diff --git a/CHANGELOG.md b/CHANGELOG.md
index fbc5a7c..a71deba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.1.26
+
+- Expand the OAuth-protected MCP server with conversation, thread, and attachment retrieval plus
+  message and conversation state updates.
+- Add complete MCP draft management, staged attachments, rich-text sending and replies, and
+  forwarding with original attachments.
+- Grant new MCP clients the complete mail scope set by default while preserving explicit
+  least-privilege connections and requiring existing clients to reconnect for broader consent.
+
 ## 0.1.25
 
 - Keep manually forwarded Gmail messages visible in the reader while continuing to collapse genuine
diff --git a/app/features/mcp/consent-page.tsx b/app/features/mcp/consent-page.tsx
index 252b46a..fbb5556 100644
--- a/app/features/mcp/consent-page.tsx
+++ b/app/features/mcp/consent-page.tsx
@@ -11,9 +11,11 @@ type OAuthClient = {
 };
 
 const scopeDescriptions: Record<string, string> = {
-  "mail:read": "Read mailboxes and message text allowed by your mailbox grants",
-  "mail:write": "Change message state where you have agent access",
-  "mail:send": "Send email and replies where you have agent access",
+  "mail:read":
+    "Read allowed mailboxes, conversations, message text, threads, and bounded attachments",
+  "mail:write": "Change message and conversation state where you have agent access",
+  "mail:send":
+    "Manage drafts and attachments, then send, reply, or forward where you have agent access",
   offline_access: "Stay connected until you revoke access"
 };
 
diff --git a/docs/mcp.md b/docs/mcp.md
index 804536a..ef3af3f 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -9,7 +9,49 @@ Cloudflare grants, runtime secrets, and customer credentials never enter the MCP
 MCP scopes never broaden workspace permissions. Every request intersects the granted scopes with
 the user's current mailbox grants, role, ban state, and session validity.
 
-Available tools cover listing accessible mailboxes, searching readable messages, reading message
-content, changing message state, creating drafts, sending, and replying. Responses exclude setup
-values, secrets, Cloudflare credentials, and attachment bytes. Content-free audit events record
-successful state changes and sends.
+New dynamically registered clients default to `mail:read`, `mail:write`, and `mail:send` so clients
+that omit registration scopes receive the complete mail surface after explicit consent. A client
+may request less access, and existing clients or consents are never silently broadened. Revoke and
+reconnect an older read-only client to register it with the new defaults.
+
+## Tools
+
+`mail:read` provides:
+
+- `list_mailboxes`
+- `search_messages`
+- `list_conversations`
+- `get_message`
+- `get_thread`
+- `get_attachment`
+
+`mail:write` provides:
+
+- `update_message`
+- `update_conversation`
+
+`mail:send` provides:
+
+- `list_drafts`
+- `get_draft`
+- `create_draft`
+- `update_draft`
+- `delete_draft`
+- `add_draft_attachment`
+- `remove_draft_attachment`
+- `send_email`
+- `reply_to_message`
+- `forward_message`
+
+Drafts use revision numbers to prevent silent overwrites. Send and reply accept plain text with
+optional HTML and staged draft attachment IDs. Forwarding creates the forwarded context on the
+server and can retain the original message attachments.
+
+Messages expose safe attachment metadata without storage keys. `get_attachment` returns an MCP
+embedded resource and `add_draft_attachment` accepts base64 content. Each MCP binary transfer is
+limited to 10 MiB; HQBase's existing total attachment and recipient limits still apply.
+
+HQBase records successful state changes, draft and attachment mutations, sends, replies, and
+forwards as content-free audit events. MCP does not expose setup values, secrets, Cloudflare
+credentials, user or workspace administration, infrastructure operations, or a new-mail
+subscription.
diff --git a/package.json b/package.json
index 901e406..9f26697 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "hqbase",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "private": true,
   "type": "module",
   "packageManager": "pnpm@11.7.0",
diff --git a/test/integration/worker/mcp.test.ts b/test/integration/worker/mcp.test.ts
index 9aafaab..eb3b51f 100644
--- a/test/integration/worker/mcp.test.ts
+++ b/test/integration/worker/mcp.test.ts
@@ -11,7 +11,9 @@ import { hashOAuthToken } from "../../../worker/auth/oauth-token";
 const origin = "https://hqbase.test";
 const userId = "usr_mcp_member";
 const sessionId = "ses_mcp_member";
-const token = "hqb_access_mcp-hqbase-access-token";
+const readToken = "hqb_access_mcp-hqbase-read-token";
+const fullToken = "hqb_access_mcp-hqbase-full-token";
+const fullScopes = ["mail:read", "mail:write", "mail:send"];
 
 describe("HQBase MCP server", () => {
   beforeAll(async () => {
@@ -25,7 +27,8 @@ describe("HQBase MCP server", () => {
       await applyMigration(migration);
     }
     const now = new Date();
-    const storedAccessToken = await hashOAuthToken("mcp-hqbase-access-token");
+    const storedReadToken = await hashOAuthToken("mcp-hqbase-read-token");
+    const storedFullToken = await hashOAuthToken("mcp-hqbase-full-token");
     await env.DB.batch([
       env.DB.prepare(
         `INSERT INTO "user"
@@ -52,10 +55,24 @@ describe("HQBase MCP server", () => {
         `INSERT INTO mailboxes (id, address, display_name, is_active, created_at, updated_at)
          VALUES ('mbx_hidden', 'hidden@example.com', 'Hidden', 1, ?, ?)`
       ).bind(now.toISOString(), now.toISOString()),
+      env.DB.prepare(
+        `INSERT INTO mail_domains (
+          id, name, receiving_status, sending_status, dns_status, is_enabled, created_at, updated_at
+        ) VALUES ('dom_example', 'example.com', 'ready', 'ready', 'ready', 1, ?, ?)`
+      ).bind(now.toISOString(), now.toISOString()),
+      env.DB.prepare(
+        `INSERT INTO mailbox_addresses (
+          id, mailbox_id, mail_domain_id, local_part, address, display_name,
+          receive_enabled, send_enabled, is_primary, created_at, updated_at
+        ) VALUES (
+          'addr_allowed', 'mbx_allowed', 'dom_example', 'allowed', 'allowed@example.com', 'Allowed',
+          1, 1, 1, ?, ?
+        )`
+      ).bind(now.toISOString(), now.toISOString()),
       env.DB.prepare(
         `INSERT INTO mailbox_grants
          (mailbox_id, user_id, access_level, created_by, created_at, updated_at)
-         VALUES ('mbx_allowed', ?, 'read', ?, ?, ?)`
+         VALUES ('mbx_allowed', ?, 'agent', ?, ?, ?)`
       ).bind(userId, userId, now.toISOString(), now.toISOString()),
       env.DB.prepare(
         `INSERT INTO oauthClient
@@ -76,14 +93,94 @@ describe("HQBase MCP server", () => {
          (id, token, clientId, sessionId, userId, expiresAt, createdAt, scopes)
          VALUES ('access_mcp_hqbase', ?, 'client_mcp_hqbase', ?, ?, ?, ?, ?)`
       ).bind(
-        storedAccessToken,
+        storedReadToken,
         sessionId,
         userId,
         new Date(now.getTime() + 60 * 60 * 1000).toISOString(),
         now.toISOString(),
         JSON.stringify(["mail:read"])
-      )
+      ),
+      env.DB.prepare(
+        `INSERT INTO oauthClient
+         (id, clientId, disabled, redirectUris, public, requirePKCE, createdAt, updatedAt)
+         VALUES ('oc_mcp_hqbase_full', 'client_mcp_hqbase_full', 0, ?, 1, 1, ?, ?)`
+      ).bind(
+        JSON.stringify(["https://client.example/full-callback"]),
+        now.toISOString(),
+        now.toISOString()
+      ),
+      env.DB.prepare(
+        `INSERT INTO oauthConsent
+         (id, clientId, userId, scopes, createdAt, updatedAt)
+         VALUES ('consent_mcp_hqbase_full', 'client_mcp_hqbase_full', ?, ?, ?, ?)`
+      ).bind(userId, JSON.stringify(fullScopes), now.toISOString(), now.toISOString()),
+      env.DB.prepare(
+        `INSERT INTO oauthAccessToken
+         (id, token, clientId, sessionId, userId, expiresAt, createdAt, scopes)
+         VALUES ('access_mcp_hqbase_full', ?, 'client_mcp_hqbase_full', ?, ?, ?, ?, ?)`
+      ).bind(
+        storedFullToken,
+        sessionId,
+        userId,
+        new Date(now.getTime() + 60 * 60 * 1000).toISOString(),
+        now.toISOString(),
+        JSON.stringify(fullScopes)
+      ),
+      env.DB.prepare(
+        `INSERT INTO threads (id, subject_normalized, last_message_at, created_at, updated_at)
+         VALUES ('thr_mcp_allowed', 'mcp allowed', ?, ?, ?)`
+      ).bind(now.toISOString(), now.toISOString(), now.toISOString()),
+      env.DB.prepare(
+        `INSERT INTO messages (
+          id, thread_id, mailbox_id, direction, folder, from_address, to_json, cc_json, bcc_json,
+          subject, snippet, text_body, message_id, dedupe_key, in_reply_to, references_json,
+          received_at, sent_at, read_at, has_attachments, created_at, updated_at
+        ) VALUES (
+          'msg_mcp_allowed', 'thr_mcp_allowed', 'mbx_allowed', 'inbound', 'inbox',
+          'sender@example.com', ?, '[]', '[]', 'MCP allowed', 'Attachment body',
+          'Attachment body', '<mcp-allowed@example.com>', 'mcp-allowed:allowed@example.com',
+          NULL, '[]', ?, NULL, NULL, 1, ?, ?
