Private beta · Gmail and Google Workspace
comail sits between Gmail and your AI agents. Each agent only sees the threads carrying its label, and nothing else in your inbox. Use rules to label incoming mail automatically, keep replies as drafts you send yourself, and take any thread back right from Gmail.
Takes a minute to apply. No credit card required.
co:bookkeeping-agent in Gmail and only that agent can read it. It gets notified, reads the invoice, and books the expense.
Google’s OAuth scopes are all-or-nothing. Once you grant an agent read access to Gmail, it can search and read everything in your archive: board updates, legal threads, payroll, personal mail, and password resets.
If an agent can search your whole inbox, private threads end up in its context window while it drafts replies to vendors or customers. Scoping each agent to its own label keeps sensitive threads out of unrelated conversations.
Anyone with your address can send a prompt injection into your inbox. When an agent is restricted to threads you’ve labeled and can only write drafts you send yourself, an untrusted email has nowhere to go.
With standard OAuth, revoking access means disconnecting the whole account. With comail, if a thread turns sensitive, just remove the agent’s label in Gmail. Access is gone on its very next request.
How it works
Sign in with Google once from the comail dashboard. comail holds the OAuth grant, so your agents never receive Google credentials or talk to the Gmail API directly. Nothing needs to be installed in Gmail. You can connect work, personal, and shared mailboxes to one account, and disconnect any of them individually.
Each agent gets a Gmail label, co:agent-name, to share a thread, and optionally no:agent-name to block one. Most agents start with no access and only see threads labeled co:agent-name. You can apply labels manually in Gmail, use standard Gmail filters, or set up comail rules that label mail automatically by address, domain, or one of your own labels.
Every agent gets a dedicated MCP URL that works across all the inboxes you’ve assigned to it. Add the URL to your client and sign in through your browser to authorize it. On every request, comail checks the agent’s permissions and labels for that mailbox before calling Gmail.
{
"mcpServers": {
"inbox-investors": {
"url": "https://mcp.comail.io/a/7f3a91c2/investor-relations"
}
}
}Works with Claude, ChatGPT, Cursor, Codex, OpenClaw, or any custom MCP client. For headless agents without a browser, pass the agent’s API key in an Authorization: Bearer header instead.
Live notifications
No Google Cloud Pub/Sub, no public webhook server, and no polling loops. Any agent that can make outbound HTTP requests can listen for new or newly labeled threads, even when running locally on your laptop.
The agent calls create_notification_url over its MCP connection for the mailbox it wants to watch.
It opens that URL with a standard HTTP request. Because the connection is outbound, your agent doesn’t need a public IP or webhook endpoint.
Events carry only opaque mailbox and message IDs, never email bodies. The agent fetches the thread through comail, which checks its current label and send permissions as usual.
Have an agent follow incoming customer or vendor threads and draft replies in Gmail, with send turned off so every reply waits for you to send it.
Notifications fire not just on new arrivals, but whenever you add an agent’s co: label to an existing thread. Label an email in Gmail and your agent picks it up right away.
Book an arriving invoice, prepare a candidate reply, or flag an urgent customer request for your team as soon as it lands.
Call create_notification_url over the agent’s MCP connection for the target mailbox, assign the returned URL to NOTIFICATION_URL, and connect with either SSE or long polling:
curl -N -H 'Accept: text/event-stream' "$NOTIFICATION_URL"curl "$NOTIFICATION_URL"Scoped, one-hour URLs. Each URL is bound to one agent and one mailbox and expires after an hour. To stay connected, the agent requests a fresh URL over MCP before it expires.
Cursor-based replay. If a connection drops, the agent can reconnect with its last cursor to catch up on up to 24 hours of history. Delivery is at-least-once, so clients should deduplicate by message ID.
No email content in events. Payloads contain only opaque mailbox and message IDs, and only fire for threads the agent’s labels currently allow. The agent still calls get_message to read the message.
Near-realtime delivery. Events arrive shortly after Gmail processes the message or label change, though exact delivery latency is not guaranteed.
