;gBACjE,6CAA6C,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAkB;IACrE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,OAAO,GAAoC;QAC/C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IACF,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAC7C,CAAC"}

package/dist/tools/catalogue.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The tools this server can register, declared rather than discovered.
+ *
+ * Declared, because the tool filter has to answer "is this a name you have?"
+ * *before* anything is registered — and in read-only mode the write tools are
+ * never registered at all. Deriving the catalogue from what actually reached
+ * `registerTool` would make `IMAP_ALLOW_TOOLS=delete_messages` report "unknown
+ * tool" under `IMAP_READ_ONLY=true`, which is the one answer that is wrong.
+ *
+ * This is also the full tool surface, hard-coded on purpose: a tool that appears
+ * or disappears by accident is a change to the server's contract and has to be a
+ * deliberate edit here. `test/tool-filter.test.ts` asserts that these lists and
+ * the tools the server really registers are the same set.
+ *
+ * Note this covers *tools* only. This server also registers attachment
+ * resources (`src/resources.ts`), and the filter does not touch those.
+ */
+/**
+ * Registered always — but "read" here means "registered under the read-only
+ * default", not "touches nothing".
+ *
+ * Two of them do write, and an operator who reads `IMAP_READ_ONLY=true` as
+ * "never changes anything" would be wrong about both. `list_new_messages`
+ * issues a STORE to set the seen keyword, which is how it can answer "anything
+ * new?" at all — that is the deliberate trade, and `dry_run` previews it
+ * without marking. `get_attachments` creates files when `IMAP_DOWNLOAD_DIR` is
+ * set. Neither carries `readOnlyHint: true`; the other four do.
+ */
+export declare const READ_TOOLS: readonly ["get_attachments", "get_message", "get_server_info", "list_mailboxes", "list_messages", "list_new_messages"];
+/** Registered only when `IMAP_READ_ONLY` is turned off. */
+export declare const WRITE_TOOLS: readonly ["delete_messages", "manage_mailbox", "move_messages", "save_draft", "set_message_flags"];
+/** Every tool, read-only mode aside. */
+export declare const ALL_TOOLS: readonly string[];
+/**
+ * What `IMAP_ALLOW_TOOLS=essential` selects: find the mail, read it, file it.
+ *
+ * Six of eleven. Left out on purpose: `delete_messages` (irreversible),
+ * `save_draft` (composing is a different job from triage), `get_attachments`
+ * (large payloads, and the attachment resources cover the same ground), and
+ * `get_server_info` and `manage_mailbox`, which are administrative.
+ *
+ * Four of the six are read tools, so `IMAP_ALLOW_TOOLS=essential` remains a
+ * working combination under the default `IMAP_READ_ONLY=true` — it then yields
+ * exactly those four.
+ */
+export declare const ESSENTIAL_TOOLS: readonly string[];

package/dist/tools/catalogue.js

@@ -0,0 +1,67 @@
+/**
+ * The tools this server can register, declared rather than discovered.
+ *
+ * Declared, because the tool filter has to answer "is this a name you have?"
+ * *before* anything is registered — and in read-only mode the write tools are
+ * never registered at all. Deriving the catalogue from what actually reached
+ * `registerTool` would make `IMAP_ALLOW_TOOLS=delete_messages` report "unknown
+ * tool" under `IMAP_READ_ONLY=true`, which is the one answer that is wrong.
+ *
+ * This is also the full tool surface, hard-coded on purpose: a tool that appears
+ * or disappears by accident is a change to the server's contract and has to be a
+ * deliberate edit here. `test/tool-filter.test.ts` asserts that these lists and
+ * the tools the server really registers are the same set.
+ *
+ * Note this covers *tools* only. This server also registers attachment
+ * resources (`src/resources.ts`), and the filter does not touch those.
+ */
+/**
+ * Registered always — but "read" here means "registered under the read-only
+ * default", not "touches nothing".
+ *
+ * Two of them do write, and an operator who reads `IMAP_READ_ONLY=true` as
+ * "never changes anything" would be wrong about both. `list_new_messages`
+ * issues a STORE to set the seen keyword, which is how it can answer "anything
+ * new?" at all — that is the deliberate trade, and `dry_run` previews it
+ * without marking. `get_attachments` creates files when `IMAP_DOWNLOAD_DIR` is
+ * set. Neither carries `readOnlyHint: true`; the other four do.
+ */
+export const READ_TOOLS = [
+    'get_attachments',
+    'get_message',
+    'get_server_info',
+    'list_mailboxes',
+    'list_messages',
+    'list_new_messages',
+];
+/** Registered only when `IMAP_READ_ONLY` is turned off. */
+export const WRITE_TOOLS = [
+    'delete_messages',
+    'manage_mailbox',
+    'move_messages',
+    'save_draft',
+    'set_message_flags',
+];
+/** Every tool, read-only mode aside. */
+export const ALL_TOOLS = [...READ_TOOLS, ...WRITE_TOOLS];
+/**
+ * What `IMAP_ALLOW_TOOLS=essential` selects: find the mail, read it, file it.
+ *
+ * Six of eleven. Left out on purpose: `delete_messages` (irreversible),
+ * `save_draft` (composing is a different job from triage), `get_attachments`
+ * (large payloads, and the attachment resources cover the same ground), and
+ * `get_server_info` and `manage_mailbox`, which are administrative.
+ *
+ * Four of the six are read tools, so `IMAP_ALLOW_TOOLS=essential` remains a
+ * working combination under the default `IMAP_READ_ONLY=true` — it then yields
+ * exactly those four.
+ */
+export const ESSENTIAL_TOOLS = [
+    'list_mailboxes',
+    'list_new_messages',
+    'list_messages',
+    'get_message',
+    'set_message_flags',
+    'move_messages',
+];
+//# sourceMappingURL=catalogue.js.map

package/dist/tools/catalogue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogue.js","sourceRoot":"","sources":["../../src/tools/catalogue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,iBAAiB;IACjB,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,mBAAmB;CACX,CAAC;AAEX,2DAA2D;AAC3D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,YAAY;IACZ,mBAAmB;CACX,CAAC;AAEX,wCAAwC;AACxC,MAAM,CAAC,MAAM,SAAS,GAAsB,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,gBAAgB;IAChB,mBAAmB;IACnB,eAAe;IACf,aAAa;IACb,mBAAmB;IACnB,eAAe;CAChB,CAAC"}

package/dist/tools/read.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../config.js';
+import { ImapClient } from '../imap.js';
+export declare function registerReadTools(server: McpServer, client: ImapClient, config: Config): void;