+        )`
+      ).bind(
+        JSON.stringify(["allowed@example.com"]),
+        now.toISOString(),
+        now.toISOString(),
+        now.toISOString()
+      ),
+      env.DB.prepare(
+        `INSERT INTO message_attachments
+         (id, message_id, filename, content_type, size_bytes, content_id, r2_key, created_at)
+         VALUES (
+           'att_mcp_allowed', 'msg_mcp_allowed', 'hello.txt', 'text/plain', 5, NULL,
+           'mail/mcp/hello.txt', ?
+         )`
+      ).bind(now.toISOString())
     ]);
+    await env.MAIL_OBJECTS.put("mail/mcp/hello.txt", "hello", {
+      httpMetadata: { contentType: "text/plain" }
+    });
+  });
+
+  it("defaults dynamically registered clients to the complete mail scope", async () => {
+    const metadataResponse = await SELF.fetch(
+      `${origin}/.well-known/oauth-authorization-server/api/auth`
+    );
+    expect(metadataResponse.status).toBe(200);
+    const metadata = (await metadataResponse.json()) as { registration_endpoint?: string };
+    expect(metadata.registration_endpoint).toBeTruthy();
+
+    const registration = await SELF.fetch(metadata.registration_endpoint ?? "", {
+      body: JSON.stringify({
+        client_name: "HQBase MCP default scope test",
+        redirect_uris: ["https://client.example/default-callback"],
+        token_endpoint_auth_method: "none"
+      }),
+      headers: { "content-type": "application/json" },
+      method: "POST"
+    });
+    expect(registration.status).toBe(201);
+    const registered = (await registration.json()) as { scope?: string };
+    expect(registered.scope?.split(" ").sort()).toEqual([...fullScopes].sort());
   });
 
   it("publishes OAuth discovery and challenges unauthenticated clients", async () => {
@@ -109,45 +206,171 @@ describe("HQBase MCP server", () => {
   });
 
   it("registers only tools granted by OAuth scopes", async () => {
-    const response = await mcpRequest(
-      { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} },
-      token
-    );
-    expect(response.status).toBe(200);
-    const payload = (await response.json()) as { result?: { tools?: Array<{ name: string }> } };
-    expect(payload.result?.tools?.map((tool) => tool.name)).toEqual([
+    expect(await listToolNames(readToken)).toEqual([
       "list_mailboxes",
       "search_messages",
-      "get_message"
+      "list_conversations",
+      "get_message",
+      "get_thread",
+      "get_attachment"
+    ]);
+    expect(await listToolNames(fullToken)).toEqual([
+      "list_mailboxes",
+      "search_messages",
+      "list_conversations",
+      "get_message",
+      "get_thread",
+      "get_attachment",
+      "update_message",
+      "update_conversation",
+      "list_drafts",
+      "get_draft",
+      "create_draft",
+      "update_draft",
+      "delete_draft",
+      "add_draft_attachment",
+      "remove_draft_attachment",
+      "send_email",
+      "reply_to_message",
+      "forward_message"
     ]);
   });
 
   it("filters mailbox results through live mailbox grants", async () => {
+    const mailboxes = (await callTool("list_mailboxes", {}, readToken)) as Array<{ id: string }>;
+    expect(mailboxes.map((mailbox) => mailbox.id)).toEqual(["mbx_allowed"]);
+  });
+
+  it("reads permitted threads and returns bounded embedded attachments", async () => {
+    const thread = (await callTool(
+      "get_thread",
+      { messageId: "msg_mcp_allowed" },
+      readToken
+    )) as Array<{ id: string }>;
+    expect(thread.map((message) => message.id)).toEqual(["msg_mcp_allowed"]);
+
     const response = await mcpRequest(
       {
         jsonrpc: "2.0",
-        id: 3,
+        id: 5,
         method: "tools/call",
-        params: { name: "list_mailboxes", arguments: {} }
+        params: { name: "get_attachment", arguments: { attachmentId: "att_mcp_allowed" } }
       },
-      token
+      readToken
     );
-    expect(response.status).toBe(200);
     const payload = (await response.json()) as {
-      result?: { content?: Array<{ text?: string }> };
+      result?: {
+        content?: Array<
+          | { type: "text"; text: string }
+          | { type: "resource"; resource: { blob?: string; mimeType?: string } }
+        >;
+      };
     };
-    const mailboxes = JSON.parse(payload.result?.content?.[0]?.text ?? "[]") as Array<{
-      id: string;
-    }>;
-    expect(mailboxes.map((mailbox) => mailbox.id)).toEqual(["mbx_allowed"]);
+    expect(payload.result?.content?.[1]).toMatchObject({
+      type: "resource",
+      resource: { blob: "aGVsbG8=", mimeType: "text/plain" }
+    });
+  });
+
+  it("creates revisioned drafts and stages base64 attachments with full consent", async () => {
+    const created = (await callTool(
+      "create_draft",
+      {
+        mailboxId: "mbx_allowed",
+        from: "allowed@example.com",
+        to: ["recipient@example.com"],
+        subject: "Draft from MCP",
+        text: "Review me"
+      },
+      fullToken
+    )) as { id: string; version: number };
+    expect(created).toMatchObject({ version: 1 });
+
+    const attachment = (await callTool(
+      "add_draft_attachment",
+      {
+        draftId: created.id,
+        filename: "draft.txt",
+        contentType: "text/plain",
+        contentBase64: "ZHJhZnQ="
+      },
+      fullToken
+    )) as { id: string; filename: string };
+    expect(attachment.filename).toBe("draft.txt");
+
+    const updated = (await callTool(
+      "update_draft",
+      {
+        draftId: created.id,
+        version: created.version,
+        text: "Updated review"
+      },
+      fullToken
+    )) as { attachments: Array<{ id: string }>; text: string; version: number };
+    expect(updated).toMatchObject({ text: "Updated review", version: 2 });
+    expect(updated.attachments.map((item) => item.id)).toEqual([attachment.id]);
+
+    await env.DB.prepare(
+      "UPDATE mail_domains SET sending_status = 'disabled' WHERE id = 'dom_example'"
+    ).run();
+    await expect(callTool("get_draft", { draftId: created.id }, fullToken)).resolves.toMatchObject({
+      id: created.id
+    });
+    await env.DB.prepare(
+      "UPDATE mail_domains SET sending_status = 'ready' WHERE id = 'dom_example'"
+    ).run();
+  });
+
+  it("applies conversation actions through agent access", async () => {
+    await expect(
+      callTool(
+        "update_conversation",
+        {
+          action: "star",
+          activeFolder: "inbox",
+          messageId: "msg_mcp_allowed"
+        },
+        fullToken
+      )
+    ).resolves.toMatchObject({ affected: 1, threadId: "thr_mcp_allowed" });
   });
 });
 
+async function listToolNames(accessToken: string): Promise<string[]> {
+  const response = await mcpRequest(
+    { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} },
+    accessToken
+  );
+  expect(response.status).toBe(200);
+  const payload = (await response.json()) as { result?: { tools?: Array<{ name: string }> } };
+  return payload.result?.tools?.map((tool) => tool.name) ?? [];
+}
+
+async function callTool(name: string, args: unknown, accessToken: string): Promise<unknown> {
+  const response = await mcpRequest(
+    {
+      jsonrpc: "2.0",
+      id: crypto.randomUUID(),
+      method: "tools/call",
+      params: { name, arguments: args }
+    },
+    accessToken
+  );
+  expect(response.status).toBe(200);
+  const payload = (await response.json()) as {
+    result?: { content?: Array<{ text?: string }>; isError?: boolean };
+  };
+  if (payload.result?.isError) {
+    throw new Error(payload.result.content?.[0]?.text ?? `${name} failed without an error body.`);
+  }
+  return JSON.parse(payload.result?.content?.[0]?.text ?? "null") as unknown;
+}
+
 function mcpRequest(body: unknown, accessToken?: string): Promise<Response> {
   const headers = new Headers({
     accept: "application/json, text/event-stream",
     "content-type": "application/json",
-    "mcp-hqbasetocol-version": "2025-11-25"
+    "mcp-protocol-version": "2025-11-25"
   });
   if (accessToken) headers.set("authorization", `Bearer ${accessToken}`);
   return SELF.fetch(`${origin}/mcp`, {
diff --git a/test/unit/worker/features/send/forward-service.test.ts b/test/unit/worker/features/send/forward-service.test.ts
new file mode 100644
index 0000000..fc22d99
--- /dev/null
+++ b/test/unit/worker/features/send/forward-service.test.ts
@@ -0,0 +1,200 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@worker/features/drafts/queries", () => ({
+  addDraftAttachment: vi.fn(),
+  deleteDraft: vi.fn(),
+  saveDraft: vi.fn()
+}));
+vi.mock("@worker/features/mailboxes/queries", () => ({
+  findMailboxForSending: vi.fn()
+}));
+vi.mock("@worker/features/messages/queries", () => ({
+  getMessageDetail: vi.fn()
+}));
+vi.mock("@worker/features/send/service", () => ({
+  sendNewMessage: vi.fn()
+}));
+
+import { addDraftAttachment, deleteDraft, saveDraft } from "@worker/features/drafts/queries";
+import { findMailboxForSending } from "@worker/features/mailboxes/queries";
+import { getMessageDetail } from "@worker/features/messages/queries";
