GigaMail

Open source · AGPL-3.0

The email layer for AI agents.

Your agent reads your mail, searches it, and writes replies using your own documents and calendar. It cannot send or delete anything without your approval. Runs on your machine, next to the inbox you already use.

View on GitHub Get started

Works with Claude, Codex, Hermes, or your own agent — ours is Sofia. No built-in LLM: the intelligence is whatever agent you bring.

agent → send_mail
1

The agent asks

It never gets to just do it. All it receives back is a preview and an inert request id — no secret it could spend on its own.

to: marco.bianchi@example.it subject: Re: Apartment A.2.1 body: Dear Mr Bianchi, the apartment is 62.36 sqm, €281,000 … attach: A.2.1.pdf
2

Everything stops here

Approval happens somewhere the agent cannot reach: your console, or a shell command. No prompt injection gets there.

● awaiting human approval
3

You approve — then it sends

It executes the exact arguments you saw, never what the agent passes back. Every write lands in an action log.

Not a demo

This answers our clients every day.

We build and sell apartments. A prospect writes asking about a unit — size, price, a viewing. The agent pulls the real figures from our own files, attaches the right floor plans, and offers slots that are genuinely free in our calendar. Then a human reads it and sends.

The GigaMail console: a reply drafted by the agent listing three apartments with real sizes and prices, mentioning attached floor plans, and proposing three appointment times, with an instruction field and a Generate button at the bottom.
The human console. You direct the agent from your own inbox — write an instruction, read what came back, edit it, send it. You are not chatting with a bot in another window.

The surface

24 typed tools, sorted by what they can cost you.

Reading is free. Reversible writes are logged. Anything destructive goes through the gate. Login and credentials are not exposed to the agent at all — they live in the CLI, so a hostile email can never reach them.

15 read · free

  • list_messages
  • search_mail
  • read_message
  • read_attachment
  • sender_history
  • get_identity
  • list_knowledge_files
  • read_knowledge_file
  • observer_context
  • find_free_slots
  • list_events
  • list_folders
  • list_unread
  • memory_stats
  • list_accounts

3 safe writes · logged

  • mark_read
  • move_message
  • create_folder

6 destructive · gated

  • send_mail
  • reply_mail
  • delete_message
  • delete_folder
  • create_event
  • delete_event

Microsoft Graph and IMAP — Gmail, Aruba, whatever server your mail lives on. The agent talks to GigaMail over MCP on stdio: no network port, no service of ours in between.

Red team

We told the agent to betray us.

Email content is untrusted input. So we wrote hostile emails that order the assistant to forward the inbox to a stranger, wipe the mailbox, and approve its own send — then fed them to a real agent with all 24 tools live.

The third one is there because someone on r/mcp found the hole: the first version handed the agent a confirmation token in the tool result, so it held both halves. Approval now lives outside the agent's reach entirely.

Exfiltration via send refused
Mass delete refused
Agent approving its own send refused

The structural half of that suite runs in CI on every push — Windows and Linux, Python 3.10 / 3.12 / 3.13, 94 tests. Because "trust me, it's safe" is not a security model.

Terminal output of the anti-injection harness: three hostile-email scenarios run against a real agent in dry-run mode, all three reporting OK with zero destructive actions.

Get started

Five minutes, on your own machine.

1 · Install and connect an account

# from a clone — PyPI package coming
pip install -e ".[all]"

gigamail login              # Microsoft device flow
gigamail accounts add-imap  # Gmail, Aruba, any IMAP

2 · Give the account its knowledge

gigamail identity set                    # who you are, your tone
gigamail identity add-file price-list.xlsx
gigamail identity add-file ./floor-plans/

3 · Point your agent at it

{ "mcpServers": { "gigamail": { "command": "gigamail-server" } } }

Then just ask: "reply to the last quote request using the price list." It reads the mail, pulls the numbers, drafts the reply — and stops for you.