Labels
Every agent gets a label in your Gmail account, co:agent-name, that grants access to a thread. Turn on no:agent-name and it blocks one. Gmail filters and comail rules apply co: for you, and comail checks the thread’s live labels on every API call.
One inbox, three agents. Want to audit exactly what an agent can read? Search label:"co:investor-relations" in Gmail on your laptop or phone. And because comail hides its labels from your sidebar and inbox list by default, they won’t clutter your day-to-day view.
Set an agent’s default to deny and it sees nothing unless a thread carries co:investor-relations. Best for focused agents that only need specific conversations, like bookkeeping or investor updates.
Set an agent’s default to allow and it can read the inbox except threads labeled no:triage and any you exclude by one of your own labels, an address, or a domain. Useful for a general triage assistant when you only need to wall off sensitive senders or topics.
no: always winsOnce turned on, no: takes priority over co:. A rule can share a whole domain while you add no:agent-name to one sensitive thread from your phone. Rules never overwrite labels you set by hand.
Use cases
Six agents sharing a single founder’s inbox. Five run on allow-lists and only see threads labeled for them; the sixth runs on a deny-list and sees everything except what’s marked off-limits.
Fundraising
Drafts monthly updates and answers diligence questions. A rule labels threads from your investors, while payroll, legal, and customer emails stay completely out of reach.
| view | allow | co:investor-relations |
| view | deny | default |
| archive | allow | — |
| send | deny | — |
Internal comms
Summarizes what the team shipped each week. It only sees internal engineering and product updates, never board discussions or emails with outside counsel.
| view | allow | co:internal-team |
| view | deny | default |
| archive | allow | — |
| send | deny | — |
Personal
Tracks flights, hotel bookings, and order confirmations. Scoped strictly to travel and personal receipts so it can’t read a single company thread.
| view | allow | co:life-admin |
| view | deny | default |
| archive | allow | — |
| send | deny | — |
Hiring
Reads candidate threads and prepares replies. With send disabled, its replies sit in Gmail as normal drafts until you review them and hit send.
| view | allow | co:recruiting |
| view | deny | default |
| archive | allow | — |
| send | deny | — |
Finance
Pulls invoices and receipts into your accounting tool. It can’t send, and it only sees threads matched by your billing and receipt rules.
| view | allow | co:bookkeeping |
| view | deny | default |
| archive | deny | — |
| send | deny | — |
Operations
Sorts and labels incoming mail across the inbox. Unlike the others, it defaults to allow, while exceptions for your Board, Legal, and HR labels keep those threads private, and no:triage blocks any other thread you pick.
| view | deny | no:triage |
| view | allow | default |
| archive | allow | — |
| labels | allow | — |
Features
| Permission | What the agent can do | How it’s set |
|---|---|---|
view |
Search, list and read threads | Per thread: the agent’s own co: and no: labels, and its default policy for threads carrying neither |
draft |
Create, edit and delete its own drafts | Always on, for every agent |
send |
Deliver mail from your address | Per agent: drafts only (the default), specific people, or anyone |
review |
Send drafts other agents ask it to review, exactly as written, or return them with a reason | Per agent, off by default: which agents’ drafts, and to anyone or specific people |
attachments |
Open files attached to mail it can see; without this it sees only their names and sizes | Per agent, on by default |
archive |
Archive mail or move it back to the inbox, mark it read or unread, and star it | Per agent, on by default |
spam |
Move mail it can see to spam, or back to the inbox | Per agent, on by default |
trash |
Move mail it can see to the trash, or restore it | Per agent, off by default |
labels |
Create labels under co:agent-name/ and put them on mail it can see |
Per agent, off by default |
Resolution order is simple: no:, when turned on, overrides co:, and co: overrides the default policy. comail checks labels live on every request, not just when an email arrives, so removing a label cuts off access immediately. An agent cannot reply to, forward, or change a thread it cannot view, and it cannot widen its own access: it can’t add its own co: label or remove its own no: label.