+import { forwardMessage } from "@worker/features/send/forward";
+import { sendNewMessage } from "@worker/features/send/service";
+import type { WorkerEnv } from "@worker/lib/env";
+
+const original = {
+  id: "message-1",
+  threadId: "thread-1",
+  mailboxId: "mailbox-1",
+  direction: "inbound" as const,
+  folder: "inbox" as const,
+  fromAddress: "sender@example.com",
+  to: ["support@example.com"],
+  cc: [],
+  bcc: [],
+  subject: "Original",
+  snippet: "Original body",
+  textBody: "Original body",
+  receivedAt: "2026-07-29T12:00:00.000Z",
+  sentAt: null,
+  readAt: null,
+  starredAt: null,
+  hasAttachments: false,
+  createdAt: "2026-07-29T12:00:00.000Z",
+  deliveredToAddress: "support@example.com",
+  htmlAvailable: false,
+  messageId: "<message-1@example.com>",
+  inReplyTo: null,
+  references: [],
+  attachments: []
+};
+const mailbox = {
+  id: "mailbox-1",
+  address: "support@example.com",
+  displayName: "Support",
+  isActive: true,
+  addresses: [],
+  createdAt: "2026-07-29T12:00:00.000Z",
+  updatedAt: "2026-07-29T12:00:00.000Z"
+};
+const sent = {
+  id: "message-forwarded",
+  threadId: "thread-forwarded",
+  mailboxId: mailbox.id,
+  direction: "outbound" as const,
+  folder: "sent" as const,
+  fromAddress: mailbox.address,
+  to: ["recipient@example.com"],
+  subject: "Fwd: Original",
+  snippet: "Forwarded",
+  receivedAt: null,
+  sentAt: "2026-07-29T12:01:00.000Z",
+  readAt: "2026-07-29T12:01:00.000Z",
+  starredAt: null,
+  hasAttachments: false,
+  createdAt: "2026-07-29T12:01:00.000Z"
+};
+
+describe("forward service", () => {
+  const get = vi.fn();
+  const put = vi.fn();
+  const env = {
+    DB: {} as D1Database,
+    MAIL_OBJECTS: { get, put } as unknown as R2Bucket
+  } as WorkerEnv;
+
+  beforeEach(() => {
+    vi.resetAllMocks();
+    vi.mocked(getMessageDetail).mockResolvedValue(original);
+    vi.mocked(findMailboxForSending).mockResolvedValue(mailbox);
+    vi.mocked(sendNewMessage).mockResolvedValue(sent);
+  });
+
+  it("sends server-owned forwarded context as a new message", async () => {
+    await expect(
+      forwardMessage(
+        env,
+        {
+          messageId: original.id,
+          from: mailbox.address,
+          to: ["recipient@example.com"],
+          cc: [],
+          bcc: [],
+          text: "Please review",
+          attachmentIds: [],
+          includeOriginalAttachments: true
+        },
+        "user-1"
+      )
+    ).resolves.toEqual(sent);
+
+    expect(sendNewMessage).toHaveBeenCalledWith(
+      env,
+      expect.objectContaining({
+        attachmentIds: [],
+        from: mailbox.address,
+        subject: "Fwd: Original",
+        text: expect.stringContaining("---------- Forwarded message ---------"),
+        to: ["recipient@example.com"]
+      }),
+      "user-1"
+    );
+    expect(saveDraft).not.toHaveBeenCalled();
+  });
+
+  it("copies original attachments through a temporary draft before sending", async () => {
+    const attachment = {
+      id: "attachment-1",
+      messageId: original.id,
+      filename: "original.txt",
+      contentType: "text/plain",
+      sizeBytes: 8,
+      contentId: null,
+      r2Key: "mail/original.txt",
+      createdAt: original.createdAt
+    };
+    vi.mocked(getMessageDetail).mockResolvedValue({
+      ...original,
+      attachments: [attachment],
+      hasAttachments: true
+    });
+    vi.mocked(saveDraft).mockResolvedValue({
+      id: "draft-forward",
+      mailboxId: mailbox.id,
+      replyToMessageId: null,
+      forwardOfMessageId: original.id,
+      from: mailbox.address,
+      to: ["recipient@example.com"],
+      cc: [],
+      bcc: [],
+      subject: "Fwd: Original",
+      text: "Forwarded",
+      html: "<blockquote>Forwarded</blockquote>",
+      version: 1,
+      updatedAt: original.createdAt,
+      attachments: []
+    });
+    get.mockResolvedValue({
+      arrayBuffer: async () => new TextEncoder().encode("original").buffer
+    });
+    vi.mocked(addDraftAttachment).mockResolvedValue({
+      attachment: {
+        id: "attachment-copy",
+        filename: "original.txt",
+        contentType: "text/plain",
+        sizeBytes: 8
+      },
+      r2Key: "drafts/user-1/draft-forward/attachment-copy"
+    });
+
+    await forwardMessage(
+      env,
+      {
+        messageId: original.id,
+        from: mailbox.address,
+        to: ["recipient@example.com"],
+        cc: [],
+        bcc: [],
+        text: "",
+        attachmentIds: [],
+        includeOriginalAttachments: true
+      },
+      "user-1"
+    );
+
+    expect(put).toHaveBeenCalledWith(
+      "drafts/user-1/draft-forward/attachment-copy",
+      expect.any(ReadableStream),
+      { httpMetadata: { contentType: "text/plain" } }
+    );
+    expect(sendNewMessage).toHaveBeenCalledWith(
+      env,
+      expect.objectContaining({
+        attachmentIds: ["attachment-copy"],
+        draftId: "draft-forward"
+      }),
+      "user-1"
+    );
+    expect(deleteDraft).not.toHaveBeenCalled();
+  });
+});
diff --git a/test/unit/worker/features/send/forward.test.ts b/test/unit/worker/features/send/forward.test.ts
new file mode 100644
index 0000000..f482254
--- /dev/null
+++ b/test/unit/worker/features/send/forward.test.ts
@@ -0,0 +1,43 @@
+import { forwardedBody } from "@worker/features/send/forward";
+import { describe, expect, it } from "vitest";
+
+describe("forwarded mail body", () => {
+  it("builds visible server-owned text and escaped HTML context", () => {
+    const body = forwardedBody(
+      {
+        id: "message-1",
+        threadId: "thread-1",
+        mailboxId: "mailbox-1",
+        direction: "inbound",
+        folder: "inbox",
+        fromAddress: "sender@example.com",
+        to: ["support@example.com"],
+        cc: ["manager@example.com"],
+        bcc: [],
+        subject: "Status <script>",
+        snippet: "Original",
+        textBody: "Original <script>alert(1)</script>",
+        receivedAt: "2026-07-29T12:00:00.000Z",
+        sentAt: null,
+        readAt: null,
+        starredAt: null,
+        hasAttachments: false,
+        createdAt: "2026-07-29T12:00:00.000Z",
+        deliveredToAddress: "support@example.com",
+        htmlAvailable: false,
+        messageId: "<message-1@example.com>",
+        inReplyTo: null,
+        references: [],
+        attachments: []
+      },
+      "Please review",
+      "<p><strong>Please review</strong></p>"
+    );
+
+    expect(body.text).toContain("Please review\n\n---------- Forwarded message ---------");
+    expect(body.text).toContain("From: sender@example.com");
+    expect(body.html).toContain("<p><strong>Please review</strong></p>");
+    expect(body.html).toContain("&lt;script&gt;alert(1)&lt;/script&gt;");
+    expect(body.html).not.toContain("<script>");
+  });
+});
diff --git a/worker/auth/auth.ts b/worker/auth/auth.ts
index 37a42b3..15ce9fe 100644
--- a/worker/auth/auth.ts
+++ b/worker/auth/auth.ts
@@ -39,8 +39,8 @@ export function createAuth(env: WorkerEnv, request: Request) {
       oauthProvider({
         allowDynamicClientRegistration: true,
         allowUnauthenticatedClientRegistration: true,
-        clientRegistrationAllowedScopes: ["mail:write", "mail:send", "offline_access"],
-        clientRegistrationDefaultScopes: ["mail:read"],
+        clientRegistrationAllowedScopes: ["offline_access"],
+        clientRegistrationDefaultScopes: ["mail:read", "mail:write", "mail:send"],
         consentPage: "/mcp/consent",
         disableJwtPlugin: true,
         grantTypes: ["authorization_code", "refresh_token"],
diff --git a/worker/features/drafts/queries.ts b/worker/features/drafts/queries.ts
index 6816583..1b3e20f 100644
--- a/worker/features/drafts/queries.ts
+++ b/worker/features/drafts/queries.ts
@@ -251,3 +251,23 @@ export async function draftAttachmentObjects(
     })
   );
 }
+
+export async function draftIdsForAttachmentIds(
+  db: D1Database,
+  userId: string,
+  ids: string[]
+): Promise<string[]> {
+  if (ids.length === 0) return [];
+  const rows = await db
+    .prepare(
+      `SELECT a.id, a.draft_id FROM draft_attachments a
+       JOIN drafts d ON d.id = a.draft_id
+       WHERE d.user_id = ? AND a.id IN (${ids.map(() => "?").join(",")})`
+    )
+    .bind(userId, ...ids)
+    .all<{ id: string; draft_id: string }>();
+  if (rows.results.length !== new Set(ids).size) {
+    throw new AppError("ATTACHMENT_NOT_FOUND", "One or more attachments are unavailable.", 404);
+  }
+  return [...new Set(rows.results.map((row) => row.draft_id))];
+}
diff --git a/worker/features/mcp/draft-tools.ts b/worker/features/mcp/draft-tools.ts
new file mode 100644
index 0000000..c7e2eaf
--- /dev/null
+++ b/worker/features/mcp/draft-tools.ts
@@ -0,0 +1,320 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+
+import { type MailboxAccessLevel, requireMailboxAccess } from "../../auth/mailbox-access";
+import type { WorkerEnv } from "../../lib/env";
+import { AppError } from "../../lib/errors";
+import { parseWith } from "../../lib/validation";
+import { recordAudit } from "../audit/service";
