MCP server › Sample workflows

Top external recipient by email volume

A natural follow-on to the external-senders analysis: instead of listing which mailboxes sent outside the company, ask who received the most — the single external address that accumulated the highest total across all collected mailboxes combined. The answer comes from five tool calls and a small amount of agent-side counting. The sample runs against the DataTap-hosted Enron corpus (6 collected mailboxes, 12,447 emails).

The tool sequence

Steps 1–3 pull recipient arrays for every outbound message per sender (same tools as the external-senders workflow). Step 4 is agent-side aggregation. Step 5 confirms the result with a live compound filter — combining a scalar fromAddress eq with a toRecipients/any() clause:

// 1 · Discover which mailboxes are collected (ownerId is the universal per-account field).
{"tool": "summarize_content", "arguments": {"facets": "ownerId,count:10"}}

// 2 · For each owner, find the fromAddress they actually send from.
{"tool": "summarize_content", "arguments": {
  "filter": "ownerId eq '<owner-id>'",
  "facets": "fromAddress,count:5"
}}
// Repeat for each owner returned in step 1.

// 3 · Pull every message sent by that address, projecting only recipient fields.
//     Set top to the per-sender message count returned by step 2.
{"tool": "search_content_advanced", "arguments": {
  "filter": "fromAddress eq '<owner-email>'",
  "select": "toRecipients,ccRecipients,bccRecipients",
  "top": 2668
}}
// Repeat for each sender address.

// 4 · Agent-side: for each message, flatten toRecipients + ccRecipients + bccRecipients,
//     deduplicate the same address appearing in multiple fields within one message,
//     drop any address on the tenant's own domain (or matching internal legacy DN patterns),
//     and tally a hit counter per external address across all senders.

// 5 · Verify the winner directly against the index — no need to re-pull anything.
//     Use to+cc+bcc to match the same scope the aggregation used (step 3).
{"tool": "count_content", "arguments": {
  "filter": "fromAddress eq 'd.giron@enron.com' and (toRecipients/any(r: r/address eq 'kristi.giron@cfisd.net') or ccRecipients/any(r: r/address eq 'kristi.giron@cfisd.net') or bccRecipients/any(r: r/address eq 'kristi.giron@cfisd.net'))"
}}
// → {"totalCount": 288}

Result — Enron corpus

Across all six mailboxes (2,668 + 1,154 + 766 + 749 + 718 + 232 = 6,287 outbound messages), the busiest external address by far:

• kristi.giron@cfisd.net — 288 emails, every one of them from Darron Giron (d.giron@enron.com). The count_content filter in step 5 returns exactly 288, matching the agent-side tally.
• Runner-up positions are also all Giron's personal contacts: dgiron1@pdq.net (262), dgiron1@houston.rr.com (176), hollyw@email.msn.com (106), smmayers@earthlink.net (98).
• The cross-mailbox aggregation confirmed the per-sender maximum rather than surfacing a new winner — Giron's personal contacts dominate the top positions and no external address appears heavily across multiple senders.

← Previous sample: Who talked to the outside world? · Back to MCP server →