---
title: "Mailroom: private Cloudflare email for AI agents | Ian Nuttall"
description: "A self-hosted Cloudflare email service with a CLI, TypeScript API, and three-tool MCP server for safe agent-assisted reading, drafting, and replies."
canonical: "https://ian.is/mailroom"
language: "en"
---

# Give project email one private home your agent can use

Mailroom receives email through Cloudflare and exposes bounded tools for reading, searching, drafting, and replying with approval before send.

[Read the setup guide](https://github.com/iannuttall/mailroom/blob/main/docs/deploy.md?ref=ian.is)

Node 22+ and Cloudflare · Apache 2.0

[Star on GitHub](https://github.com/iannuttall/mailroom?ref=ian.is)

0 stars · Open source

## What Mailroom puts between an agent and your inbox

### One private home for several domains

Exact routes feed a central Worker. Signed ingress relays cover domains that must remain in another Cloudflare account.

### Keep the original beside the useful view

R2 stores raw MIME and attachments. D1 stores bounded messages, threads, routes, drafts, approvals, and delivery history.

### Three MCP tools cover every operation

Agents list compact operation names, inspect one schema and its safety notes, then run only the operation they chose.

### A draft cannot quietly send itself

Creation, approval, and delivery are separate audited operations. Retries use idempotency keys so one action cannot become two emails.

### Email content is input, not authority

Prompts and attachments stay untrusted. Automation ships off, and quoted prices and links are checked against structured offer data.

### Keep Gmail as the human inbox

Optional forwarding sends stored inbound mail to Gmail. A user-owned Apps Script returns manual Sent messages to the correct thread.

## Email infrastructure that keeps storage, search, and sending explicit

You own the Cloudflare account

The Worker, D1 database, R2 bucket, routes, and sending configuration deploy into infrastructure you control.

Original email stays inspectable

R2 keeps raw MIME and attachments while D1 stores bounded parsed messages, threads, drafts, and delivery history.

Agents discover before they read

Three MCP tools list operations, describe one schema, and run it. Full bodies and attachments remain opt-in.

Drafting and sending are separate

A draft cannot silently become an outbound message. Approval, permissions, audit records, and idempotency guard the send path.

## Common questions about Mailroom

### Does Mailroom include a web inbox?

No. The first release uses a CLI, TypeScript API, private HTTP API, and MCP server. Gmail can remain the human inbox through optional forwarding and Sent-mail sync.

### Can an agent send email by itself?

Not by default. Creating, approving, and sending a draft are separate operations. Automation ships disabled and cannot silently send mail.

### What Cloudflare services does it need?

The central installation uses Workers, Email Routing and Email Service, D1, R2, Queues, Workers AI, and AI Search. Email Sending to arbitrary recipients currently needs Workers Paid.

### Is Mailroom a hosted email provider?

No. It is self-hosted software for Cloudflare. The mailbox state, raw email, routes, and sending configuration remain in the Cloudflare account you choose.

### How does Mailroom keep email content bounded for agents?

Search and discovery return compact metadata first. Complete bodies, threads, raw MIME, attachment metadata, and prompt content require explicit operation inputs.

### Can Mailroom receive email for several domains?

Yes. One central Worker can serve domains in the same Cloudflare account. Small signed ingress Workers relay domains that must stay in other accounts.

### Can I keep using Gmail?

Yes. Mailroom can forward stored inbound messages to a verified Gmail address, and its optional Apps Script can return manual Gmail Sent messages to the correct Mailroom thread.

## Let the agent help with the inbox without handing it an unlimited send button.