+import {
+  addDraftAttachment,
+  deleteDraft,
+  draftIdsForAttachmentIds,
+  getDraft,
+  listDrafts,
+  removeDraftAttachment,
+  saveDraft
+} from "../drafts/queries";
+import type { Draft } from "../drafts/types";
+import { draftSchema } from "../drafts/validation";
+import { listMailboxesForUser } from "../mailboxes/queries";
+import type { Mailbox } from "../mailboxes/types";
+import { getMessageMailboxId } from "../messages/queries";
+
+import type { McpPrincipal } from "./route";
+import { base64File, maxMcpAttachmentBase64Length, toolResult } from "./tool-result";
+
+const recipients = z.array(z.string().email()).max(50);
+const createDraftShape = {
+  mailboxId: z.string().min(1).max(100).nullable().default(null),
+  replyToMessageId: z.string().min(1).max(100).nullable().default(null),
+  forwardOfMessageId: z.string().min(1).max(100).nullable().default(null),
+  from: z.union([z.literal(""), z.string().email()]).default(""),
+  to: recipients.default([]),
+  cc: recipients.default([]),
+  bcc: recipients.default([]),
+  subject: z.string().max(200).default(""),
+  text: z.string().max(100_000).default(""),
+  html: z.string().max(200_000).default("")
+};
+
+export function registerDraftTools(
+  server: McpServer,
+  env: WorkerEnv,
+  principal: McpPrincipal
+): void {
+  if (!principal.scopes.has("mail:send")) return;
+
+  server.registerTool(
+    "list_drafts",
+    {
+      description: "List this user's drafts that remain accessible through live mailbox grants.",
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    },
+    () =>
+      toolResult(async () => {
+        const drafts = await listDrafts(env.DB, principal.userId);
+        const mailboxes = await listMailboxesForUser(env.DB, principal.userId, principal.role);
+        const visibility = await Promise.all(
+          drafts.map(async (draft) => {
+            try {
+              await requireDraftAccess(env, principal, draft, mailboxes);
+              return draft;
+            } catch (error) {
+              if (!(error instanceof AppError)) throw error;
+              return null;
+            }
+          })
+        );
+        return visibility.filter((draft): draft is Draft => draft !== null);
+      })
+  );
+
+  server.registerTool(
+    "get_draft",
+    {
+      description: "Open one user-owned draft after rechecking its live mailbox access.",
+      inputSchema: { draftId: z.string().min(1).max(100) },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    },
+    ({ draftId }) =>
+      toolResult(async () => {
+        const draft = await ownedDraft(env, principal, draftId);
+        await requireDraftAccess(env, principal, draft);
+        return draft;
+      })
+  );
+
+  server.registerTool(
+    "create_draft",
+    {
+      description: "Create a user-owned draft for an allowed sending mailbox.",
+      inputSchema: createDraftShape,
+      annotations: { destructiveHint: false, idempotentHint: false, openWorldHint: false }
+    },
+    (input) =>
+      toolResult(async () => {
+        const parsed = parseWith(draftSchema, input);
+        await requireDraftAccess(env, principal, parsed);
+        const draft = await saveDraft(env.DB, principal.userId, parsed);
+        await recordDraftMutation(env, principal, "mcp.draft.create", draft.id);
+        return draft;
+      })
+  );
+
+  server.registerTool(
+    "update_draft",
+    {
+      description:
+        "Update a user-owned draft by version; omitted fields preserve their current values.",
+      inputSchema: {
+        draftId: z.string().min(1).max(100),
+        version: z.number().int().positive(),
+        mailboxId: createDraftShape.mailboxId.optional(),
+        replyToMessageId: createDraftShape.replyToMessageId.optional(),
+        forwardOfMessageId: createDraftShape.forwardOfMessageId.optional(),
+        from: createDraftShape.from.optional(),
+        to: recipients.optional(),
+        cc: recipients.optional(),
+        bcc: recipients.optional(),
+        subject: createDraftShape.subject.optional(),
+        text: createDraftShape.text.optional(),
+        html: createDraftShape.html.optional()
+      },
+      annotations: { destructiveHint: false, idempotentHint: false, openWorldHint: false }
+    },
+    ({ draftId, version, ...changes }) =>
+      toolResult(async () => {
+        const current = await ownedDraft(env, principal, draftId);
+        await requireDraftAccess(env, principal, current);
+        const parsed = parseWith(draftSchema, {
+          ...current,
+          ...changes,
+          id: draftId,
+          version
+        });
+        await requireDraftAccess(env, principal, parsed);
+        const draft = await saveDraft(env.DB, principal.userId, parsed);
+        await recordDraftMutation(env, principal, "mcp.draft.update", draft.id);
+        return draft;
+      })
+  );
+
+  server.registerTool(
+    "delete_draft",
+    {
+      description: "Delete one accessible user-owned draft and its staged attachments.",
+      inputSchema: { draftId: z.string().min(1).max(100) },
+      annotations: { destructiveHint: true, idempotentHint: true, openWorldHint: false }
+    },
+    ({ draftId }) =>
+      toolResult(async () => {
+        const draft = await ownedDraft(env, principal, draftId);
+        await requireDraftAccess(env, principal, draft);
+        await deleteDraft(env.DB, env.MAIL_OBJECTS, principal.userId, draftId);
+        await recordDraftMutation(env, principal, "mcp.draft.delete", draftId);
+        return { deleted: true, draftId };
+      })
+  );
+
+  registerDraftAttachmentTools(server, env, principal);
+}
+
+function registerDraftAttachmentTools(
+  server: McpServer,
+  env: WorkerEnv,
+  principal: McpPrincipal
+): void {
+  server.registerTool(
+    "add_draft_attachment",
+    {
+      description: "Stage a base64 attachment of at most 10 MiB on an accessible draft.",
+      inputSchema: {
+        draftId: z.string().min(1).max(100),
+        filename: z
+          .string()
+          .trim()
+          .min(1)
+          .max(255)
+          .regex(/^[^\p{Cc}/\\"]+$/u),
+        contentType: z
+          .string()
+          .trim()
+          .min(1)
+          .max(255)
+          .regex(/^[A-Za-z0-9!#$&^_.+-]+\/[A-Za-z0-9!#$&^_.+-]+$/)
+          .default("application/octet-stream"),
+        contentBase64: z
+          .string()
+          .max(maxMcpAttachmentBase64Length)
+          .regex(/^[A-Za-z0-9+/]*={0,2}$/)
+      },
+      annotations: { destructiveHint: false, idempotentHint: false, openWorldHint: false }
+    },
+    (input) =>
+      toolResult(async () => {
+        const draft = await ownedDraft(env, principal, input.draftId);
+        await requireDraftAccess(env, principal, draft);
+        const file = base64File(input);
+        const added = await addDraftAttachment(env.DB, principal.userId, draft.id, file);
+        await env.MAIL_OBJECTS.put(added.r2Key, file.stream(), {
+          httpMetadata: { contentType: added.attachment.contentType }
+        });
+        await recordDraftMutation(env, principal, "mcp.draft.attachment.add", added.attachment.id);
+        return added.attachment;
+      })
+  );
+
+  server.registerTool(
+    "remove_draft_attachment",
+    {
+      description: "Remove one staged attachment from an accessible user-owned draft.",
+      inputSchema: {
+        draftId: z.string().min(1).max(100),
+        attachmentId: z.string().min(1).max(100)
+      },
+      annotations: { destructiveHint: true, idempotentHint: true, openWorldHint: false }
+    },
+    ({ draftId, attachmentId }) =>
+      toolResult(async () => {
+        const draft = await ownedDraft(env, principal, draftId);
+        await requireDraftAccess(env, principal, draft);
+        if (
+          !(await removeDraftAttachment(
+            env.DB,
+            env.MAIL_OBJECTS,
+            principal.userId,
+            draftId,
+            attachmentId
+          ))
+        ) {
+          throw new AppError("ATTACHMENT_NOT_FOUND", "Attachment not found.", 404);
+        }
+        await recordDraftMutation(env, principal, "mcp.draft.attachment.remove", attachmentId);
+        return { deleted: true, attachmentId, draftId };
+      })
+  );
+}
+
+export async function requireDraftIdAccess(
+  env: WorkerEnv,
+  principal: McpPrincipal,
+  draftId?: string
+): Promise<void> {
+  if (!draftId) return;
+  await requireDraftAccess(env, principal, await ownedDraft(env, principal, draftId));
+}
+
+export async function requireDraftAttachmentIdsAccess(
+  env: WorkerEnv,
+  principal: McpPrincipal,
+  attachmentIds: string[]
+): Promise<void> {
+  for (const draftId of await draftIdsForAttachmentIds(env.DB, principal.userId, attachmentIds)) {
+    await requireDraftAccess(env, principal, await ownedDraft(env, principal, draftId));
+  }
+}
+
+async function ownedDraft(env: WorkerEnv, principal: McpPrincipal, draftId: string) {
+  const draft = await getDraft(env.DB, principal.userId, draftId);
+  if (!draft) throw new AppError("DRAFT_NOT_FOUND", "Draft not found.", 404);
