Agentic Inbox
Host email in your Cloudflare account and use a built-in agent to search conversations, manage mail, and draft replies.
The evidence explicitly describes Cloudflare Access, per-mailbox Durable Object isolation, SQLite/R2 storage flows, Workers AI, visible tool calls, and mandatory confirmation before sending, supporting strong confirmation and data-flow scores. Deductions apply because anyone admitted by the shared Access policy can reach every mailbox, and MCP clients can operate on any mailbox using mailboxId; there is no mailbox-level authorization. Encryption, retention, deletion, backup, dependency-audit, and update policies are not documented, and no post-send undo or recovery mechanism is shown. Repository naming, dependency attribution, and the copyright/license identify an apparent source, but registry-verified publisher identity is unavailable.
README, package metadata, and the license are broadly consistent about the product name, Cloudflare stack, deployment workflow, and license. Prerequisites are enumerated, while common Access failures have concrete messages and remedies. Deductions reflect the absence of implementation files, tests, a lockfile, and broader failure-handling evidence, plus reliance on several separately enabled and configured Cloudflare services.
The material identifies users with a Cloudflare account and domain who want a self-hosted email client and AI assistant, and covers sending, receiving, searching, drafting, attachments, and MCP use. Capability boundaries, the production authentication boundary, automatic-draft trigger, send confirmation, and local/production requirements are unusually explicit. Deductions apply because multi-tenant operation, non-Cloudflare environments, scale limits, and differentiated user roles are not addressed.
The README has clear setup, troubleshooting, features, stack, prerequisites, and architecture sections, with usable installation and deployment commands. It candidly documents the single shared Access trust boundary, and Apache-2.0 is consistently supported by the README, package metadata, and full license text. Deductions apply because examples are limited to short commands and mailbox examples, the FAQ coverage is narrow, no version or changelog is supplied, and maintenance responsibility is only partly inferable from repository ownership, an issue link, and the copyright notice rather than an explicit maintainer or support policy.
The described email client, threading, folders, search, attachments, rich composer, automatic drafts, persistent chat, and visible tool calls form a concrete and usable workflow. Deductions apply because marginal value is asserted without representative agent outputs or comparisons, while the operational and financial tradeoffs of requiring a domain, Email Routing, Email Service, Workers AI, R2, Durable Objects, and Access are not quantified.
Several basic claims can be cross-checked among README, package.json, and LICENSE, including naming, Cloudflare components, commands, and licensing. Deductions apply because agent implementation, configuration, tests, and dependency lock data were not supplied, leaving claims about nine tools, confirmation enforcement, isolation, and authentication behavior supported mainly by README statements. Facts and design intent are generally distinguishable, but verified guarantees, inferences, and promotional claims are not systematically labeled.
- The shared Cloudflare Access policy is the sole trust boundary; every admitted user or connected MCP tool can operate across all mailboxes rather than being confined to one mailbox.
- The agent automatically reads new mail and creates drafts. Although the documentation says sending always requires confirmation, the implementation should be inspected before deployment to verify that every sending path enforces it.
- Email bodies, attachments, chat history, and model processing may contain highly sensitive data, but the supplied material does not document encryption, retention, deletion, backup, or audit policies.
- Many dependencies use version ranges, and no lockfile, vulnerability report, or security-update process was supplied, so supply-chain status cannot be established from this static evidence.
- Deployment depends on several Cloudflare services that may have charges or quotas; cost, quota, latency, capacity, and disaster-recovery implications are not documented.
What does this agent do, and when should you use it?
Agentic Inbox is a self-hosted email client that runs entirely on Cloudflare Workers, combining a React 19 web interface with an integrated email agent. Cloudflare Email Routing delivers inbound messages to a Hono Worker; each mailbox is stored in a separate SQLite-backed Durable Object, while attachments reside in R2. Its side-panel agent uses the Cloudflare Agents SDK's AIChatAgent, AI SDK v6, and Workers AI to read inboxes, search conversations, draft responses, and send messages. New mail can trigger an automatically prepared reply, but the user must explicitly confirm every send. Production deployment requires Cloudflare Access, and anyone admitted by the shared Access policy can reach every mailbox, including external tools connected through `/mcp`.
