iris-mcp 0.1.0__py3-none-any.whl

iris_mcp-0.1.0.dist-info/METADATA

@@ -0,0 +1,146 @@
+Metadata-Version: 2.5
+Name: iris-mcp
+Version: 0.1.0
+Summary: A Microsoft 365 mail MCP server that can draft but cannot send. The token has no Mail.Send scope.
+Project-URL: Homepage, https://github.com/SuperAngryMonkey/iris
+Project-URL: Source, https://github.com/SuperAngryMonkey/iris
+Project-URL: Issues, https://github.com/SuperAngryMonkey/iris/issues
+Author-email: "800 Pound Gorilla Inc." <james@bigassmonkey.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: email,graph,mcp,microsoft-365,model-context-protocol,msal,outlook
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Communications :: Email
+Requires-Python: >=3.10
+Requires-Dist: mcp<2,>=1.2.0
+Requires-Dist: msal>=1.28.0
+Requires-Dist: requests>=2.31.0
+Description-Content-Type: text/markdown
+
+# iris
+
+**A Microsoft 365 mail server for AI agents that cannot send email.**
+
+Not "will not". Cannot. iris requests the delegated Graph scope `Mail.ReadWrite`
+and never `Mail.Send`. The access token it holds has no capability to transmit a
+message, so no prompt, no jailbreak and no bug in this code can make one go out.
+It writes drafts into a folder in your mailbox. You open Outlook and press Send.
+
+That is the whole design. Everything else is detail.
+
+---
+
+## Why this shape
+
+The usual worry about giving an agent your mailbox is that it will send
+something you did not sanction — to the wrong person, with the wrong tone, or
+because someone talked it into doing so. The common answer is a confirmation
+prompt, which is a guardrail: code that asks permission, and code can be
+bypassed.
+
+iris removes the capability instead. Microsoft Graph will reject a send attempt
+made with this token, because the consent screen you approved never included
+that permission. The security boundary is Microsoft's, not this program's, and
+it holds even if this program is wrong.
+
+The trade is real: a human is in the loop on every message, by construction. If
+you want autonomous sending, iris is the wrong tool.
+
+## Install
+
+```bash
+uvx iris-mcp        # run without installing
+pip install iris-mcp
+```
+
+Python 3.10+.
+
+## Setup
+
+**You must register your own Entra application.** There is no shared app
+registration and no hosted service — iris talks directly from your machine to
+your tenant. This is deliberate: a shared app would mean trusting someone
+else's client ID with access to your mail.
+
+1. Entra admin centre → **App registrations** → **New registration**. Single
+   tenant is fine. No redirect URI needed.
+2. **Authentication** → Settings → enable **Allow public client flows**. Device
+   code sign-in needs this. No client secret is used anywhere.
+3. **API permissions** → Microsoft Graph → **Delegated** → add
+   **`Mail.ReadWrite`**. Add nothing else. Do not add `Mail.Send` — if it is
+   present, the guarantee above is void.
+4. Copy the **Application (client) ID** and **Directory (tenant) ID**. Neither
+   is a secret.
+
+Then add iris to your MCP client:
+
+```json
+{
+  "mcpServers": {
+    "iris": {
+      "command": "uvx",
+      "args": ["iris-mcp"],
+      "env": {
+        "IRIS_CLIENT_ID": "<application client id>",
+        "IRIS_TENANT_ID": "<directory tenant id>"
+      }
+    }
+  }
+}
+```
+
+Sign in once: call `iris_login`, open the URL, enter the code, then call
+`iris_login_finish`. The token cache is written next to the server, mode 600.
+
+## Tools
+
+| Tool | What it does |
+|---|---|
+| `iris_login` | Starts device-code sign-in, returns a URL and a code |
+| `iris_login_finish` | Completes sign-in; safe to call repeatedly while you type the code |
+| `iris_auth_status` | Who is signed in, which scopes, and whether Graph is reachable |
+| `iris_create_draft` | Writes a draft (to/cc/bcc, subject, body or HTML, optional reply-to) |
+| `iris_list_drafts` | Lists what is waiting in the draft folder |
+| `iris_update_draft` | Revises a draft in place |
+| `iris_delete_draft` | Deletes a draft; requires `confirm=true` |
+
+## Where drafts go
+
+Into a dedicated top-level mail folder, `AI Drafts` by default
+(`IRIS_DRAFT_FOLDER`). It is created on first use. Set the variable to an empty
+string to use the normal Drafts folder instead.
