Private beta · Gmail and Google Workspace
comail sits between Gmail and your AI agents. Each agent only sees the threads carrying its label, and nothing else in your inbox. Use rules to label incoming mail automatically, hold outbound replies for your approval, and take any thread back right from Gmail.
Takes a minute to apply. No credit card required.
co:bookkeeping-agent in Gmail and only that agent can read it. It gets notified, reads the invoice, and books the expense.
Google’s OAuth scopes are all-or-nothing. Once you grant an agent read access to Gmail, it can search and read everything in your archive: board updates, legal threads, payroll, personal mail, and password resets.
If an agent can search your whole inbox, private threads end up in its context window while it drafts replies to vendors or customers. Scoping each agent to its own label keeps sensitive threads out of unrelated conversations.
Anyone with your address can send a prompt injection into your inbox. When an agent is restricted to threads you’ve labeled and can’t send mail without your approval, an untrusted email has nowhere to go.
With standard OAuth, revoking access means disconnecting the whole account. With comail, if a thread turns sensitive, just remove the agent’s label in Gmail. Access is gone on its very next request.
How it works
Sign in with Google once from the comail dashboard. comail holds the OAuth grant, so your agents never receive Google credentials or talk to the Gmail API directly. Nothing needs to be installed in Gmail. You can connect work, personal, and shared mailboxes to one account, and disconnect any of them individually.
Each agent gets two Gmail labels: co:agent-name to share a thread, and no:agent-name to block one. Most agents start with no access and only see threads labeled co:agent-name. You can apply labels manually in Gmail, use standard Gmail filters, or set up comail rules that automatically label threads by sender, domain, or existing label.
Every agent gets a dedicated MCP URL that works across all the inboxes you’ve assigned to it. Add the URL to your client and sign in through your browser to authorize it. On every request, comail checks the agent’s permissions and labels for that mailbox before calling Gmail.
{
"mcpServers": {
"inbox-investors": {
"url": "https://mcp.comail.io/a/7f3a91c2/investor-relations"
}
}
}Works with Claude, ChatGPT, Cursor, Codex, OpenClaw, or any custom MCP client. For headless agents without a browser, pass the agent’s API key in an Authorization: Bearer header instead.
Live notifications
No Google Cloud Pub/Sub, no public webhook server, and no polling loops. Any agent that can make outbound HTTP requests can listen for new or newly labeled threads, even when running locally on your laptop.
The agent calls create_notification_url over its MCP connection for the mailbox it wants to watch.
It opens that URL with a standard HTTP request. Because the connection is outbound, your agent doesn’t need a public IP or webhook endpoint.
Events carry only opaque mailbox and message IDs, never email bodies. The agent fetches the thread through comail, which checks its current label and send permissions as usual.
Have an agent follow incoming customer or vendor threads and draft replies in Gmail, while keeping send held for your approval.
Notifications fire not just on new arrivals, but whenever you add an agent’s co: label to an existing thread. Label an email in Gmail and your agent picks it up right away.
Book an arriving invoice, prepare a candidate reply, or flag an urgent customer request for your team as soon as it lands.
Call create_notification_url over the agent’s MCP connection for the target mailbox, assign the returned URL to NOTIFICATION_URL, and connect with either SSE or long polling:
curl -N -H 'Accept: text/event-stream' "$NOTIFICATION_URL"curl "$NOTIFICATION_URL"Scoped, one-hour URLs. Each URL is bound to one agent and one mailbox and expires after an hour. To stay connected, the agent requests a fresh URL over MCP before it expires.
Cursor-based replay. If a connection drops, the agent can reconnect with its last cursor to catch up on up to 24 hours of history. Delivery is at-least-once, so clients should deduplicate by message ID.
No email content in events. Payloads contain only opaque mailbox and message IDs, and only fire for threads the agent’s labels currently allow. The agent still calls get_thread to read the message.
Near-realtime delivery. Events arrive shortly after Gmail processes the message or label change, though exact delivery latency is not guaranteed.