The React SPA calls APIs exposed by the Hono Worker and uses WebSocket connections to reach the EmailAgent Durable Object under /agents/*. Cloudflare Email Routing passes inbound messages to the Worker; MailboxDO stores mailbox data in SQLite and places attachments in R2. The client supports sending and receiving mail, rich-text composition, reply and forward threads, folders, search, and attachments. The AIChatAgent implementation exposes nine email tools for reading and searching mail, creating reply drafts, and sending messages; it runs the Workers AI model @cf/moonshotai/kimi-k2.5 and provides streaming Markdown, visible tool calls, and persistent chat history. Each mailbox can also have a custom system prompt. An MCP server at /mcp lets documented external clients such as Claude Code and Cursor operate on a mailbox by supplying mailboxId.
- An individual with a Cloudflare-managed domain who wants a browser-based mailbox running inside their own Cloudflare account.
- A user handling substantial correspondence who wants an agent to search prior conversations and prepare replies for review before sending.
- A small team managing several addresses on one domain that values separate Durable Object and SQLite storage for each mailbox.
- An operator who wants automatic first-draft responses to incoming mail without permitting unattended message delivery.
- A developer using Claude Code or Cursor who wants to read or operate application mailboxes through
/mcpand amailboxId.
What are this agent's strengths and limitations?
- Email delivery, compute, mailbox storage, attachment storage, and agent inference are integrated into Cloudflare services, with the deployment flow provisioning R2, Durable Objects, and Workers AI.
- Every mailbox receives its own Durable Object and SQLite database, while R2 handles attachments.
- Automatic replies stop at the draft stage and always require explicit confirmation before sending.
- The product combines a full email client with nine agent email tools, persistent chat history, streaming responses, and visible tool calls.
- The documented
/mcpendpoint allows external tools including Claude Code and Cursor to operate on mailboxes bymailboxId.
- Core operation depends on Cloudflare Workers, Durable Objects, R2, Email Routing, Email Service, Workers AI, and Access, so this is not a portable deployment for another cloud without substantial adaptation.
- One-click deployment is incomplete by itself; Access secrets, an Email Routing catch-all rule, and the
send_emailbinding still require manual configuration. - There is no per-mailbox authorization. Every user admitted by the shared Cloudflare Access policy can access every mailbox, including through MCP.
- The documented AI implementation is tied to the Workers AI model
@cf/moonshotai/kimi-k2.5; no alternative model-provider adapter is described. - Adoption requires a Cloudflare account, a managed domain, and several enabled Cloudflare services before both inbound and outbound mail work.
How do you install or deploy this agent?
You need a Cloudflare account with a managed domain, plus Email Routing, Email Service, and Workers AI. Cloudflare Access is required for production or shared deployments. For the hosted flow, use the repository's Deploy to Cloudflare process and enter the receiving domain as DOMAINS. For source deployment, run npm install, set the domain in wrangler.jsonc, create storage with wrangler r2 bucket create agentic-inbox, and run npm run deploy; use npm run dev for local development. The deploy flow provisions R2, Durable Objects, and Workers AI, but post-deployment work remains: enable one-click Cloudflare Access for the Worker, save the displayed POLICY_AUD and TEAM_DOMAIN values as Worker secrets, create an Email Routing catch-all rule that forwards to the Worker, and configure the outbound send_email binding.
How do you use this agent?
After deployment and the Access, Email Routing, and Email Service configuration, open the application and create a mailbox for an address on the configured domain, such as [email protected]. Use the web client to receive and send mail, search conversations, organize folders, and handle attachments. Open the agent side panel when you want it to inspect the inbox, locate messages, or draft a response. Inbound mail may generate an automatic draft, but sending always requires explicit confirmation. You can set a system prompt per mailbox, and agent chat history persists. External clients may connect to /mcp and select a mailbox with mailboxId; access remains governed by the application's shared Cloudflare Access policy.
FAQ
Can it run on a server without Cloudflare?
Will the agent send generated replies automatically?
Are permissions isolated per mailbox?
What should I check after an Invalid or expired Access token error?
POLICY_AUD or TEAM_DOMAIN secret. Turn one-click Access off and on again, obtain the latest modal values, and reset both Worker secrets.Can external agent tools connect to it?
/mcp, and the documentation names Claude Code and Cursor as clients that can operate on a mailbox using mailboxId. Those clients inherit the same all-mailbox Access boundary.