ReplyLayer

Get a derived text preview of an inbound message attachment. Returns extracted text for plain-text, CSV, PDF, and Office (DOCX/PPTX/XLSX) attachments on mailboxes with attachment_exposure_mode="derived_content". Content is hard-capped at 20 000 characters; check preview.truncated and preview.char_count if you need the full extent. Raw bytes are NOT available via MCP. If the derivative is not ready or failed, the server returns 404 ATTACHMENT_PREVIEW_NOT_AVAILABLE — this tool surfaces that as an isError result.

Read a specific draft by ID. Returns the full draft including body, scan results, scheduled-send fields, and sub-address fields if set.

Get malicious link scanning (URL reputation) activation status for the account: active, accepted_version, current_version, privacy_ok. Read-only; works with any key. Enabling it is a human/admin action (dashboard or `rly account link-scanning enable`), not an agent action.

Read a full email thread as one ordered conversation (every message in the thread, oldest → newest, safe-view only). Pass the thread_id from list_threads or a message's thread_id. A thread key can resolve in more than one mailbox — a `NOT_FOUND` error means the thread is either absent or the key is ambiguous; retry with `mailbox` to disambiguate.

List the recipient allowlist for a given mailbox. Only meaningful when the mailbox is in recipient_policy_mode=allowlist; in blocklist mode the allowlist is not consulted. Use this to check what addresses are approved before attempting a send. Entries may be exact emails (alice@corp.com) OR domain patterns (@corp.com) — the latter approves every address at that domain. Each row carries a pattern_type field ("email" or "domain"). Agents CANNOT add or remove entries via MCP (admin-only, by design). When allowlist mode is active, sends to off-list recipients return 403 with code RECIPIENT_NOT_ON_…

Inspect sends this agent (or a peer agent on the same mailbox) attempted that were rejected by the recipient allowlist (403 RECIPIENT_NOT_ON_ALLOWLIST). Default returns an aggregated top-N summary with one row per recipient and sending key (the key id is not shown; actor_type says admin or agent) with count + first/last timestamps + origins. Pass aggregate=false for raw per-attempt history with cursor pagination. Use this to understand why sends are being blocked and either pick different recipients or surface the address to an admin for allowlist review.

List drafts in a ReplyLayer mailbox. Drafts are scan-then-review-then-send entries; use create_draft to make one and send_draft to dispatch it.

List per-mailbox inbound allowlist entries (senders permitted in `allowlist` mode). Mirrors `list_allowlist` for the inbound side. Read-only. Returns up to `limit` rows (default 100, max 500); pass `cursor` to paginate.

List account-wide inbound sender blocklist entries (the do-not-receive list). Mirrors `list_suppressions` for the inbound side. Returns up to `limit` rows (default 100, max 500); pass `cursor` to paginate. Read-only.

List incoming senders rejected by the inbound firewall for a mailbox. Default aggregated view groups by (sender, matched_field, mode, reason_code) ordered by most recent. Pass aggregate=false for raw per-attempt history with tuple-cursor pagination. within_days filters by recency (1..365). Read-only.

List all mailboxes on the account. Returns name, full address, status, and the recipient-visible From identity (effective_from_display) for each mailbox.

List / search messages in a ReplyLayer mailbox. Filter by keyword search, sender, date range, direction, and status — including the held-mail states for triage: status="quarantined" or status="pending_review" (then release_quarantined_message / approve_review). Page older by passing before=<id of the oldest message from the previous page>.

List recipients with confirmation status. Sandbox-tier accounts can only send to confirmed recipients.

List addresses on the do-not-contact list (suppressions). Includes both system-added entries (hard bounces, spam complaints, RFC 8058 unsubscribes) and customer-added entries (reason="manual", source="customer"). Useful for verifying that an address is or is not blocked before attempting to send. Entries may be exact emails (alice@corp.com) OR domain patterns (@corp.com) — the latter blocks every address at that domain. Each row carries a pattern_type field ("email" or "domain") to disambiguate.

List conversation threads in a mailbox (most-recent first), each with participants, unread_count, and last_message_at. Then use get_thread to read one. Page older by passing before_ts = the oldest last_message_at from the previous page. Filter with starred / has_inbound.

Mark a single message as read. Eligible only for inbound, visible rows. Outbound / deleted / firewall_blocked rows return a 200 no-op with the existing read_at. Idempotent: a second call returns the same read_at. Use this after read_message to advance the customer's read state — read_message itself is now side-effect-free.

