Expand MCP mail capabilities

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.1.26
+
+- Expand the OAuth-protected MCP server with conversation, thread, and attachment retrieval plus
+  message and conversation state updates.
+- Add complete MCP draft management, staged attachments, rich-text sending and replies, and
+  forwarding with original attachments.
+- Grant new MCP clients the complete mail scope set by default while preserving explicit
+  least-privilege connections and requiring existing clients to reconnect for broader consent.
+
 ## 0.1.25
 
 - Keep manually forwarded Gmail messages visible in the reader while continuing to collapse genuine

app/features/mcp/consent-page.tsx

@@ -11,9 +11,11 @@ type OAuthClient = {
 };
 
 const scopeDescriptions: Record<string, string> = {
-  "mail:read": "Read mailboxes and message text allowed by your mailbox grants",
-  "mail:write": "Change message state where you have agent access",
-  "mail:send": "Send email and replies where you have agent access",
+  "mail:read":
+    "Read allowed mailboxes, conversations, message text, threads, and bounded attachments",
+  "mail:write": "Change message and conversation state where you have agent access",
+  "mail:send":
+    "Manage drafts and attachments, then send, reply, or forward where you have agent access",
   offline_access: "Stay connected until you revoke access"
 };
 

docs/mcp.md

@@ -9,7 +9,49 @@ Cloudflare grants, runtime secrets, and customer credentials never enter the MCP
 MCP scopes never broaden workspace permissions. Every request intersects the granted scopes with
 the user's current mailbox grants, role, ban state, and session validity.
 
-Available tools cover listing accessible mailboxes, searching readable messages, reading message
-content, changing message state, creating drafts, sending, and replying. Responses exclude setup
-values, secrets, Cloudflare credentials, and attachment bytes. Content-free audit events record
-successful state changes and sends.
+New dynamically registered clients default to `mail:read`, `mail:write`, and `mail:send` so clients
+that omit registration scopes receive the complete mail surface after explicit consent. A client
+may request less access, and existing clients or consents are never silently broadened. Revoke and
+reconnect an older read-only client to register it with the new defaults.
+
+## Tools
+
+`mail:read` provides:
+
+- `list_mailboxes`
+- `search_messages`
+- `list_conversations`
+- `get_message`
+- `get_thread`
+- `get_attachment`
+
+`mail:write` provides:
+
+- `update_message`
+- `update_conversation`
+
+`mail:send` provides:
+
+- `list_drafts`
+- `get_draft`
+- `create_draft`
+- `update_draft`
+- `delete_draft`
+- `add_draft_attachment`
+- `remove_draft_attachment`
+- `send_email`
+- `reply_to_message`
+- `forward_message`
+
+Drafts use revision numbers to prevent silent overwrites. Send and reply accept plain text with
+optional HTML and staged draft attachment IDs. Forwarding creates the forwarded context on the
+server and can retain the original message attachments.
+
+Messages expose safe attachment metadata without storage keys. `get_attachment` returns an MCP
+embedded resource and `add_draft_attachment` accepts base64 content. Each MCP binary transfer is
+limited to 10 MiB; HQBase's existing total attachment and recipient limits still apply.
+
+HQBase records successful state changes, draft and attachment mutations, sends, replies, and
+forwards as content-free audit events. MCP does not expose setup values, secrets, Cloudflare
+credentials, user or workspace administration, infrastructure operations, or a new-mail
+subscription.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hqbase",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "private": true,
   "type": "module",
   "packageManager": "pnpm@11.7.0",