email-agent-mcp vs Fastmail API (JMAP)

email-agent-mcp 84

v0.5.0 was tagged and published on 5 November 2026 (30). Nine npm releases in the 90 days from 8 August, v0.3.0 to v0.5.0 (20). Pull requests up to #234 merged in the history, all by the one maintainer; issue responses couldn't be read through GitHub's API that day (10 of 25). io.github.UseJunior/email-agent-mcp is in the official MCP registry with 0.5.0 marked latest (15). CI, commitlint, semgrep and Codecov workflows (9 of 10). Total 84.

Fastmail API (JMAP) 16

Fastmail keeps no API changelog, so recency rests on what we could date. The last dated change to the API or MCP server is the MCP launch on 22 April 2026, 196 days before this check. The 29 October 2026 blog post announces a Dynamic DNS API on api.fastmail.com with its own token type, which isn't part of the JMAP mailbox API graded here, and the JMAP section of the developer page carries no date (0 of 30). No dated API entries in the 90 days from 6 August; the blog's posts in that window cover the EU data region, a data recovery, a mailbox view, calendar time zones and Dynamic DNS (0 of 20). Support answers by email and form around the clock with a stated 24-hour reply target, per the 8 October check, and fastmail/JMAP-Samples has a last commit on 6 April 2026. No developer forum was found (9 of 15 for a closed service). No official SDK. The MCP registry wasn't searched, since its API is barred to us (3 of 15). The samples repository takes dependency updates and has no CI (4 of 10). 0 + 0 + 9 + 3 + 4 = 16.

email-agent-mcp 42

Apache-2.0 with a LICENSE file (30). SECURITY.md says tokens and mail are handled locally over stdio with no network listener, and the broker README says mail never reaches the broker and refresh tokens aren't stored. The broker has no published privacy policy (22 of 30). No deprecation policy (0). No telemetry was found in the README or package manifests, and none is stated either way (10 of 20). Total 62.

Fastmail API (JMAP) 74

The editorial half. A closed service with API Terms of Service and an API Developer Policy that state the grant, the limits and the governing law (Victoria, Australia). The protocol is an open IETF standard and the sample code is MIT (15 of 30). The privacy policy, updated 2 July 2026, names retention periods (IP logs up to one year, the address up to twelve months after closure, account data deleted within seven days of closure) and says customer data is not used to train AI. The DPA is public in five sections and three annexes, a transparency report counts law-enforcement requests by year, and the data residency page says backups, logs and debug systems stay in the US for EU accounts. No retention period for backups beyond the seven-day minimum was found (26 of 30). No deprecation policy. The API terms say Fastmail may make backwards-incompatible changes and will try to give notice (4 of 20). DPA Annex 3 names 36 subprocessors with the purpose of each, without a country for each, and the security help page names data centres in Philadelphia, St. Louis and Amsterdam (17 of 20). The provenance half is computed from the provenance block.

email-agent-mcp 60

Free, Apache-2.0 software with nothing to buy, scored 20 + 20 + 20 by the self-hosted rule. No payment protocol (0 of 40). Total 60.

Fastmail API (JMAP) 30

No x402, MPP or L402 on the developer page or the pricing page (0 of 40). Plan prices are public without a login, $6 a month or $60 a year for Individual and $6 a user a month for Business Standard, with API access included and no per-call price (10 of 20). A trial of up to 30 days needs no card, though Fastmail may ask for a mobile number, and the trial page doesn't say whether API tokens work during it (20). A person signs up in a browser and creates a token in settings, or consents on an OAuth screen (0 of 20).

email-agent-mcp 79

Tools are defined with typed input schemas that the MCP SDK publishes as JSON Schema (25). README in five languages, AGENTS.md, CLAUDE.md and GEMINI.md; no llms.txt, which a local server doesn't need (5 of 10). The README's tool table marks each tool read, write or destructive and states provider limits, such as Gmail deletes removing drafts only (15 of 20). Typed inputs with options such as list_style (12 of 15). Setup examples per client and documented error behaviour, such as NOT_SUPPORTED on Gmail and sanitised errors (10 of 15). Semver tags and GitHub Releases (12 of 15). Total 79.

