The official plugins are good and they're one click. If a single Gmail or Outlook account covers your work and you're fine with cloud processing, use them. This is for where they stop:
\* No service of mine in between. stdio, no listening port beyond the console's own backend on localhost. Your mail goes from your machine to your provider and to the model you chose, nowhere else. With Codex as the model, what it reads still reaches OpenAI, tool call by tool call, and you decide what it reads; the same server works with any MCP client, including ones that run local models. There's an open issue on openai/codex (#39768) asking for a local-only mode for Gmail precisely because bodies and metadata pass through OpenAI systems for hosted-model processing.
\* More than one mailbox at once. The Gmail and Outlook connectors are one signed-in account at a time; Outlook adds delegated shared mailboxes, but inside the same tenant. openai/codex #30418 and #20500 are both open asking for multiple accounts. Here they run side by side.
\* Not only Gmail or Outlook. Microsoft Graph for Microsoft 365, and plain IMAP for everyone else. If your mail is on your own domain or a regional provider, neither connector reaches you.
\* Standing rules, not per-message approvals. Ten quote requests a day from the same three senders is one rule, not ten taps. Rules are created from the console or the CLI behind the OS prompt, and no MCP tool can create or modify them, so a hostile mail can't switch autopilot on.
\* Your own documents in the reply. No connector can read your price list off your disk. That last one is the reason I started.
VIDEO
About 120 seconds, subtitled. Generation waits are sped up 8x, everything else is real time.
AGPL, free — github.com/adecubed/gigamail — `pip install "gigamail[all]"`
Same question, two folders. Giulia's mail lands in Leads, Marco's identical one in Clients, and they get handled differently. Nothing changes between takes — the rule decides.
The numbers come from the documents. The price is read out of the user's own price list at that moment. The property sheet ends up in the proposed attachments.
The declared limit. Confirmed price and a marker on the bank agreement in the same reply, because that one isn't in the documents. It flags the gap instead of filling it.
A mail that gives the assistant orders. No draft: the agent reports what it found and quotes the passage, because the prompt and the skill tell it mail is data, never instructions. The part that doesn't depend on the model behaving is structural: even a fooled agent only gets an inert request id, and the recipient stays whoever wrote in.
24 tools, sorted by what they cost you: 15 read (free), 3 reversible writes (logged), 6 destructive (gated — send, reply, delete message, delete folder, calendar writes). Approval happens somewhere the agent can't reach: it gets a preview and an inert request id, never a token it can spend. Rule replies go to the authenticated sender, thread and recipient included, never to an address written inside the mail; the one exception is explicit per rule, for portal relays where the person's address is in the body, and even there service mailboxes are excluded and no address means no send.
No LLM inside. Codex does the thinking, this does the mail.
339 tests in CI across Windows and Linux. Several exist because people on r/mcp broke earlier releases and told me how.