+  return draft;
+}
+
+async function requireDraftAccess(
+  env: WorkerEnv,
+  principal: McpPrincipal,
+  draft: Pick<Draft, "mailboxId" | "from" | "replyToMessageId" | "forwardOfMessageId">,
+  knownMailboxes?: Array<Mailbox & { accessLevel: MailboxAccessLevel | null }>
+): Promise<void> {
+  let sendingMailboxId = draft.mailboxId;
+  if (draft.from) {
+    const mailboxes =
+      knownMailboxes ?? (await listMailboxesForUser(env.DB, principal.userId, principal.role));
+    const normalizedFrom = draft.from.toLowerCase();
+    const mailbox = mailboxes.find(
+      (candidate) =>
+        candidate.address.toLowerCase() === normalizedFrom ||
+        candidate.addresses.some((address) => address.address.toLowerCase() === normalizedFrom)
+    );
+    if (!mailbox) throw new AppError("MAILBOX_NOT_FOUND", "Sending mailbox not found.", 404);
+    if (sendingMailboxId && sendingMailboxId !== mailbox.id) {
+      throw new AppError(
+        "DRAFT_MAILBOX_MISMATCH",
+        "Draft sender does not belong to the selected mailbox.",
+        400
+      );
+    }
+    sendingMailboxId = mailbox.id;
+  }
+  if (sendingMailboxId) {
+    await requireMailboxAccess(env.DB, principal.userId, principal.role, sendingMailboxId, "agent");
+  }
+  for (const messageId of [draft.replyToMessageId, draft.forwardOfMessageId]) {
+    if (!messageId) continue;
+    await requireMailboxAccess(
+      env.DB,
+      principal.userId,
+      principal.role,
+      await getMessageMailboxId(env.DB, messageId),
+      "agent"
+    );
+  }
+}
+
+function recordDraftMutation(
+  env: WorkerEnv,
+  principal: McpPrincipal,
+  action: string,
+  resourceId: string
+) {
+  return recordAudit(env.DB, {
+    correlationId: crypto.randomUUID(),
+    actorType: "user",
+    actorId: principal.userId,
+    action,
+    resourceType: "draft",
+    resourceId,
+    outcome: "success"
+  });
+}
diff --git a/worker/features/mcp/mail-tools.ts b/worker/features/mcp/mail-tools.ts
new file mode 100644
index 0000000..f3bcca9
--- /dev/null
+++ b/worker/features/mcp/mail-tools.ts
@@ -0,0 +1,278 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+
+import { accessibleMailboxIds, requireMailboxAccess } from "../../auth/mailbox-access";
+import type { WorkerEnv } from "../../lib/env";
+import { AppError } from "../../lib/errors";
+import { recordAudit } from "../audit/service";
+import { listMailboxesForUser } from "../mailboxes/queries";
+import { listConversations, updateConversationAction } from "../messages/conversation-queries";
+import {
+  findAttachment,
+  getAttachmentMailboxId,
+  getMessageDetail,
+  getMessageMailboxId,
+  listMessages,
+  listThreadMessages,
+  updateMessageAction
+} from "../messages/queries";
+import { conversationFolders } from "../messages/types";
+
+import type { McpPrincipal } from "./route";
+import { attachmentResult, toolResult } from "./tool-result";
+
+const messageActionSchema = z.enum(["read", "unread", "star", "unstar", "archive", "trash"]);
+const conversationFolderSchema = z.enum(conversationFolders);
+
+export function registerMailTools(
+  server: McpServer,
+  env: WorkerEnv,
+  principal: McpPrincipal
+): void {
+  if (principal.scopes.has("mail:read")) registerReadTools(server, env, principal);
+  if (principal.scopes.has("mail:write")) registerWriteTools(server, env, principal);
+}
+
+function registerReadTools(server: McpServer, env: WorkerEnv, principal: McpPrincipal): void {
+  server.registerTool(
+    "list_mailboxes",
+    {
+      description: "List only mailboxes currently visible to the connected user.",
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    },
+    () =>
+      toolResult(async () => {
+        const mailboxes = await listMailboxesForUser(env.DB, principal.userId, principal.role);
+        return mailboxes.filter((mailbox) => mailbox.accessLevel !== null);
+      })
+  );
+
+  server.registerTool(
+    "search_messages",
+    {
+      description:
+        "Search recent individual messages across mailboxes where the user has read access.",
+      inputSchema: {
+        folder: z.enum(["inbox", "sent", "archived", "trash", "catchall"]).optional(),
+        mailboxId: z.string().min(1).max(100).optional(),
+        query: z.string().trim().min(1).max(200).optional(),
+        limit: z.number().int().min(1).max(100).default(25)
+      },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    },
+    (input) =>
+      toolResult(async () => {
+        const mailboxIds = await accessibleMailboxIds(
+          env.DB,
+          principal.userId,
+          principal.role,
+          "read"
+        );
+        return listMessages(env.DB, {
+          folder: input.folder,
+          mailboxId: input.mailboxId,
+          mailboxIds,
+          search: input.query,
+          limit: input.limit
+        });
+      })
+  );
+
+  server.registerTool(
+    "list_conversations",
+    {
+      description:
+        "List recent mailbox conversations with aggregate unread, star, attachment, and count state.",
+      inputSchema: {
+        folder: conversationFolderSchema.optional(),
+        mailboxId: z.string().min(1).max(100).optional(),
+        query: z.string().trim().min(1).max(200).optional()
+      },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    },
+    (input) =>
+      toolResult(async () => {
+        const mailboxIds = await accessibleMailboxIds(
+          env.DB,
+          principal.userId,
+          principal.role,
+          "read"
+        );
+        return listConversations(env.DB, {
+          folder: input.folder,
+          mailboxId: input.mailboxId,
+          mailboxIds,
+          search: input.query
+        });
+      })
+  );
+
+  server.registerTool(
+    "get_message",
+    {
+      description: "Open one permitted message as plain text with safe attachment metadata.",
+      inputSchema: { messageId: z.string().min(1).max(100) },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    },
+    ({ messageId }) => toolResult(() => readMessage(env, principal, messageId))
+  );
+
+  server.registerTool(
+    "get_thread",
+    {
+      description: "Open the permitted chronological conversation containing one message.",
+      inputSchema: { messageId: z.string().min(1).max(100) },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    },
+    ({ messageId }) =>
+      toolResult(async () => {
+        const message = await readMessage(env, principal, messageId);
+        const mailboxIds = await accessibleMailboxIds(
+          env.DB,
+          principal.userId,
+          principal.role,
+          "read"
+        );
+        return Promise.all(
+          (await listThreadMessages(env.DB, message.threadId, mailboxIds)).map(safeMessage)
+        );
+      })
+  );
+
+  server.registerTool(
+    "get_attachment",
+    {
+      description: "Download one permitted attachment as a bounded MCP embedded resource.",
+      inputSchema: { attachmentId: z.string().min(1).max(100) },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    },
+    ({ attachmentId }) =>
+      attachmentResult(async () => {
+        await requireMailboxAccess(
+          env.DB,
+          principal.userId,
+          principal.role,
+          await getAttachmentMailboxId(env.DB, attachmentId),
+          "read"
+        );
+        const attachment = await findAttachment(env.DB, attachmentId);
+        if (!attachment) {
+          throw new AppError("ATTACHMENT_NOT_FOUND", "Attachment not found.", 404);
+        }
+        const object = await env.MAIL_OBJECTS.get(attachment.r2Key);
+        if (!object) {
+          throw new AppError("ATTACHMENT_OBJECT_NOT_FOUND", "Attachment object not found.", 404);
+        }
+        return { attachment, object };
+      })
+  );
+}
+
+function registerWriteTools(server: McpServer, env: WorkerEnv, principal: McpPrincipal): void {
+  server.registerTool(
+    "update_message",
+    {
+      description: "Change read, starred, archived, or trash state for one permitted message.",
+      inputSchema: {
+        action: messageActionSchema,
+        messageId: z.string().min(1).max(100)
+      },
+      annotations: { destructiveHint: true, idempotentHint: true, openWorldHint: false }
+    },
+    ({ action, messageId }) =>
+      toolResult(async () => {
+        await requireMailboxAccess(
+          env.DB,
+          principal.userId,
+          principal.role,
+          await getMessageMailboxId(env.DB, messageId),
+          "agent"
+        );
+        const message = await updateMessageAction(env.DB, messageId, action);
+        await recordMutation(env, principal, `mcp.message.${action}`, "message", messageId);
+        return message;
+      })
+  );
+
+  server.registerTool(
+    "update_conversation",
+    {
+      description:
+        "Change read, starred, archived, or trash state across one permitted conversation.",
+      inputSchema: {
+        action: messageActionSchema,
+        activeFolder: conversationFolderSchema,
+        messageId: z.string().min(1).max(100)
+      },