+
+These are real drafts and Outlook sends them normally — but because they live in
+their own folder, they do **not** appear in the Drafts view. That is the point:
+agent-written mail sits somewhere you have to go and look, rather than mixed in
+with your own half-finished messages.
+
+One wrinkle worth knowing: Graph's `createReply` always lands a reply in Drafts
+first, so iris moves it afterwards, and a move assigns a new message id.
+
+## Other controls
+
+- **Recipient allowlist** — `recipients.allow`, one address or domain per line.
+  Absent or empty means all recipients are permitted. Point `IRIS_ALLOWLIST`
+  elsewhere if you prefer.
+- **Kill switch** — create a `DISABLED` file beside the server, or set
+  `IRIS_DISABLED=1`, and every tool refuses.
+- **Audit log** — every call is appended to `audit.log` (`IRIS_AUDIT_LOG`).
+
+## Limits
+
+No attachments. No shared or delegated mailboxes — `/me` only. No folder nesting
+via `parentFolderId`. Sign-in is delegated device-code as a public client, so
+the blast radius is exactly one mailbox: yours.
+
+## License
+
+MIT — see [LICENSE](LICENSE).
+
+<!-- mcp-name: io.github.SuperAngryMonkey/iris -->

iris_mcp-0.1.0.dist-info/RECORD

@@ -0,0 +1,6 @@
+server.py,sha256=DhMni7DnJwLRuCZTWNgEByOeUd1tuzDOX-jFylVdjhM,18489
+iris_mcp-0.1.0.dist-info/METADATA,sha256=sH3_Igoy6It0wUQqp714YjfRgR1qZDpsrGl-z3w1sYs,5599
+iris_mcp-0.1.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+iris_mcp-0.1.0.dist-info/entry_points.txt,sha256=SR7mKBte3eR0B-GmMPCqm6YQJq3g1TR0G0eRLq25NHY,41
+iris_mcp-0.1.0.dist-info/licenses/LICENSE,sha256=EtJkg0PFkR4cVf5VTOf5D2T7b_FCErVOciGa6HmNqDg,1079
+iris_mcp-0.1.0.dist-info/RECORD,,

iris_mcp-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.0
+Root-Is-Purelib: true
+Tag: py3-none-any

iris_mcp-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+iris-mcp = server:main

iris_mcp-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 800 Pound Gorilla Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

server.py

@@ -0,0 +1,492 @@
+#!/usr/bin/env python3
+"""
+iris — a draft-only Microsoft 365 mail MCP.
+
+The other messenger of the gods. Composes mail into your Outlook Drafts
+folder and stops there. A human opens Outlook, reads it, and presses Send.
+
+Containment (heimdall doctrine applied to mail):
+  - NO SEND CAPABILITY  the app requests Mail.ReadWrite ONLY, never Mail.Send.
+                        This is structural: the token cannot send mail, so no
+                        bug, loop, or bad instruction can put mail in flight.
+  - DELEGATED AUTH      public client + device code. No client secret on disk,
+                        no admin consent, blast radius = this mailbox only.
+  - RECIPIENT ALLOWLIST if recipients.allow is present and non-empty, drafts to
+                        anything outside it are refused.
+  - AUDIT LOG           every draft written appended to audit.log.
+  - KILL SWITCH         a DISABLED file (or IRIS_DISABLED=1) blocks everything.
+  - CONFIRM GATE        deleting a draft requires confirm=true, which the
+                        assistant must only set after explicit human ok.
+
+Setup (one time, in Entra ID):
+  1. Register an application. Single tenant is fine.
+  2. Authentication -> Add platform -> Mobile and desktop -> check the
+     "https://login.microsoftonline.com/common/oauth2/nativeclient" redirect,
+     and set "Allow public client flows" = Yes.
+  3. API permissions -> Microsoft Graph -> Delegated -> Mail.ReadWrite.
+     Do NOT add Mail.Send. That omission is the safety property.
+  4. Export IRIS_CLIENT_ID and IRIS_TENANT_ID, then call iris_login().