Bulk-mark every visible inbound unread message in a thread as read. Returns marked_count of rows newly stamped this call. Excludes outbound, deleted, and firewall_blocked rows. Idempotent: a thread with everything already read returns marked_count: 0. Use this after fetching a full thread (e.g. via read_message of each entry) to advance the customer's read state in one call.

Read a specific message by ID. Returns the default plaintext body projection, attachment metadata/status fields, and scan results for human handoff.

Release a state="firewall_blocked" message back into scanner processing. Returns 202 immediately; actual scanner verdict (available/quarantined/blocked) is observed by re-reading the message detail. Mailbox-bound agent keys can only release messages whose mailbox they are bound to. Releasing does NOT remove the matching entry from the inbound blocklist or add the sender to the inbound allowlist; those remediations are explicit per-tool calls.

Release a state="quarantined" INBOUND message back into the inbox (→ available). INBOUND-ONLY: the tool pre-fetches the message and refuses an outbound row (releasing an outbound quarantine would re-send it via the provider — manage those from the dashboard). Optional reason is persisted to the audit log. Mailbox-bound agent keys can only release messages whose mailbox they are bound to.

Suppression removal is intentionally NOT available via MCP. Undoing a do-not-contact entry is a per-human admin decision — use the CLI (`rly suppressions remove`), an SDK admin key, or the dashboard.

Reply to a message. The reply is sent from the same mailbox that received the original message, threading correctly. Returns the message ID, status, and the Governed Email-Effect fields: email_effect (effect_status = sent | held_for_review | held_infrastructure | blocked, plus releasable/terminal/retryable — branch on this in ONE read for proceed vs release vs retry vs edit/escalate), scan (the scanner verdict + findings), and hold_context (the hold reason + agent_instructions on held sends — policy causes, policy-changed decisions, and genuine scan-explained holds alike; null on sent/terminal…

Report and block an INBOUND message: blocks a held (quarantined) message and adds the resolved sender to your account-wide inbound blocklist (idempotent). INBOUND-ONLY: the tool pre-fetches the message and refuses an outbound row (an outbound message has no inbound sender to block). Optional reason is persisted to the audit log. Mailbox-bound agent keys can only act on messages whose mailbox they are bound to.

Send a draft. The server re-runs the scanner authoritatively at send time; the verdict can differ from the create-time verdict because mailbox policy, suppressions, allowlists, or scanner models may have changed in between. Success returns { message_id, status, scan, hold_context, daily_limit, sends_remaining }: - status='sent' → message dispatched to the provider. - status='pending_review' → review queue entry created (every tier); an operator must approve before dispatch. - `scan` is the scanner verdict; `hold_context` is the hold reason plus agent_instructions on held sends —…

Send an email from a ReplyLayer mailbox — a fresh send, or continue an existing thread with thread_id. Returns the message ID, status (sent, quarantined, blocked, or pending_review), and the Governed Email-Effect fields: email_effect (effect_status = sent | held_for_review | held_infrastructure | blocked, plus releasable/terminal/retryable — branch on this in ONE read for proceed vs release vs retry vs edit/escalate), scan (the scanner verdict + findings), and hold_context (the hold reason + agent_instructions on held sends — policy causes, policy-changed decisions, and genuine scan-explained …

Star or unstar a message. Pass starred=true to star, starred=false to unstar. Idempotent — re-starring an already-starred message is a no-op. Works for both inbound and outbound messages.

Star or unstar a thread. Pass starred=true to star, starred=false to unstar. The mailbox parameter accepts a mailbox name or UUID. Idempotent — re-starring an already-starred thread is a no-op.

Update an existing draft. Re-runs the scanner synchronously and attaches a fresh verdict. This call sends no email itself, but a draft with a `send_at` (set here or earlier) is sent at that time with no further call; use clear_send_at to stop it. Set semantics: - subaddress_instance_id / subaddress_mode / send_at → string value sets the field. - clear_subaddress_instance_id / clear_subaddress_mode / clear_send_at → true clears the field (sends null to the API). Use clear_send_at to cancel a scheduled send. - Passing both a set field and its clear flag returns an error without callin…

Long-poll for new messages in a mailbox. Returns when a new message arrives or the timeout expires.