+      annotations: { destructiveHint: true, idempotentHint: true, openWorldHint: false }
+    },
+    ({ action, activeFolder, messageId }) =>
+      toolResult(async () => {
+        await requireMailboxAccess(
+          env.DB,
+          principal.userId,
+          principal.role,
+          await getMessageMailboxId(env.DB, messageId),
+          "agent"
+        );
+        const mailboxIds = await accessibleMailboxIds(
+          env.DB,
+          principal.userId,
+          principal.role,
+          "agent"
+        );
+        const result = await updateConversationAction(env.DB, {
+          action,
+          activeFolder,
+          mailboxIds,
+          messageId
+        });
+        await recordMutation(
+          env,
+          principal,
+          `mcp.conversation.${action}`,
+          "conversation",
+          result.threadId
+        );
+        return result;
+      })
+  );
+}
+
+async function readMessage(env: WorkerEnv, principal: McpPrincipal, messageId: string) {
+  await requireMailboxAccess(
+    env.DB,
+    principal.userId,
+    principal.role,
+    await getMessageMailboxId(env.DB, messageId),
+    "read"
+  );
+  const message = await getMessageDetail(env.DB, messageId);
+  if (!message) throw new AppError("MESSAGE_NOT_FOUND", "Message not found.", 404);
+  return safeMessage(message);
+}
+
+function safeMessage(message: NonNullable<Awaited<ReturnType<typeof getMessageDetail>>>) {
+  return {
+    ...message,
+    attachments: message.attachments.map(({ r2Key: _r2Key, ...attachment }) => attachment)
+  };
+}
+
+function recordMutation(
+  env: WorkerEnv,
+  principal: McpPrincipal,
+  action: string,
+  resourceType: string,
+  resourceId: string
+) {
+  return recordAudit(env.DB, {
+    correlationId: crypto.randomUUID(),
+    actorType: "user",
+    actorId: principal.userId,
+    action,
+    resourceType,
+    resourceId,
+    outcome: "success"
+  });
+}
diff --git a/worker/features/mcp/send-tools.ts b/worker/features/mcp/send-tools.ts
new file mode 100644
index 0000000..a458782
--- /dev/null
+++ b/worker/features/mcp/send-tools.ts
@@ -0,0 +1,170 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+
+import { requireMailboxAccess } from "../../auth/mailbox-access";
+import type { WorkerEnv } from "../../lib/env";
+import { AppError } from "../../lib/errors";
+import { parseWith } from "../../lib/validation";
+import { enforceRateLimit } from "../../security/rate-limit";
+import { recordAudit } from "../audit/service";
+import { findMailboxForSending } from "../mailboxes/queries";
+import { getMessageMailboxId } from "../messages/queries";
+import { forwardMessage } from "../send/forward";
+import { replyToMessage, sendNewMessage } from "../send/service";
+import { forwardMessageSchema, replyMessageSchema, sendMessageSchema } from "../send/validation";
+
+import { requireDraftAttachmentIdsAccess, requireDraftIdAccess } from "./draft-tools";
+import type { McpPrincipal } from "./route";
+import { toolResult } from "./tool-result";
+
+const recipientList = z.array(z.string().email()).max(50);
+const attachmentIds = z.array(z.string().min(1).max(100)).max(20).default([]);
+
+export function registerSendTools(
+  server: McpServer,
+  env: WorkerEnv,
+  principal: McpPrincipal
+): void {
+  if (!principal.scopes.has("mail:send")) return;
+
+  server.registerTool(
+    "send_email",
+    {
+      description:
+        "Send text with optional HTML and staged attachments from an allowed active mailbox.",
+      inputSchema: {
+        from: z.string().email(),
+        to: recipientList.min(1),
+        cc: recipientList.default([]),
+        bcc: recipientList.default([]),
+        subject: z.string().trim().min(1).max(200),
+        text: z.string().trim().min(1).max(100_000),
+        html: z.string().trim().max(200_000).optional(),
+        attachmentIds,
+        draftId: z.string().min(1).max(100).optional()
+      },
+      annotations: { destructiveHint: false, idempotentHint: false, openWorldHint: true }
+    },
+    (input) =>
+      toolResult(async () => {
+        await enforceSendRateLimit(env, principal.userId);
+        const parsed = parseWith(sendMessageSchema, input);
+        const mailboxId = await requireSendingAccess(env, principal, parsed.from);
+        await requireDraftIdAccess(env, principal, parsed.draftId);
+        await requireDraftAttachmentIdsAccess(env, principal, parsed.attachmentIds);
+        const message = await sendNewMessage(env, parsed, principal.userId);
+        await recordSend(env, principal, "mcp.message.send", mailboxId);
+        return message;
+      })
+  );
+
+  server.registerTool(
+    "reply_to_message",
+    {
+      description:
+        "Reply with text, optional HTML, recipients, and staged attachments from an allowed mailbox.",
+      inputSchema: {
+        from: z.string().email(),
+        messageId: z.string().min(1).max(100),
+        to: recipientList.min(1).optional(),
+        cc: recipientList.default([]),
+        bcc: recipientList.default([]),
+        text: z.string().trim().min(1).max(100_000),
+        html: z.string().trim().max(200_000).optional(),
+        attachmentIds,
+        draftId: z.string().min(1).max(100).optional()
+      },
+      annotations: { destructiveHint: false, idempotentHint: false, openWorldHint: true }
+    },
+    (input) =>
+      toolResult(async () => {
+        await enforceSendRateLimit(env, principal.userId);
+        const parsed = parseWith(replyMessageSchema, input);
+        await requireSourceAccess(env, principal, parsed.messageId);
+        const mailboxId = await requireSendingAccess(env, principal, parsed.from);
+        await requireDraftIdAccess(env, principal, parsed.draftId);
+        await requireDraftAttachmentIdsAccess(env, principal, parsed.attachmentIds);
+        const message = await replyToMessage(env, parsed, principal.userId);
+        await recordSend(env, principal, "mcp.message.reply", mailboxId);
+        return message;
+      })
+  );
+
+  server.registerTool(
+    "forward_message",
+    {
+      description:
+        "Forward one permitted message with optional note, HTML, staged, and original attachments.",
+      inputSchema: {
+        messageId: z.string().min(1).max(100),
+        from: z.string().email(),
+        to: recipientList.min(1),
+        cc: recipientList.default([]),
+        bcc: recipientList.default([]),
+        subject: z.string().trim().min(1).max(200).optional(),
+        text: z.string().trim().max(100_000).default(""),
+        html: z.string().trim().max(200_000).optional(),
+        attachmentIds,
+        includeOriginalAttachments: z.boolean().default(true)
+      },
+      annotations: { destructiveHint: false, idempotentHint: false, openWorldHint: true }
+    },
+    (input) =>
+      toolResult(async () => {
+        await enforceSendRateLimit(env, principal.userId);
+        const parsed = parseWith(forwardMessageSchema, input);
+        await requireSourceAccess(env, principal, parsed.messageId);
+        const mailboxId = await requireSendingAccess(env, principal, parsed.from);
+        await requireDraftAttachmentIdsAccess(env, principal, parsed.attachmentIds);
+        const message = await forwardMessage(env, parsed, principal.userId);
+        await recordSend(env, principal, "mcp.message.forward", mailboxId);
+        return message;
+      })
+  );
+}
+
+async function requireSendingAccess(
+  env: WorkerEnv,
+  principal: McpPrincipal,
+  from: string
+): Promise<string> {
+  const mailbox = await findMailboxForSending(env.DB, from);
+  if (!mailbox) throw new AppError("MAILBOX_NOT_FOUND", "Sending mailbox not found.", 404);
+  await requireMailboxAccess(env.DB, principal.userId, principal.role, mailbox.id, "agent");
+  return mailbox.id;
+}
+
+async function requireSourceAccess(
+  env: WorkerEnv,
+  principal: McpPrincipal,
+  messageId: string
+): Promise<void> {
+  await requireMailboxAccess(
+    env.DB,
+    principal.userId,
+    principal.role,
+    await getMessageMailboxId(env.DB, messageId),
+    "agent"
+  );
+}
+
+function enforceSendRateLimit(env: WorkerEnv, userId: string): Promise<void> {
+  return enforceRateLimit(env.DB, env.BETTER_AUTH_SECRET, {
+    scope: "mcp.mail.send",
+    subject: userId,
+    limit: 60,
+    windowSeconds: 60
+  });
+}
+
+function recordSend(env: WorkerEnv, principal: McpPrincipal, action: string, mailboxId: string) {
+  return recordAudit(env.DB, {
+    correlationId: crypto.randomUUID(),
+    actorType: "user",
+    actorId: principal.userId,
+    action,
+    resourceType: "mailbox",
+    resourceId: mailboxId,
+    outcome: "success"
+  });
+}
diff --git a/worker/features/mcp/server.ts b/worker/features/mcp/server.ts
index 4f74104..4d48770 100644
--- a/worker/features/mcp/server.ts
+++ b/worker/features/mcp/server.ts
@@ -1,25 +1,11 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { z } from "zod";
 
-import { accessibleMailboxIds, requireMailboxAccess } from "../../auth/mailbox-access";
 import type { WorkerEnv } from "../../lib/env";