+"""
+import json
+import os
+import re
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+
+import msal
+import requests
+from mcp.server.fastmcp import FastMCP
+
+HERE = Path(__file__).resolve().parent
+ALLOWLIST_FILE = Path(os.environ.get("IRIS_ALLOWLIST", HERE / "recipients.allow"))
+AUDIT_LOG = Path(os.environ.get("IRIS_AUDIT_LOG", HERE / "audit.log"))
+CACHE_FILE = Path(os.environ.get("IRIS_TOKEN_CACHE", HERE / ".token_cache.json"))
+FLOW_FILE = Path(os.environ.get("IRIS_FLOW_FILE", HERE / ".pending_flow.json"))
+DISABLED_FILE = HERE / "DISABLED"
+# Drafts are staged here instead of the Drafts folder. Blank = use Drafts.
+DRAFT_FOLDER = os.environ.get("IRIS_DRAFT_FOLDER", "AI Drafts")
+
+CLIENT_ID = os.environ.get("IRIS_CLIENT_ID", "")
+TENANT_ID = os.environ.get("IRIS_TENANT_ID", "organizations")
+AUTHORITY = f"https://login.microsoftonline.com/{TENANT_ID}"
+
+# Mail.ReadWrite ONLY. Adding Mail.Send here would defeat the entire design.
+SCOPES = ["Mail.ReadWrite"]
+
+GRAPH = "https://graph.microsoft.com/v1.0"
+HTTP_TIMEOUT = 30
+MAX_BODY = 500_000
+
+EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
+
+mcp = FastMCP("iris")
+
+
+# ----------------------------------------------------------------- plumbing
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat(timespec="seconds")
+
+
+def _disabled() -> bool:
+    return DISABLED_FILE.exists() or os.environ.get("IRIS_DISABLED") == "1"
+
+
+def _audit(action: str, detail: str) -> None:
+    try:
+        with AUDIT_LOG.open("a", encoding="utf-8") as fh:
+            fh.write(f"{_now()}\t{action}\t{detail}\n")
+    except OSError:
+        pass
+
+
+def _load_allowlist() -> list[str]:
+    if not ALLOWLIST_FILE.exists():
+        return []
+    entries = []
+    for line in ALLOWLIST_FILE.read_text(encoding="utf-8").splitlines():
+        line = line.split("#", 1)[0].strip().lower()
+        if line:
+            entries.append(line)
+    return entries
+
+
+def _check_recipients(addrs: list[str]) -> str | None:
+    """Return an error string if any address is outside the allowlist."""
+    allow = _load_allowlist()
+    if not allow:
+        return None
+    bad = []
+    for a in addrs:
+        a = a.strip().lower()
+        domain = a.rsplit("@", 1)[-1]
+        if a not in allow and domain not in allow and f"@{domain}" not in allow:
+            bad.append(a)
+    if bad:
+        return (
+            f"recipients not in {ALLOWLIST_FILE.name}: {', '.join(bad)}. "
+            "Add them to the allowlist or clear the file to allow all."
+        )
+    return None
+
+
+def _cache() -> msal.SerializableTokenCache:
+    cache = msal.SerializableTokenCache()
+    if CACHE_FILE.exists():
+        cache.deserialize(CACHE_FILE.read_text(encoding="utf-8"))
+    return cache
+
+
+def _save_cache(cache: msal.SerializableTokenCache) -> None:
+    if cache.has_state_changed:
+        CACHE_FILE.write_text(cache.serialize(), encoding="utf-8")
+        try:
+            CACHE_FILE.chmod(0o600)
+        except OSError:
+            pass
+
+
+def _app(cache: msal.SerializableTokenCache) -> msal.PublicClientApplication:
+    return msal.PublicClientApplication(
+        CLIENT_ID, authority=AUTHORITY, token_cache=cache
+    )
+
+
+def _token() -> tuple[str | None, str | None]:
+    """Return (access_token, error)."""
+    if not CLIENT_ID:
+        return None, "IRIS_CLIENT_ID is not set. See the setup notes in server.py."
