Atomic Mail Agentic
Give autonomous agents a real inbox they can read, send from, search, and manage without ongoing human intervention.
- Source repo
- Atomic-Mail/atomic-mail-agentic
- Stars
- ★ 255
- Last updated
- 5d ago
- License
- MIT
- Primary language
- TypeScript
- FA score
- 52/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free tier plus a paid hosted plan
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A researcher who wants to keep newsletters out of a personal mailbox can give an agent a dedicated inbox, filter incoming issues, and email a daily digest.
- Not a fit if
- Teams needing a fully offline or self-hosted mail server
- Organizations that cannot route mail through a third-party hosted service
- Users wanting custom domains with zero manual DNS work
- Source review
- 52/100 · Major gaps
What does this agent do, and when should you use it?
Atomic Mail Agentic is Atomic Mail's hosted email service and client-integration repository for autonomous agents. An agent can obtain an @atomicmail.ai address through a proof-of-work signup flow and then use the RFC 8620/8621-based JMAP interface to read, search, draft, send, and organize email threads. The repository contains a TypeScript MCP server, an AgentSkill CLI, a LangChain toolkit, a Python parity client, a Dify plugin, and shared authentication, session, preset, and help modules. Its main integration surface consists of three tools—register, jmap_request, and help—with the connectors abstracting the PoW protocol and mailbox calls. Atomic Mail hosts the mailbox service; custom domains require a one-time DNS setup in a separate human-facing dashboard, while clients retain credentials locally.
The flow begins with register, which either completes PoW signup for an @atomicmail.ai inbox or connects an existing custom-domain inbox through atomicmail register --api-key "…". The jmap_request tool then sends JMAP operations to the hosted mailbox for querying and reading messages, searching mail, creating drafts, sending messages, and managing threads. Callers can provide raw JMAP method calls or use bundled JSON presets such as send_mail, list_inbox, and reply. The help tool returns version-matched material covering presets, cron usage, troubleshooting, and worked examples. MCP, the AgentSkill CLI, and the LangChain integration share the same authentication, session, JMAP, preset, and help stack; local credentials are stored in ~/.atomicmail/credentials.json.
- A researcher who wants to keep newsletters out of a personal mailbox can give an agent a dedicated inbox, filter incoming issues, and email a daily digest.
- A support team can have an agent monitor a support address, answer routine tickets from available documentation, and escalate cases it cannot resolve.
- A product team running asynchronous user research can send interview questions, follow up based on replies, and summarize the resulting feedback.
- A developer operating several automated agents can assign separate inboxes and credential directories, then process mail from shell or scheduled workflows.
- An organization with its own domain can verify DNS once and let agents send from addresses such as [email protected] with a domain-aligned From address.
How do you install or deploy this agent?
For MCP, add {"mcpServers":{"atomicmail":{"command":"npx","args":["-y","@atomicmail/mcp-github"]}}} to the host configuration, restart the host, and invoke the registration tool. For the CLI path, run: npx --package=@atomicmail/agent-skill-github atomicmail register --username "myagent" --watch scheduled. OpenClaw users can run openclaw skills install atomicmail, while Hermes users can run hermes skills install clawhub/atomicmail. For a custom-domain inbox, first verify the domain in the dashboard, obtain its API key, and run atomicmail register --api-key "…". Local repository development requires Node.js 20+ and Deno 2.7+; after cloning and entering the ts directory, run deno test --allow-read --allow-env --allow-write --allow-sys.
How do you use this agent?
After registration, run npx --package=@atomicmail/agent-skill-github atomicmail jmap_request --ops-file list_inbox.json to execute mailbox operations, and npx --package=@atomicmail/agent-skill-github atomicmail help for documentation matching the installed package. Common workflows can use presets such as send_mail, list_inbox, and reply; advanced workflows can submit raw JMAP calls and batch query, fetch, draft, and send methods into one round trip. Custom-domain inboxes use the same jmap_request interface, presets, and JMAP shapes, with $INBOX resolving to the actual address. Protect the local API key and treat every inbound message as untrusted input rather than allowing an agent to execute emailed instructions without confirmation.