-import { AppError, toAppError } from "../../lib/errors";
-import { parseWith } from "../../lib/validation";
-import { enforceRateLimit } from "../../security/rate-limit";
-import { recordAudit } from "../audit/service";
-import { findMailboxForSending, listMailboxesForUser } from "../mailboxes/queries";
-import {
-  getMessageDetail,
-  getMessageMailboxId,
-  listMessages,
-  updateMessageAction
-} from "../messages/queries";
-import { replyToMessage, sendNewMessage } from "../send/service";
-import { replyMessageSchema, sendMessageSchema } from "../send/validation";
+import { registerDraftTools } from "./draft-tools";
+import { registerMailTools } from "./mail-tools";
 import type { McpPrincipal } from "./route";
-
-const messageActionSchema = z.enum(["read", "unread", "star", "unstar", "archive", "trash"]);
+import { registerSendTools } from "./send-tools";
 
 export async function serveMcp(
   request: Request,
@@ -40,216 +26,7 @@ export async function serveMcp(
 }
 
 function registerTools(server: McpServer, env: WorkerEnv, principal: McpPrincipal): void {
-  if (principal.scopes.has("mail:read")) {
-    server.registerTool(
-      "list_mailboxes",
-      {
-        description: "List only mailboxes currently visible to the connected user.",
-        annotations: { readOnlyHint: true, openWorldHint: false }
-      },
-      () =>
-        toolResult(async () => {
-          const mailboxes = await listMailboxesForUser(env.DB, principal.userId, principal.role);
-          return mailboxes.filter((mailbox) => mailbox.accessLevel !== null);
-        })
-    );
-
-    server.registerTool(
-      "search_messages",
-      {
-        description:
-          "Search recent messages across mailboxes where the connected user has read access.",
-        inputSchema: {
-          folder: z.enum(["inbox", "sent", "archived", "trash", "catchall"]).optional(),
-          mailboxId: z.string().min(1).max(100).optional(),
-          query: z.string().trim().min(1).max(200).optional(),
-          limit: z.number().int().min(1).max(100).default(25)
-        },
-        annotations: { readOnlyHint: true, openWorldHint: false }
-      },
-      (input) =>
-        toolResult(async () => {
-          const mailboxIds = await accessibleMailboxIds(
-            env.DB,
-            principal.userId,
-            principal.role,
-            "read"
-          );
-          return listMessages(env.DB, {
-            folder: input.folder,
-            mailboxId: input.mailboxId,
-            mailboxIds,
-            search: input.query,
-            limit: input.limit
-          });
-        })
-    );
-
-    server.registerTool(
-      "get_message",
-      {
-        description:
-          "Open one permitted message as stored plain text with safe attachment metadata.",
-        inputSchema: { messageId: z.string().min(1).max(100) },
-        annotations: { readOnlyHint: true, openWorldHint: false }
-      },
-      ({ messageId }) =>
-        toolResult(async () => {
-          await requireMailboxAccess(
-            env.DB,
-            principal.userId,
-            principal.role,
-            await getMessageMailboxId(env.DB, messageId),
-            "read"
-          );
-          const message = await getMessageDetail(env.DB, messageId);
-          if (!message) throw new AppError("MESSAGE_NOT_FOUND", "Message not found.", 404);
-          return safeMessage(message);
-        })
-    );
-  }
-
-  if (principal.scopes.has("mail:write")) {
-    server.registerTool(
-      "update_message",
-      {
-        description: "Change read, starred, archived, or trash state for one permitted message.",
-        inputSchema: {
-          action: messageActionSchema,
-          messageId: z.string().min(1).max(100)
-        },
-        annotations: { destructiveHint: true, idempotentHint: true, openWorldHint: false }
-      },
-      ({ action, messageId }) =>
-        toolResult(async () => {
-          const mailboxId = await getMessageMailboxId(env.DB, messageId);
-          await requireMailboxAccess(env.DB, principal.userId, principal.role, mailboxId, "agent");
-          const message = await updateMessageAction(env.DB, messageId, action);
-          await recordAudit(env.DB, {
-            correlationId: crypto.randomUUID(),
-            actorType: "user",
-            actorId: principal.userId,
-            action: `mcp.message.${action}`,
-            resourceType: "message",
-            resourceId: messageId,
-            outcome: "success"
-          });
-          return message;
-        })
-    );
-  }
-
-  if (principal.scopes.has("mail:send")) {
-    server.registerTool(
-      "send_email",
-      {
-        description: "Send a plain-text email from a mailbox where the user has agent access.",
-        inputSchema: {
-          from: z.string().email(),
-          to: z.array(z.string().email()).min(1).max(50),
-          cc: z.array(z.string().email()).max(50).default([]),
-          bcc: z.array(z.string().email()).max(50).default([]),
-          subject: z.string().trim().min(1).max(200),
-          text: z.string().trim().min(1).max(100_000)
-        },
-        annotations: { destructiveHint: false, idempotentHint: false, openWorldHint: true }
-      },
-      (input) =>
-        toolResult(async () => {
-          await enforceSendRateLimit(env, principal.userId);
-          const parsed = parseWith(sendMessageSchema, { ...input, html: undefined });
-          const mailbox = await findMailboxForSending(env.DB, parsed.from);
-          if (!mailbox) throw new AppError("MAILBOX_NOT_FOUND", "Sending mailbox not found.", 404);
-          await requireMailboxAccess(env.DB, principal.userId, principal.role, mailbox.id, "agent");
-          const message = await sendNewMessage(env, parsed, principal.userId);
-          await recordAudit(env.DB, {
-            correlationId: crypto.randomUUID(),
-            actorType: "user",
-            actorId: principal.userId,
-            action: "mcp.message.send",
-            resourceType: "mailbox",
-            resourceId: mailbox.id,
-            outcome: "success"
-          });
-          return message;
-        })
-    );
-
-    server.registerTool(
-      "reply_to_message",
-      {
-        description: "Reply in plain text from a mailbox where the user has agent access.",
-        inputSchema: {
-          from: z.string().email(),
-          messageId: z.string().min(1).max(100),
-          to: z.array(z.string().email()).min(1).max(50).optional(),
-          cc: z.array(z.string().email()).max(50).default([]),
-          bcc: z.array(z.string().email()).max(50).default([]),
-          text: z.string().trim().min(1).max(100_000)
-        },
-        annotations: { destructiveHint: false, idempotentHint: false, openWorldHint: true }
-      },
-      (input) =>
-        toolResult(async () => {
-          await enforceSendRateLimit(env, principal.userId);
-          const parsed = parseWith(replyMessageSchema, { ...input, html: undefined });
-          await requireMailboxAccess(
-            env.DB,
-            principal.userId,
-            principal.role,
-            await getMessageMailboxId(env.DB, parsed.messageId),
-            "agent"
-          );
-          const mailbox = await findMailboxForSending(env.DB, parsed.from);
-          if (!mailbox) throw new AppError("MAILBOX_NOT_FOUND", "Sending mailbox not found.", 404);
-          await requireMailboxAccess(env.DB, principal.userId, principal.role, mailbox.id, "agent");
-          const message = await replyToMessage(env, parsed, principal.userId);
-          await recordAudit(env.DB, {
-            correlationId: crypto.randomUUID(),
-            actorType: "user",
-            actorId: principal.userId,
-            action: "mcp.message.reply",
-            resourceType: "mailbox",
-            resourceId: mailbox.id,
-            outcome: "success"
-          });
-          return message;
-        })
-    );
-  }
-}
-
-function enforceSendRateLimit(env: WorkerEnv, userId: string): Promise<void> {
-  return enforceRateLimit(env.DB, env.BETTER_AUTH_SECRET, {
-    scope: "mcp.mail.send",
-    subject: userId,
-    limit: 60,
-    windowSeconds: 60
-  });
-}
-
-async function toolResult(run: () => Promise<unknown>) {
-  try {
-    const value = await run();
-    return { content: [{ type: "text" as const, text: JSON.stringify(value, null, 2) }] };
-  } catch (error) {
-    const appError = toAppError(error);
-    return {
-      content: [
-        {
-          type: "text" as const,
-          text: JSON.stringify({ error: { code: appError.code, message: appError.message } })
-        }
-      ],
-      isError: true
-    };
-  }
-}
-
-function safeMessage(message: Awaited<ReturnType<typeof getMessageDetail>>) {
-  if (!message) return null;
-  return {
-    ...message,
-    attachments: message.attachments.map(({ r2Key: _r2Key, ...attachment }) => attachment)
-  };
+  registerMailTools(server, env, principal);
+  registerDraftTools(server, env, principal);
+  registerSendTools(server, env, principal);