+    cache = _cache()
+    app = _app(cache)
+    accounts = app.get_accounts()
+    if not accounts:
+        return None, "not signed in — run iris_login() first"
+    result = app.acquire_token_silent(SCOPES, account=accounts[0])
+    _save_cache(cache)
+    if not result or "access_token" not in result:
+        return None, "token expired or revoked — run iris_login() again"
+    return result["access_token"], None
+
+
+def _graph(method: str, path: str, token: str, **kw) -> tuple[dict, int]:
+    url = path if path.startswith("http") else f"{GRAPH}{path}"
+    headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
+    headers.update(kw.pop("headers", {}))
+    resp = requests.request(method, url, headers=headers, timeout=HTTP_TIMEOUT, **kw)
+    try:
+        body = resp.json() if resp.content else {}
+    except ValueError:
+        body = {"raw": resp.text[:2000]}
+    return body, resp.status_code
+
+
+def _recips(addrs: list[str] | str | None) -> list[dict]:
+    if isinstance(addrs, str):  # tolerate a bare address where a list is expected
+        addrs = [addrs]
+    return [{"emailAddress": {"address": a.strip()}} for a in (addrs or []) if a.strip()]
+
+
+def _flatten(*groups) -> list[str]:
+    out = []
+    for g in groups:
+        if isinstance(g, str):  # tolerate a bare address where a list is expected
+            g = [g]
+        for a in (g or []):
+            if a and a.strip():
+                out.append(a.strip())
+    return out
+
+
+def _ensure_folder(token: str) -> tuple[str | None, str | None]:
+    """Find or create the staging mail folder. Returns (folder_id, error)."""
+    if not DRAFT_FOLDER:
+        return "drafts", None
+    body, code = _graph(
+        "GET", "/me/mailFolders?$top=100&$select=id,displayName", token
+    )
+    if code != 200:
+        return None, f"folder lookup failed {code}: {json.dumps(body)[:300]}"
+    want = DRAFT_FOLDER.strip().lower()
+    for f in body.get("value", []):
+        if (f.get("displayName") or "").strip().lower() == want:
+            return f.get("id"), None
+    made, code = _graph(
+        "POST", "/me/mailFolders", token, json={"displayName": DRAFT_FOLDER}
+    )
+    if code not in (200, 201):
+        return None, f"folder creation failed {code}: {json.dumps(made)[:300]}"
+    _audit("folder", f"created {DRAFT_FOLDER} id={made.get('id')}")
+    return made.get("id"), None
+
+
+# -------------------------------------------------------------------- tools
+
+@mcp.tool()
+def iris_login() -> str:
+    """Start a device-code sign-in for the mailbox. Returns a URL and a code
+    for the human to enter in a browser; then call iris_login_finish() to
+    complete. Only needed once, or after the refresh token lapses."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    if not CLIENT_ID:
+        return "IRIS_CLIENT_ID is not set. See the setup notes in server.py."
+    cache = _cache()
+    app = _app(cache)
+    flow = app.initiate_device_flow(scopes=SCOPES)
+    if "user_code" not in flow:
+        return f"failed to start device flow: {json.dumps(flow)[:500]}"
+    FLOW_FILE.write_text(json.dumps(flow))
+    FLOW_FILE.chmod(0o600)
+    msg = flow.get("message", "")
+    return f"{msg}\n\nAfter entering the code, call iris_login_finish() to complete sign-in."
+
+
+@mcp.tool()
+def iris_login_finish() -> str:
+    """Complete a device-code sign-in started with iris_login(). Call after
+    entering the code in the browser. Waits up to ~60s; if the code has not
+    been entered yet, it says so and can simply be called again."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    if not CLIENT_ID:
+        return "IRIS_CLIENT_ID is not set. See the setup notes in server.py."
+    if not FLOW_FILE.exists():
+        return "no pending sign-in — call iris_login() first"
+    try:
+        flow = json.loads(FLOW_FILE.read_text())
+    except ValueError:
+        FLOW_FILE.unlink(missing_ok=True)
+        return "pending sign-in state was unreadable — call iris_login() again"
+    if time.time() > flow.get("expires_at", 0):
+        FLOW_FILE.unlink(missing_ok=True)
+        return "the device code expired — call iris_login() to get a new one"
+    # Bound the blocking poll to ~60s per call; the stashed flow keeps its
+    # original expiry, so calling again later still works.
+    flow["expires_at"] = min(flow.get("expires_at", 0), int(time.time()) + 60)
+    cache = _cache()
+    app = _app(cache)
+    result = app.acquire_token_by_device_flow(flow)
+    _save_cache(cache)
+    if "access_token" in result:
+        FLOW_FILE.unlink(missing_ok=True)
+        who = result.get("id_token_claims", {}).get("preferred_username", "unknown")
+        _audit("login", who)
+        return f"signed in as {who} (scopes: {' '.join(SCOPES)} — no send capability)"
+    if result.get("error") == "authorization_pending":
+        return "code not entered yet — finish it in the browser, then call iris_login_finish() again"
+    FLOW_FILE.unlink(missing_ok=True)
+    return f"sign-in failed: {result.get('error_description', json.dumps(result))[:500]}"
+
+
+@mcp.tool()
+def iris_auth_status() -> str:
+    """Report whether iris is signed in, as whom, and with what scopes."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    if not CLIENT_ID:
+        return "IRIS_CLIENT_ID is not set. See the setup notes in server.py."