| Inbox | What chief-of-staff sees there | Default | Access |
|---|---|---|---|
you@company.com |
Threads carrying co:chief-of-staff |
deny | active |
founders@company.com |
Everything except no:chief-of-staff |
allow | active |
you@personal.com |
Threads carrying co:chief-of-staff |
deny | paused |
One MCP URL across multiple accounts. Each inbox gets its own labels and default policy, so the same agent can use an allow-list on your individual work email and a deny-list on a shared team address. You can pause an agent in one inbox (or all of them) from the dashboard; its credentials and labels stay intact for when you resume, and any scheduled sends wait in the meantime.
| Capability | Gmail itself | Web dashboard |
|---|---|---|
| Give an agent one thread, or take it back | ||
| Label threads automatically as they arrive | Gmail filters | comail rules |
| Hide an agent’s labels from your inbox | ||
| Pause an agent in one inbox, or in all of them | ||
| Add, deactivate and revoke agents | ||
| Delegate setup to an agent management MCP, time-boxed or pausable | ||
| Switch an agent between allow-list and deny-list | ||
| Set an agent’s send, attachment, archive, spam, trash and label permissions | ||
| Billing and account |
Day-to-day access happens right in Gmail: sharing a thread or taking it back is just adding or removing a label on desktop or mobile. The web dashboard handles setup and rules.
FAQ
No. comail holds your Google OAuth grant. Each agent connects to comail using its own OAuth session or API key, and comail calls the Gmail API on its behalf only after checking that agent’s permissions. You can disconnect or rotate one agent’s credentials without affecting any other agent.
comail only manages its own co: and no: labels. It can read your existing labels so rules can match them, but it never creates, edits, or deletes your own labels. If you turn on an agent’s labels permission, it can create labels under co:agent-name/ and put them on threads it can view; it still can’t apply or change yours.
No. Gmail lets you hide labels from both the sidebar and the inbox list. comail sets its labels to hidden when it creates them, so ten agents won’t clutter your UI. You can toggle any label visible whenever you want to inspect it, or search label:"co:agent-name" anytime.
Personal Gmail and Google Workspace accounts. We built comail specifically around Gmail’s native label system so you can audit and control agent access directly from the inbox you already use.
Yes. You can attach multiple connected mailboxes to a single agent, using one MCP URL and one credential. Each mailbox has its own co: and no: labels and its own default policy, and the agent specifies which mailbox it’s querying on each tool call. You can also pause an agent in one mailbox while leaving the others active. Each inbox can have up to 10 agents, and an agent attached to several inboxes counts toward each of them.
Any client that supports MCP over HTTP, including Claude Desktop, Claude Code, ChatGPT, Cursor, Codex, OpenClaw, and custom scripts. Each agent gets a standard MCP server URL, so there is no custom SDK to install.
Yes. An agent can call create_notification_url over MCP and listen for new or newly labeled threads using standard HTTP streaming (SSE) or long polling. You don’t need to set up a webhook server, a public URL, or Google Cloud Pub/Sub. See how notifications work.
No. Agents only receive events for threads their labels currently allow, and the notification payload contains only opaque mailbox and message IDs. To read the email itself, the agent still has to call get_message, which re-checks its permissions.
Yes, via the management MCP endpoint. Connect an agent to the setup URL, sign in, and ask it in plain English to create agents, connect inboxes, and configure routing rules. Management access is off by default and can be enabled for a 60-minute window (so an agent can’t later widen its own permissions) or left on until you disable or pause it. The management endpoint can’t send email, and you choose how much mail it can read.
Only if you allow it. You choose one of three setups per agent: drafts only (the agent writes drafts in Gmail and you hit send), send only to specific people, or send to anyone. You can also have one agent review another’s drafts: the writer asks for a review, and the reviewer either sends the draft exactly as written or returns it with a reason. You choose whose drafts a reviewer may send and to whom, and anything it can’t send stays in Gmail Drafts for you.
Revoking an agent immediately invalidates its credentials and cancels any sends it has scheduled. If you just want a temporary hold, you can deactivate the agent altogether or pause it on a single inbox; its credentials, labels, and rules stay intact for when you’re ready to resume.
We’re onboarding beta users in small batches. Tell us what you want your agent to handle; specific use cases go to the front of the line.