Fastmail API (JMAP) 52

Graded on the JMAP API. Fastmail publishes no OpenAPI or similar file. The contract is the IETF text (RFC 8620, 8621 and 9610) plus a session object that lists capabilities and limits for a signed-in caller, which is machine-readable discovery but not a full schema. The MCP server's tool definitions sit behind sign-in and were not read (10 of 25). www.fastmail.com/llms.txt returned 404 on 8 October 2026 (0). The RFCs state the purpose, arguments, defaults and error cases of every method, and Fastmail's own page documents the scopes and the Masked Email extension. Nothing says when to prefer JMAP, IMAP or MCP (14 of 20). Arguments are typed in the RFCs with defaults and required fields, and filters are structured objects, with no schema file to validate against (12 of 15). The RFCs carry worked requests and error lists, and fastmail/JMAP-Samples has scripts in JavaScript, Python, Perl and Lua. Fastmail documents no errors of its own beyond rateLimit on Masked Email (11 of 15). Capability URIs version the protocol, but no API changelog was found. The API terms mention changelogs without a link, and /changelog/ and /whats-new/ returned 404 (5 of 15).

email-agent-mcp 50

Graded with the lines for local packages and stdio MCP servers. Installs from the official npm package email-agent-mcp with npx, CI runs on Node 20 (20). A CI workflow with Vitest tests, Codecov and a spec-coverage gate; the run results weren't readable through GitHub's API that day, so partial (20 of 25). Open crash and regression issues couldn't be read because GitHub's API refused our requests for its rate limit (0, unchecked). Semver tags from v0.1.7 to v0.5.0 and auto-categorised GitHub Releases as the changelog, with no breaking changes marked in what we read (10 of 15). Pre-1.0 (0). Total 50.

Fastmail API (JMAP) 59

Graded on the JMAP API with the hosted lines. fastmailstatus.com, run on Instatus, lists ten components with notice history, though none is named for JMAP or the API, so 15 as for other vendor pages with no component for the listed product. In the 90 days from 6 August 2026 the history shows partial outages that stopped some users reaching the service, 8 hours 17 minutes from 25 August (Login & sessions, 'a small number of users'), 1 hour 8 minutes on 4 September ('some users') and 5 hours 23 minutes on 7 October (one server, users with a full stop in the username), plus 11 hours 13 minutes of bounced replies from masked addresses from 23 September. Three support-ticket incidents (5 October, 14 October, 29 October) don't touch the API. Each incident touched a subset of users, so all are partial and read as minor (20). Sending limits are published per plan (8,000 messages a day on Individual and Standard, 120 on a trial, 500 logins per ten minutes), but no API request rate was found (8 of 15, a partial kept under the in-between rule). RFC 8620 defines the urn:ietf:params:jmap:error:limit problem type and a rateLimit error, and the developer page says Masked Email creation returns a rateLimit SetError. No Retry-After or backoff guidance was found, and EmailSubmission/set has no idempotency key (6 of 15, a partial kept). No SLA was found in the terms of service, the API terms or the pricing page, and the API terms say the APIs come as is (0). JMAP access with an API token carries no beta or preview label (10). 15 + 20 + 8 + 6 + 0 + 10 = 59.

email-agent-mcp 79

27 tools in the full profile, the 11 to 30 band, plus the observe profile as a read-only subset (20 of 25). List and search tools filter and page; we read the tool table, not every parameter (16 of 20). Errors are sanitised and use stable reasons such as NOT_SUPPORTED, failing closed before a Gmail mutation (15 of 20). readOnlyHint and destructiveHint on the tools in source; sends take no idempotency key (16 of 20). One npx command and a setup wizard for OAuth and mailbox choice; TypeScript only (12 of 15). Total 79.

Fastmail API (JMAP) 73

Graded on the JMAP API as RFC 8620 and 8621 specify it. Every /get call takes a properties list, Email/get returns no body text unless fetchTextBodyValues is set, maxBodyValueBytes caps it, and method calls batch into one request with back-references, so a search and a fetch cost one round trip. The MCP tool count was not read (22 of 25). /query takes a structured filter, sort, position, anchor, limit and collapseThreads, with /changes and /queryChanges for sync (20). Errors are typed at three levels, request problem details, method errors such as invalidArguments and per-object SetErrors such as tooManyRecipients and forbiddenFrom. Fastmail adds no error guide of its own (17 of 20). ifInState makes a write conditional on the state the client last saw, and creation IDs tie results to requests, but there is no idempotency key for sending. MCP annotations were not read (9 of 20). Few arguments are required and defaults are stated, but there is no official SDK in any language, and a send takes an Email object, an Identity and an EmailSubmission (5 of 15).