MCP server › Sample workflows

Who talked to the outside world?

A common e-discovery and compliance question — “which mailboxes sent email outside the company, and to whom?” — answered end to end with four MCP search tool calls and no custom code beyond the agent's own filtering. The sample runs against the DataTap-hosted Enron corpus (6 collected mailboxes, 12,447 emails).

The tool sequence

All four steps use Search tools — summarize_content for faceted aggregation and search_content_advanced for the full-projection pull. No collection or restore tools are needed; this workflow assumes the corpus is already indexed.

// 1 · Per collected mailbox, how much did we collect? ownerId is the universal owning-account
//     field (every content type — Exchange, OneDrive, Teams), not just the message sender.
{"tool": "summarize_content", "arguments": {"facets": "ownerId,count:10"}}

// 2 · For one mailbox owner, what address does that owner actually send from? (the dominant
//     value in their own fromAddress facet)
{"tool": "summarize_content", "arguments": {
  "filter": "ownerId eq '<owner-id>'",
  "facets": "fromAddress,count:5"
}}

// 3 · Pull every message that address sent, projecting only the recipient fields.
//     Set top to the per-sender message count returned by step 2.
{"tool": "search_content_advanced", "arguments": {
  "filter": "fromAddress eq '<owner-email>'",
  "select": "toRecipients,ccRecipients,bccRecipients",
  "top": 2668
}}

// 4 · Agent-side: flatten toRecipients/ccRecipients/bccRecipients and drop anything on the
//     tenant's own domain — what remains is external correspondence.

Results — Enron corpus

Run against the seeded public Enron corpus (6 mailboxes, 12,447 emails):

Weldon sent from two aliases (v.charles.weldon@enron.com and charles.weldon@enron.com); counts are combined. Davis's 718 messages are automated schedule-crawler alerts with a fixed internal CC list — zero external recipients.

← Previous sample: Selective OneDrive folder backup · Next sample: Top external recipient →