Desktop Gmail connector sends from an unseen account: no from field, no account in results, Bash hooks cannot guard it

Summary

The Claude Desktop (Code tab) Gmail connector exposes send_message, reply and forward tools with no from field and no indication of which Google account the connector is bound to. A session that had been told (in a skill file) that client email goes from the work address used the connector, and every message left from the user's personal Gmail. The user only found out when the client's reply landed in the personal inbox.

What happened

• Four emails in one session (a vendor support ticket and three client emails) sent via mcp__<gmail-connector>__send_message.
• The model assumed the work account; nothing in the tool schema, the tool description or the tool result said which account was used. The result returned a message id only.
• The user's existing PreToolUse guard hook was matched on Bash (it inspects curl/gws Gmail sends for the account). MCP connector calls never reach it. We have now added a second PreToolUse hook on mcp__.* that refuses the connector's send/reply/forward/draft tools outright.

Requests

1. Connector tools that send on the user's behalf should state the bound account in the tool description and echo the actual From address in the tool result.
2. send_message / reply / forward should accept an explicit from and refuse when it does not match the bound account, instead of silently sending as whoever is connected.
3. A per-connector "read-only" toggle in the desktop app, so a connector can stay attached for reading while sending is impossible.
4. Documentation: state clearly that PreToolUse hooks with matcher: "Bash" do not see MCP tool calls, and give the mcp__.* matcher example next to the Gmail/Calendar connector docs.

Environment

Claude Desktop app, Code tab, macOS 26 (Darwin 25.6.0), model claude-fable-5-1, Gmail connector attached to a personal Google account while the user's working address is a Google Workspace account on a different domain.