The Email connector.
Send and receive email on behalf of the team. Connect once with your own key. Every agent your team runs reads the same 6 tools under one permission model.
How access is governed
2
Read tools
Open by default. They run when called, and every call is logged with the endpoint, tool and capability.
3
Write tools
Available through governed Slack workflows. MCP endpoints do not expose write tools.
1
Destructive tools
Admin-only in supported workflows, and never exposed over MCP.
Defaults come from the capability on each tool definition, and an admin can tighten or open any tool individually. The endpoint's capability ceiling can only tighten that policy. An endpoint scoped to read never surfaces a write tool.
Every Email tool
6 tools, named as the agent sees them.
- draft_emailwrite
Create an email draft for user review. The draft is posted to Slack with Approve/Discard buttons — the user clicks to confirm. ALWAYS pass slack_channel (and slack_thread_ts if inside a thread) so the interactive preview is rendered. The email will NOT send until the user approves. Do NOT repeat the preview in your own reply; the button message already shows it. For multiple CC recipients pass an array of addresses (e.g. ["a@x.com","b@y.com"]). Tenant-configured default CCs are merged in automatically; pass omit_default_cc=true ONLY when the user explicitly says not to CC them.
- send_draftwrite
Send a previously drafted email. Do NOT call this from the agent loop — the Slack Approve button on the draft_email preview calls the send path directly. If invoked from the agent loop it requires an explicit human approval click (the call is deferred via the approval flow even when invoked from a webhook or scheduled task) — it does NOT bypass review.
- send_emailwrite
AVOID — last-resort tool. Almost every flow should use draft_email instead so a human approves in Slack before the message is sent. This tool requires explicit human approval (the call is deferred via the approval flow even when invoked from a webhook or scheduled task) — it does NOT bypass review. Only consider it when there is genuinely no Slack channel available to post a draft preview to. For multiple CC recipients pass an array of addresses (e.g. ["a@x.com","b@y.com"]). Tenant-configured default CCs are merged in automatically; pass omit_default_cc=true ONLY when the user explicitly says not to CC them.
- discard_draftdestructive
Discard a draft email that the user has rejected or no longer wants to send.
- get_inbox_inforead
Get information about the configured email inbox.
- check_emailsread
Check for recent incoming emails and return a summary.
Use it from any agent
The same Email tools reach Claude Code, Cursor, Claude Desktop or your own agent through one MCP endpoint. The endpoint is scoped to a group, the token is issued per group and revocable from the dashboard, and an allowed-tool list and capability ceiling limit what it exposes. Reads run. Gated writes refuse unless an admin opens them. Destructive tools remain unavailable over MCP.
{
"mcpServers": {
"growth": {
"type": "http",
"url": "https://app.notara.ai/mcp/g/acme/growth",
"headers": {
"Authorization": "Bearer ntr_mcp_xxxxxxxxxxxxxxxxxxxx"
}
}
}
}The URL and token are placeholders. Real endpoints are issued per group from the dashboard.
Setup
- 01
Create a AgentMail API Key in your Email account (where to find it). The key is yours: Notara stores it encrypted and never sees a bill.
- 02
Paste it into the Notara dashboard. Credentials can be scoped to the workspace or to one person.
- 03
The tools appear with their capability defaults already set. Tighten or open any of them per tool, then invite the agent to a channel or issue an MCP token.
Connect Email once. Use it everywhere.
Use Notara directly, or bring us the workflow that needs to be redesigned and built.