 }
diff --git a/worker/features/mcp/tool-result.ts b/worker/features/mcp/tool-result.ts
new file mode 100644
index 0000000..2455c32
--- /dev/null
+++ b/worker/features/mcp/tool-result.ts
@@ -0,0 +1,105 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+
+import { AppError, toAppError } from "../../lib/errors";
+import type { StoredAttachment } from "../messages/types";
+
+export const maxMcpAttachmentBytes = 10 * 1024 * 1024;
+export const maxMcpAttachmentBase64Length = Math.ceil(maxMcpAttachmentBytes / 3) * 4;
+
+export async function toolResult(run: () => Promise<unknown>): Promise<CallToolResult> {
+  try {
+    const value = await run();
+    return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }] };
+  } catch (error) {
+    return toolError(error);
+  }
+}
+
+export async function attachmentResult(
+  run: () => Promise<{ attachment: StoredAttachment; object: R2ObjectBody }>
+): Promise<CallToolResult> {
+  try {
+    const { attachment, object } = await run();
+    if (attachment.sizeBytes > maxMcpAttachmentBytes || object.size > maxMcpAttachmentBytes) {
+      throw new AppError(
+        "MCP_ATTACHMENT_TOO_LARGE",
+        "MCP attachment transfers are limited to 10 MiB.",
+        413
+      );
+    }
+    return {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            {
+              id: attachment.id,
+              filename: attachment.filename,
+              contentType: attachment.contentType,
+              sizeBytes: attachment.sizeBytes
+            },
+            null,
+            2
+          )
+        },
+        {
+          type: "resource",
+          resource: {
+            uri: `hqbase://attachments/${attachment.id}/${encodeURIComponent(attachment.filename)}`,
+            mimeType: attachment.contentType,
+            blob: bytesToBase64(new Uint8Array(await object.arrayBuffer()))
+          }
+        }
+      ]
+    };
+  } catch (error) {
+    return toolError(error);
+  }
+}
+
+export function base64File(input: {
+  contentBase64: string;
+  contentType: string;
+  filename: string;
+}): File {
+  let binary: string;
+  try {
+    binary = atob(input.contentBase64);
+  } catch {
+    throw new AppError("ATTACHMENT_INVALID_BASE64", "Attachment content is not valid base64.", 400);
+  }
+  if (binary.length > maxMcpAttachmentBytes) {
+    throw new AppError(
+      "MCP_ATTACHMENT_TOO_LARGE",
+      "MCP attachment transfers are limited to 10 MiB.",
+      413
+    );
+  }
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return new File([bytes], input.filename, { type: input.contentType });
+}
+
+function bytesToBase64(bytes: Uint8Array): string {
+  let binary = "";
+  const chunkSize = 32_768;
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    binary += String.fromCharCode(...bytes.subarray(offset, offset + chunkSize));
+  }
+  return btoa(binary);
+}
+
+function toolError(error: unknown): CallToolResult {
+  const appError = toAppError(error);
+  return {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify({ error: { code: appError.code, message: appError.message } })
+      }
+    ],
+    isError: true
+  };
+}
diff --git a/worker/features/send/forward.ts b/worker/features/send/forward.ts
new file mode 100644
index 0000000..a4646ac
--- /dev/null
+++ b/worker/features/send/forward.ts
@@ -0,0 +1,134 @@
+import type { WorkerEnv } from "../../lib/env";
+import { AppError } from "../../lib/errors";
+import { parseWith } from "../../lib/validation";
+import { addDraftAttachment, deleteDraft, saveDraft } from "../drafts/queries";
+import { findMailboxForSending } from "../mailboxes/queries";
+import { getMessageDetail } from "../messages/queries";
+import type { MessageDetail } from "../messages/types";
+
+import { sendNewMessage } from "./service";
+import { type ForwardMessageInput, sendMessageSchema } from "./validation";
+
+const maxForwardedAttachments = 20;
+
+export async function forwardMessage(env: WorkerEnv, input: ForwardMessageInput, userId: string) {
+  const original = await getMessageDetail(env.DB, input.messageId);
+  if (!original) throw new AppError("MESSAGE_NOT_FOUND", "Message not found.", 404);
+
+  const mailbox = await findMailboxForSending(env.DB, input.from);
+  if (!mailbox) throw new AppError("MAILBOX_NOT_FOUND", "Sending mailbox not found.", 404);
+
+  const body = forwardedBody(original, input.text, input.html);
+  const subject = input.subject ?? forwardSubject(original.subject);
+  const outbound = parseWith(sendMessageSchema, {
+    from: input.from,
+    to: input.to,
+    cc: input.cc,
+    bcc: input.bcc,
+    subject,
+    text: body.text,
+    html: body.html,
+    attachmentIds: input.attachmentIds
+  });
+  if (!input.includeOriginalAttachments || original.attachments.length === 0) {
+    return sendNewMessage(env, outbound, userId);
+  }
+
+  if (original.attachments.length + input.attachmentIds.length > maxForwardedAttachments) {
+    throw new AppError(
+      "ATTACHMENTS_TOO_MANY",
+      "A forwarded message may contain at most 20 attachments.",
+      400
+    );
+  }
+
+  const draft = await saveDraft(env.DB, userId, {
+    mailboxId: mailbox.id,
+    replyToMessageId: null,
+    forwardOfMessageId: original.id,
+    from: input.from,
+    to: input.to,
+    cc: input.cc,
+    bcc: input.bcc,
+    subject,
+    text: body.text,
+    html: body.html,
+    version: undefined
+  });
+
+  const copiedAttachmentIds: string[] = [];
+  try {
+    for (const attachment of original.attachments) {
+      const object = await env.MAIL_OBJECTS.get(attachment.r2Key);
+      if (!object) {
+        throw new AppError(
+          "ATTACHMENT_NOT_FOUND",
+          "A forwarded attachment object is unavailable.",
+          404
+        );
+      }
+      const file = new File([await object.arrayBuffer()], attachment.filename, {
+        type: attachment.contentType
+      });
+      const added = await addDraftAttachment(env.DB, userId, draft.id, file);
+      await env.MAIL_OBJECTS.put(added.r2Key, file.stream(), {
+        httpMetadata: { contentType: added.attachment.contentType }
+      });
+      copiedAttachmentIds.push(added.attachment.id);
+    }
+  } catch (error) {
+    await deleteDraft(env.DB, env.MAIL_OBJECTS, userId, draft.id);
+    throw error;
+  }
+
+  return sendNewMessage(
+    env,
+    parseWith(sendMessageSchema, {
+      ...outbound,
+      attachmentIds: [...input.attachmentIds, ...copiedAttachmentIds],
+      draftId: draft.id
+    }),
+    userId
+  );
+}
+
+export function forwardedBody(
+  message: MessageDetail,
+  noteText = "",
+  noteHtml?: string
+): { text: string; html: string } {
+  const timestamp = message.receivedAt ?? message.sentAt ?? message.createdAt;
+  const forwarded = [
+    "---------- Forwarded message ---------",
+    `From: ${message.fromAddress}`,
+    `Date: ${new Date(timestamp).toUTCString()}`,
+    `Subject: ${message.subject}`,
+    `To: ${message.to.join(", ")}`,
+    ...(message.cc.length ? [`Cc: ${message.cc.join(", ")}`] : []),
+    "",
+    message.textBody || message.snippet
+  ].join("\n");
+  const text = [noteText.trim(), forwarded].filter(Boolean).join("\n\n");
+  const authoredHtml = noteHtml?.trim()
+    ? noteHtml.trim()
+    : noteText.trim()
+      ? `<p>${escapeHtml(noteText.trim()).replaceAll("\n", "<br>")}</p>`
+      : "";
+  return {
+    text,
+    html: `${authoredHtml}<blockquote>${escapeHtml(forwarded).replaceAll("\n", "<br>")}</blockquote>`
+  };
+}
+
+function forwardSubject(subject: string): string {
+  return `Fwd: ${subject.replace(/^(fw|fwd):\s*/i, "")}`;
+}
+
+function escapeHtml(value: string): string {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#039;");
+}
diff --git a/worker/features/send/validation.ts b/worker/features/send/validation.ts
index be28042..acd68b0 100644
--- a/worker/features/send/validation.ts
+++ b/worker/features/send/validation.ts
@@ -52,5 +52,30 @@ export const replyMessageSchema = z
     }
   });
 
+export const forwardMessageSchema = z
+  .object({
+    messageId: z.string().min(1).max(100),
+    from: emailAddressSchema,
+    to: recipientListSchema,
+    cc: optionalRecipientListSchema,
+    bcc: optionalRecipientListSchema,
+    subject: z.string().trim().min(1).max(200).optional(),
+    text: z.string().trim().max(100_000).default(""),
+    html: z.string().trim().max(200_000).optional(),
+    attachmentIds: z.array(z.string().min(1).max(100)).max(20).default([]),
+    includeOriginalAttachments: z.boolean().default(true)
+  })
+  .superRefine((message, context) => {
+    const recipientCount = message.to.length + message.cc.length + message.bcc.length;
+    if (recipientCount > maxTotalRecipients) {
+      context.addIssue({
+        code: "custom",
+        message: "Cloudflare Email Sending allows up to 50 total recipients.",
+        path: ["to"]
+      });
+    }
+  });
+
 export type SendMessageInput = z.infer<typeof sendMessageSchema>;
 export type ReplyMessageInput = z.infer<typeof replyMessageSchema>;
+export type ForwardMessageInput = z.infer<typeof forwardMessageSchema>;