What is api-implementation?

A development guide for connecting an application to Fastmail's email, contacts, calendar, and file services. It explains JMAP, a web protocol for email and related data, plus CardDAV and CalDAV, standard protocols for contacts and calendars.

It is for implementing email and masked-email operations with JMAP, and creating, reading, updating, or deleting contacts and calendars through CardDAV and CalDAV.

It gives developers the authentication methods, server addresses, data formats, and request patterns needed to work with Fastmail. It also separates API-token access from app-password access for other services.

api-implementation — Skill for Claude Code and Codex by pjosols

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add pjosols/pyfastmail-mcp --skill api-implementation

Clone the repo

git clone --depth 1 https://github.com/pjosols/pyfastmail-mcp

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/pjosols/pyfastmail-mcp/api-implementation/github.svg)](https://agentmods.dev/skills/pjosols/pyfastmail-mcp/api-implementation)

Your own site

<a href="https://agentmods.dev/skills/pjosols/pyfastmail-mcp/api-implementation"><img src="https://agentmods.dev/badge/skills/pjosols/pyfastmail-mcp/api-implementation/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/pjosols/pyfastmail-mcp/api-implementation"><img src="https://agentmods.dev/badge/skills/pjosols/pyfastmail-mcp/api-implementation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 497 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.00497
Opus 5.5	$0.00000	$0.00199
Sonnet 5.5	$0.00000	$0.00099
Haiku 4.5	$0.00000	$0.00050

Measured 1mo ago against content hash 1835d741efce, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

api-implementation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.kiro_bak/skills/api-implementation/SKILL.md · 36 lines

What it actually says

API Implementation

JMAP (Mail, Masked Email)

Endpoint: https://api.fastmail.com/jmap/api/
Auth: Authorization: Bearer {FASTMAIL_API_TOKEN}
All calls: POST with using and methodCalls arrays
Query+Get pattern: combine in one round trip using #ids back-references
Set pattern: create, update, destroy in one call
URNs: urn:ietf:params:jmap:mail, urn:ietf:params:jmap:submission, https://www.fastmail.com/dev/maskedemail

DAV Protocols (Contacts, Calendars, Files)

Auth: Basic auth with (FASTMAIL_EMAIL, FASTMAIL_APP_PASSWORD) — app password, not API token
Create DAVClient in dav_client.py with shared auth, base URLs, and DAV methods

CardDAV (RFC 6352) — Contacts

Server: https://carddav.fastmail.com/dav/principals/user/{email}/
PROPFIND depth=1 to discover address books
vCard format — use vobject library to parse/generate
PUT with Content-Type: text/vcard to create, DELETE to remove

CalDAV (RFC 4791) — Calendars

Server: https://caldav.fastmail.com/dav/principals/user/{email}/
PROPFIND depth=1 to discover calendars
iCalendar format — use icalendar library to parse/generate
REPORT with calendar-query + time-range filter for date queries
PUT with Content-Type: text/calendar to create, DELETE to remove

WebDAV (RFC 4918) — Files

Server: https://myfiles.fastmail.com/
PROPFIND depth=0 (self) or 1 (children), MKCOL for folders, PUT/GET/DELETE/MOVE for files

References

RFC 6352 (CardDAV): https://www.rfc-editor.org/rfc/rfc6352
RFC 4791 (CalDAV): https://www.rfc-editor.org/rfc/rfc4791
RFC 8621 (JMAP Mail): https://www.rfc-editor.org/rfc/rfc8621.html

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 36 lines · 0 tokens per session scan A 1835d741efce

Subscribe to this mod's changes

api-implementation is a skill published in the GitHub repository pjosols/pyfastmail-mcp (0 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 497 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs caldav calendar contacts fastmail mcp

nylas-api

Build email, calendar, and contacts integrations with the Nylas v3 API. Use when code imports nylas, @nylas/nylas, nylas-python, or user asks about Nylas API, email API integration, calendar API, contacts API, OAuth grants, agent accounts, webhooks, scheduler, notetaker, smart compose, or transactional send. DO NOT…

nylas/skills · 90 tokens

calendar-contacts-tasks

Reads and changes the user's own calendars, contacts and to-dos on their CalDAV/CardDAV server (Nextcloud, iCloud, Baikal, Radicale and others) through the dav-mcp tools - finding events, free time, phone numbers and tasks, and creating, moving, cancelling or deleting them safely. Use whenever the user asks about or…

PhilflowIO/dav-mcp · 147 tokens

nylas-email-templates

Write, test, and deploy Nylas email templates and workflows with an API key. Use when user asks to create or edit a Nylas email template, set up a workflow for booking., event., grant., notetaker., or message. triggers, send email with a stored template through the Send API, translate or brand a Scheduler email, or…

nylas/skills · 117 tokens

olk

Microsoft Outlook and OneDrive CLI and MCP for email, calendar, contacts, tasks, and files, for personal and enterprise accounts.

rlrghb/olkcli · 28 tokens

using-outlook-assistant

Safety, privacy and efficient-use rules for the Outlook Assistant (outlook) MCP tools, covering Outlook email, calendar, contacts, folders, rules, categories and mailbox settings on personal Outlook.com and work/school Microsoft 365 accounts. Read it before the first Outlook Assistant tool call in a session, and again…

littlebearapps/outlook-assistant · 175 tokens

Pear - iCloud Calendar, Reminders, Contacts & Mail

Pear provides hosted MCP access to iCloud Calendar, Contacts, Mail, and legacy CalDAV reminder data. Tools are prefixed with pear. Calendar and legacy reminders use CalDAV; Contacts use CardDAV; Mail uses IMAP/SMTP. Apple's upgraded Reminders store is not accessible through this connection.

AshtonAU/pear-plugin · 51 tokens