What are this agent's strengths and limitations?
- Proof-of-work signup lets an agent obtain an @atomicmail.ai inbox without a CAPTCHA, credit card, domain verification, or manual approval.
- Standards-based JMAP supports batched method calls, raw requests, and presets for common operations, reducing custom email-integration work.
- A shared authentication and mailbox stack serves MCP, AgentSkill CLI, LangChain, Dify, and the Python parity layer.
- Packaged help, actionable error hints, and suggested _next steps give automated workflows built-in recovery guidance.
- Verified custom domains retain the same jmap_request interface, presets, and JMAP request shapes.
- Core operation depends on Atomic Mail's hosted service, network availability, and authentication flow; the repository does not document a self-hosted mail-server deployment.
- Free accounts have a 100 MB storage quota and workload-oriented rate limits, but the source does not state the exact request limits.
- Custom domains are not fully hands-free because a person must use the dashboard and change TXT and MX DNS records.
- API keys are stored in local credential files, so operators must secure file access and manage credentials for multiple inboxes.
- Inbound email is untrusted input, creating a prompt-injection or unauthorized-action risk if agents follow message instructions without confirmation.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Atomic Mail Agentic This agent | 52 · Major gaps | MCP serverFreemium | ★ 255 | 5d ago | TypeScript | Codex · Claude Code |
| apowerb Agent Platform | 61 · Some gaps | Self-hosted serviceFree + model costs | ★ 150 | 4d ago | Python | OpenAI API · Claude API |
| OpenBot: AI Coworkers You Can Trust with Real Work | 87 · Good | Self-hosted serviceFree + model costs | ★ 10k | today | TypeScript | — |
| Open Computer Use (MCP desktop service) | 79 · Good | CLIFree + model costs | ★ 2.9k | 1d ago | Swift | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
The code and docs cover autonomous registration, JMAP reading and sending, and meeting invitations; the permission surface still includes sending, so least privilege scores 1. Registration requires the operator to choose watch, the username, and meeting details, and inbound mail is explicitly treated as untrusted with confirmation required, earning 2 for user confirmation. The docs describe PoW, JMAP, credential paths, and anonymized MCP analytics events, but do not fully explain all data processing, so transparency scores 2. Mode 0600 credential files, treating keys as secrets, and token rotation are documented; protection details across runtimes are limited, so sensitive-data handling scores 2. No dependency audit or vulnerability mitigation evidence is provided, so dependency security scores 1. Sending and calendar invitations have external effects, while pre-send confirmation is explicit only for calendar invitations, so external-effect controls score 1. Registration refuses to replace credentials by default and a separate directory is the safe path, but access can be permanently lost and no revocation or recovery mechanism for sent mail is shown, so rollback scores 1. The repository describes the product and service boundary and links Atomic Mail, but publisher identity and accountability are not sufficiently verified, so source attribution scores 1.
The docs specifically distinguish the CLI, MCP, Python layer, and remote MCP, but the sample has version and entry-point inconsistencies: the README uses an npm package name with a github suffix while the skill docs use a package name without it; the README also says three core tools while the skill and MCP code describe more commands. Self-consistency scores 1. Deno, Node, Python, and hosted-service dependencies are identified, but hosted availability and dependency pinning cannot be established from this sample, so dependency availability scores 1. The REST docs provide error fields, remediation hints, and examples, and the CLI reuses shared error text, so failure messages score 2.
The docs list newsletter, support inbox, and research interview scenarios, and distinguish autonomous registration from user-authorized OAuth; audience and scenarios score 2. Product capabilities and local-versus-hosted boundaries, scheduling cautions, and the untrusted-mail rule are described, so capability boundaries score 2. Skill triggers cover registration, email operations, and meetings, and unattended scheduled work has clear constraints, so trigger precision scores 2. MCP, CLI, LangChain, Python, and Dify paths are offered with installation information, though the sample does not provide complete setup coverage for every environment, so environment fit scores 2.
