Mailboxes
Connect your email accounts, check reachability, and manage read and send permissions.
Your private connections
Sign in to connect Gmail, iCloud, Yandex, or a custom IMAP/SMTP account. You control reading and sending permissions.
AI Clients & MCP
Connect ChatGPT, Claude, Cursor, Windsurf, or custom Model Context Protocol agents to search, inspect, and draft messages from your mailboxes.
ChatGPT & AI client connections
Sign in to view ChatGPT setup for this workspace.
Account & security
Workspace owner identity, authentication session, and cryptographic protection.
Your account
Sign in with the Google account authorized for this workspace. This does not connect your Gmail mailbox.
Storage and privacy
Encrypted credentials
Saved passwords and refresh tokens are encrypted at rest with AES-256-GCM using your local secret key before storage.
Ephemeral memory cache
Message contents and attachments are never stored in your database. Temporary responses are held in memory for up to 10 minutes to absorb rate limits.
Single-owner boundary
Only the designated Google account has access to this dashboard and its stored connections. All other sign-ins are denied by policy.
Setup guide
Onboarding checklist and protocol requirements for connecting your inboxes to AI agents.
Onboarding sequence
- Open account viewStep 1 of 3
Sign in to your account
Use your authorized Google account to access your workspace.
Access is restricted to the single email defined in AUTH_OWNER_EMAIL. Signing in verifies workspace ownership and protects your stored mail credentials.
- Open mailboxes viewStep 2 of 3
Connect an email provider
Add the accounts you want to use.
Connect Gmail with Google OAuth, or configure iCloud, Yandex, or custom IMAP/SMTP using dedicated app-specific passwords. Reading never modifies mailbox flags.
- Open AI clients viewStep 3 of 3
Connect AI clients (ChatGPT, Claude, Cursor)
Use your connected accounts through authorized tools.
Provide your workspace MCP endpoint URL in ChatGPT, Claude Desktop, Cursor, or custom agents, configure client scopes, and approve the authorization grant.
Provider protocol requirements
Gmail
During Google Cloud testing mode, user refresh tokens expire every 7 days. If a connection expires, simply click Reconnect to refresh tokens without losing configuration.
Apple iCloud
Standard Apple ID passwords are not accepted. Generate an app-specific password at appleid.apple.com under Sign-In and Security. IMAP uses imap.mail.me.com on port 993 SSL.
Yandex Mail
If two-factor authentication is active on your Yandex ID, generate an App Password for Mail in Yandex ID security settings. IMAP uses imap.yandex.com on port 993 SSL.
Custom IMAP / SMTP
Requires IMAP over SSL (port 993) and SMTP over STARTTLS (port 587) or SSL (port 465). Plaintext unencrypted connections are rejected by policy.
Security & protocol invariants
Zero flag mutation
Mailbox reading operations (searching, inspecting message lists, reading body content) use RFC 3501 EXAMINE mode and BODY.PEEK. Email unread/read state is never modified by this bridge or any connected AI agent.
Zero message persistence
Emails, message bodies, attachment binaries, and address books are never written to disk or database storage. Temporary in-memory cache expires after 10 minutes.
Explicit-only writes
The application does not allow autonomous mailbox modifications. Sending is disabled by default and requires explicit dual confirmation (account toggle and MCP client scope).
Model Context Protocol tool reference
list_accountsRead-onlyEnumerate all connected and reachable mail accounts with capability flags.
list_mailboxesRead-onlyInspect mail folders, labels, and hierarchy for a specific account.
search_messagesRead-onlySearch message headers, subjects, sender info, and snippets with query criteria.
get_messageRead-onlyFetch complete message body, headers, text content, and attachment metadata.
get_attachmentAttachmentsDownload raw binary file data and decode base64 attachments safely.
stage_attachmentsAttachmentsUpload and validate files into ephemeral temporary storage for sending.
send_messageSend-enabledCompose and send an email with optional staged attachments across authorized providers.