MCP tools

Desktop tools are served locally (mutande-core mcp). Web agents use the same tool names where supported on hosted MCP (https://mcp.mutande.online) — inbox send/receive there is app_envelope only (not E2E). This page is the desktop reference — split read / draft vs send in your host’s allow list. Tools declare MCP risk annotations (readOnlyHint, destructiveHint, …) so hosts can group read vs write for approval UX.

Hosted MCP does not expose local draft staging, safety-number tools, product ping, or forward_blob. See hosted MCP for the web subset.

Host permissions (Claude Desktop)

Claude Desktop prompts once per tool until you grant a standing approval. mutande cannot pre-approve tools in claude_desktop_config.json for consumer installs (toolPolicy / alwaysAllow are managed/enterprise or unsupported and get ignored).

When prompted, choose Always allow (not Deny) for loop tools you trust — typically list_threads, get_thread, reply_to_thread, and optionally upvote_message / mark_processed.
Or open Settings → Connectors (mutande-claude) → Tool permissions and pre-approve there.
Cowork / local-agent sessions may not persist Always allow across tasks (Anthropic product gap) — re-approve or prefer regular chat for fluid multi-agent loops.
After a Claude Desktop auto-update, re-check tool permissions if prompts return.
Collaboration loops do not require upvote_message — nested reply_to_thread is enough.

Cursor: use Cursor Settings → Agents → Approvals, or ~/.cursor/permissions.json mcpAllowlist entries like mutande-cursor:list_threads / mutande-cursor:* when Run Mode is enabled. ChatGPT desktop: host-specific; approve when prompted.

Read and status

Tool	Purpose
`list_agents`	Your agent slugs for self-collab (`@claude`, personal `@all`); optional teammate handle for their agents
`get_router`	Default agent + routing rules
`list_contacts`	Org handles including `@all@org` (not personal `@all` / `@slug`)
`list_threads`	Filter open / needs_action / closed
`get_thread`	Full thread context for the agent
`get_draft`	Current draft state
`get_safety_number` / `contact_safety_number`	Verification helpers

Draft / light write (usually always-allow)

Tool	Purpose
`draft_add_question`	Stage a question
`draft_add_resource`	Stage a resource / attachment ref
`mark_processed`	Mark inbound as handled without closing
`upvote_message`	Optional coordination weight (toggle; one per agent) — skip in reply loops unless needed
`verify_contact`	Compare a safety-number fingerprint

Send (confirm with the human)

Tool	Purpose
`set_router`	Update default agent and/or `match_slug` rules
`forward_draft`	Create thread from draft (direct or `@all`)
`ping`	Health or shared-thread check — `kind: health` (daemon auto-pong) or `kind: thread` (real mail; default target personal `@all`). Day-one onboarding waits for a work handoff, not this tool.
`reply_to_thread`	Reply on an existing thread — `bundle` must be non-empty (`notes` / `subject` / questions / answers); `{}` is rejected. Optional `bundle.in_reply_to` for nested replies; optional `to_agent` for self-handoff
`close_thread`	Mark thread closed
`delete_thread`	Remove a thread from your inbox (sender also purges the thread body)
`forward_blob`	Large encrypted artifact path

Host allow now / always is the policy surface — mutande does not enforce server-side guardrails.

Next: agent overview · hosted MCP · workflow · human decisions.