+    cache = _cache()
+    app = _app(cache)
+    accounts = app.get_accounts()
+    if not accounts:
+        return "not signed in — run iris_login() first"
+    result = app.acquire_token_silent(SCOPES, account=accounts[0])
+    _save_cache(cache)
+    if not result or "access_token" not in result:
+        return "token expired or revoked — run iris_login() again"
+    # Cheap Graph probe within the granted scope. Deliberately NOT /me:
+    # reading the profile needs User.Read, which iris does not request.
+    _, code = _graph("GET", "/me/mailFolders?$top=1&$select=id", result["access_token"])
+    allow = _load_allowlist()
+    return json.dumps({
+        "signed_in_as": accounts[0].get("username"),
+        "scopes": SCOPES,
+        "graph_ok": code == 200,
+        "can_send": False,
+        "draft_folder": DRAFT_FOLDER or "Drafts",
+        "recipient_allowlist": allow or "(empty — all recipients permitted)",
+    }, indent=2)
+
+
+@mcp.tool()
+def iris_create_draft(
+    to: list[str],
+    subject: str,
+    body: str,
+    cc: list[str] | None = None,
+    bcc: list[str] | None = None,
+    html: bool = False,
+    reply_to_message_id: str | None = None,
+) -> str:
+    """Compose a message into the staging mail folder (IRIS_DRAFT_FOLDER,
+    default "AI Drafts"; created on first use). It is NOT sent — a human opens
+    Outlook and presses Send. Set reply_to_message_id to draft a threaded
+    reply to an existing message."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    if not to:
+        return "at least one 'to' recipient is required"
+    if len(body) > MAX_BODY:
+        return f"body too large ({len(body)} chars, max {MAX_BODY})"
+
+    everyone = _flatten(to, cc, bcc)
+    malformed = [a for a in everyone if not EMAIL_RE.match(a)]
+    if malformed:
+        return f"malformed addresses: {', '.join(malformed)}"
+    problem = _check_recipients(everyone)
+    if problem:
+        return problem
+
+    token, err = _token()
+    if err:
+        return err
+
+    content_type = "HTML" if html else "Text"
+
+    if reply_to_message_id:
+        draft, code = _graph("POST", f"/me/messages/{reply_to_message_id}/createReply", token)
+        if code not in (200, 201):
+            return f"createReply failed {code}: {json.dumps(draft)[:400]}"
+        draft_id = draft.get("id")
+        patch = {
+            "body": {"contentType": content_type, "content": body},
+            "toRecipients": _recips(to),
+        }
+        if subject:
+            patch["subject"] = subject
+        if cc:
+            patch["ccRecipients"] = _recips(cc)
+        if bcc:
+            patch["bccRecipients"] = _recips(bcc)
+        out, code = _graph("PATCH", f"/me/messages/{draft_id}", token, json=patch)
+        if code != 200:
+            return f"draft created but patch failed {code}: {json.dumps(out)[:400]}"
+        # createReply lands it in Drafts; relocate to the staging folder.
+        # NOTE: a move returns a NEW message id, so rebind out.