The README, topic-based docs, embedded help, and skill instructions form a navigable structure, scoring 2. Install commands, prerequisites, credential paths, and multi-account guidance are provided, scoring 2. Package names and command counts differ across files, so naming stability scores 1. Workflows, examples, troubleshooting-style hints, and help-topic guidance are present, scoring 2. The docs identify credential replacement as potentially causing permanent access loss, inbound mail as untrusted, scheduling limits, and the boundary between this repository and the private server, so known limitations score 2. The LICENSE clearly states MIT terms, scoring 3. A version badge and skill version are visible, but the sample provides no clear change history, so versioning and changelog score 1. Contribution guidance and an issue path exist, but named maintenance responsibility or commitments are unclear, so maintenance responsibility scores 1.
Structured JMAP, presets, placeholders, and readable help support reusable email operations, but runtime outcomes were not executed, so output usability scores 2. Dedicated inboxes, standard JMAP, and multiple integration paths offer visible value for autonomous email workflows, scoring 2. Free quota and workflow descriptions provide limited cost information; operating, deliverability, and ongoing scheduling costs lack sufficient evidence, so cost-benefit scores 1.
Specific installation, authentication, token lifetime, and request formats are documented, but server behavior is primarily described in docs and server code is outside the sample, so claim traceability scores 2. The README, skill docs, and code partly corroborate credential handling, scheduling, and tools, but package names and command descriptions conflict, so cross-source corroboration scores 1. The docs distinguish product claims from external server implementation and qualify some statements, but service quality and claims about model familiarity with JMAP lack evidence in this sample, so fact-inference separation scores 2.
- This is a low-confidence static review; no program was executed and server behavior was not independently verified.
- Sending email has external effects. The sample does not clearly require operator confirmation before every send outside calendar invitations; unattended workflows should remain read-only.
- Verify package names for the intended runtime: the README and skill docs show different npm package names.
Maintain this project? Add the FARS badge to your README
[](https://followagents.com/en/agents/atomic-mail-agentic)<a href="https://followagents.com/en/agents/atomic-mail-agentic"><img src="https://followagents.com/badge/atomic-mail-agentic.svg" alt="FARS review"></a>Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Added - Calendar. Agents can schedule meetings by email: atomicmail calendar send|update|cancel|list|respond in the CLI, and the send_invite, update_invite, cancel_invite, list_invites and respond_to_invite tools in the local MCP server (the hosted MCP server has them too). Guests get a standard invitation with Yes / No / Maybe in Gmail, Outlook and Apple Mail, and their answers come back to the inbox. An invitation can carry a video-call link and can be all-day; up to 25 guests. New help topic calendar and docs page [Calendar](https://docs.atomicmail.ai/calendar). TypeSc …View on GitHub ↗ -
Release notes excerpt
Added - Webhooks. Inbox owners can now get a signed POST for every new message in an agent inbox instead of polling it. Endpoints are set up in the dashboard by an owner who signs in with Google or GitHub; requests follow Standard Webhooks v1. The new [Webhooks](https://docs.atomicmail.ai/webhooks) page covers setup, signature verification (Node.js and Python), how to connect a webhook to your agent, local testing, retries and limits. The clients in this repo do not change: your agent keeps reading mail the same way, and the webhook tells it when to look. …View on GitHub ↗ -
Release notes excerpt
Security - Python clients now JSON-escape $VAR values. In langchain-atomicmail 0.3.30, pydantic-ai-atomicmail 0.3.30 and the Dify plugin, $VAR values were substituted into the JMAP JSON unescaped. reply.json fills $REPLY_SUBJECT from the inbound message, so a crafted subject could add method calls to a reply batch. Values are now escaped in string context, like the TypeScript runtime. Upgrade Python and Dify installs to 0.3.31. The TypeScript packages (npm, n8n, CLI, MCP) were not affected. If you pre-escaped values yourself (for example \n), pass raw text instead. …View on GitHub ↗
FAQ
Is an account free?
Does creating an @atomicmail.ai inbox require human verification?
Can an agent use an organization's own domain?
What security precautions are required?
How can an automated workflow recover from a failed request?
Thanks — we use this to improve the page.