+        folder_id, ferr = _ensure_folder(token)
+        if ferr:
+            return ferr
+        if folder_id != "drafts":
+            moved, code = _graph(
+                "POST", f"/me/messages/{draft_id}/move", token,
+                json={"destinationId": folder_id},
+            )
+            if code not in (200, 201):
+                return f"drafted but move failed {code}: {json.dumps(moved)[:400]}"
+            out = moved
+    else:
+        payload = {
+            "subject": subject,
+            "body": {"contentType": content_type, "content": body},
+            "toRecipients": _recips(to),
+        }
+        if cc:
+            payload["ccRecipients"] = _recips(cc)
+        if bcc:
+            payload["bccRecipients"] = _recips(bcc)
+        folder_id, ferr = _ensure_folder(token)
+        if ferr:
+            return ferr
+        out, code = _graph(
+            "POST", f"/me/mailFolders/{folder_id}/messages", token, json=payload
+        )
+        if code not in (200, 201):
+            return f"draft creation failed {code}: {json.dumps(out)[:400]}"
+
+    _audit("draft", f"to={','.join(to)} subject={subject!r} id={out.get('id')}")
+    return json.dumps({
+        "status": "draft created — NOT sent",
+        "folder": DRAFT_FOLDER or "Drafts",
+        "id": out.get("id"),
+        "subject": out.get("subject"),
+        "to": [r["emailAddress"]["address"] for r in out.get("toRecipients", [])],
+        "webLink": out.get("webLink"),
+        "next": f"open the {DRAFT_FOLDER or 'Drafts'} folder in Outlook, read it, press Send",
+    }, indent=2)
+
+
+@mcp.tool()
+def iris_list_drafts(limit: int = 10) -> str:
+    """List recent messages sitting in the staging mail folder."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    limit = max(1, min(int(limit), 50))
+    token, err = _token()
+    if err:
+        return err
+    folder_id, ferr = _ensure_folder(token)
+    if ferr:
+        return ferr
+    q = (f"/me/mailFolders/{folder_id}/messages?$top={limit}"
+         "&$select=id,subject,toRecipients,createdDateTime,webLink"
+         "&$orderby=createdDateTime desc")
+    body, code = _graph("GET", q, token)
+    if code != 200:
+        return f"graph error {code}: {json.dumps(body)[:400]}"
+    items = [{
+        "id": m.get("id"),
+        "subject": m.get("subject"),
+        "to": [r["emailAddress"]["address"] for r in m.get("toRecipients", [])],
+        "created": m.get("createdDateTime"),
+        "webLink": m.get("webLink"),
+    } for m in body.get("value", [])]
+    return json.dumps(items, indent=2)
+
+
+@mcp.tool()
+def iris_update_draft(
+    draft_id: str,
+    subject: str | None = None,
+    body: str | None = None,
+    to: list[str] | None = None,
+    cc: list[str] | None = None,
+    bcc: list[str] | None = None,
+    html: bool = False,
+) -> str:
+    """Revise an existing draft in place. Only the fields you pass are changed."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    patch: dict = {}
+    if subject is not None:
+        patch["subject"] = subject
+    if body is not None:
+        if len(body) > MAX_BODY:
+            return f"body too large ({len(body)} chars, max {MAX_BODY})"
+        patch["body"] = {"contentType": "HTML" if html else "Text", "content": body}
+    for field, val in (("toRecipients", to), ("ccRecipients", cc), ("bccRecipients", bcc)):
+        if val is not None:
+            patch[field] = _recips(val)
+    if not patch:
+        return "nothing to update — pass at least one field"
+
+    everyone = _flatten(to, cc, bcc)
+    if everyone:
+        malformed = [a for a in everyone if not EMAIL_RE.match(a)]
+        if malformed:
+            return f"malformed addresses: {', '.join(malformed)}"
+        problem = _check_recipients(everyone)
+        if problem:
+            return problem
+
+    token, err = _token()
+    if err:
+        return err
+    out, code = _graph("PATCH", f"/me/messages/{draft_id}", token, json=patch)
+    if code != 200:
+        return f"update failed {code}: {json.dumps(out)[:400]}"
+    _audit("update", f"id={draft_id} fields={','.join(patch)}")
+    return json.dumps({
+        "status": "draft updated — still NOT sent",
+        "id": out.get("id"),
+        "subject": out.get("subject"),
+        "webLink": out.get("webLink"),
+    }, indent=2)
+
+
+@mcp.tool()
+def iris_delete_draft(draft_id: str, confirm: bool = False) -> str:
+    """Delete a draft. Destructive, so confirm=true is required — set it only
+    after the human has explicitly approved deleting this specific draft."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    if not confirm:
+        return ("refusing to delete without confirm=true. Ask the human first, "
+                "then retry with confirm=true.")
+    token, err = _token()
+    if err:
+        return err
+    out, code = _graph("DELETE", f"/me/messages/{draft_id}", token)
+    if code not in (200, 204):
+        return f"delete failed {code}: {json.dumps(out)[:400]}"
+    _audit("delete", f"id={draft_id}")
+    return f"draft {draft_id} deleted"
+
+
+def main() -> None:
+    """Console-script entry point."""
+    mcp.run()
+
+
+if __name__ == "__main__":
+    main()