Labels
Every agent gets two labels in your Gmail account: co:agent-name grants access to a thread, and no:agent-name blocks it. Rules and filters simply apply those labels for you, and comail checks the thread’s live labels on every API call.
One inbox, three agents. Want to audit exactly what an agent can read? Search label:"co:investor-relations" in Gmail on your laptop or phone. And because comail hides its labels from your sidebar and inbox list by default, they won’t clutter your day-to-day view.
Set an agent’s default to deny and it sees nothing unless a thread carries co:investor-relations. Best for focused agents that only need specific conversations, like bookkeeping or investor updates.
Set an agent’s default to allow and it can read the inbox except for threads labeled no:triage. Useful for a general triage assistant when you only need to wall off sensitive senders or topics.
no: always winsIf a thread has both labels, no: takes priority. A broad rule can share a whole domain with an agent while you add no:agent-name to one sensitive thread from your phone. Manual labels are never overwritten by rules.
Use cases
Six agents sharing a single founder’s inbox. Five run on allow-lists and only see threads labeled for them; the sixth runs on a deny-list and sees everything except what’s marked off-limits.
Fundraising
Drafts monthly updates and answers diligence questions. A rule labels threads from your investors, while payroll, legal, and customer emails stay completely out of reach.
| view | allow | co:investor-relations |
| view | deny | default |
| draft | allow | — |
| send | approval | — |
Internal comms
Summarizes what the team shipped each week. It only sees internal engineering and product updates, never board discussions or emails with outside counsel.
| view | allow | co:internal-team |
| view | deny | default |
| send | deny | — |
| modify | allow | — |
Personal
Tracks flights, hotel bookings, and order confirmations. Scoped strictly to travel and personal receipts so it can’t read a single company thread.
| view | allow | co:life-admin |
| view | deny | default |
| draft | allow | — |
| send | approval | — |
Hiring
Reads candidate threads and prepares replies. With send disabled, its replies sit in Gmail as normal drafts until you review them and hit send.
| view | allow | co:recruiting |
| view | deny | default |
| draft | allow | — |
| send | deny | — |
Finance
Pulls invoices and receipts into your accounting tool. Strictly read-only, and restricted to threads matched by your billing and receipt rules.
| view | allow | co:bookkeeping |
| view | deny | default |
| draft | deny | — |
| send | deny | — |
Operations
Sorts and labels incoming mail across the inbox. Unlike the others, it defaults to allow, while rules apply no:triage to keep board, legal, and HR threads private.
| view | deny | no:triage |
| view | allow | default |
| draft | deny | — |
| modify | allow | — |
Features
| Permission | What the agent can do | Scoped by | Approval gate |
|---|---|---|---|
view |
Search, list and read threads | The agent’s own co: and no: labels, and its default policy for threads carrying neither |
— |
draft |
Create and edit drafts, on threads it can already view | Agent-wide default | — |
send |
Deliver mail from your address | Agent-wide default | Optional: hold every send for your review |
modify |
Label, archive and mark messages read | Agent-wide default | Optional |
Resolution order is simple: no: overrides co:, and co: overrides the default policy. comail checks labels live on every request, not just when an email arrives, so removing a label cuts off access immediately. And because an agent cannot draft, send, or modify a thread it cannot view, thread labels govern every action.
| Inbox | What chief-of-staff sees there | Default | Access |
|---|---|---|---|
you@company.com |
Threads carrying co:chief-of-staff |
deny | active |
founders@company.com |
Everything except no:chief-of-staff |
allow | active |
you@personal.com |
Threads carrying co:chief-of-staff |
deny | paused |
One MCP URL and one audit trail across multiple accounts. Each inbox gets its own labels and default policy, so the same agent can use an allow-list on your individual work email and a deny-list on a shared team address. You can pause an agent in one inbox (or all of them) from the dashboard; its credentials and labels stay intact for when you resume, and any queued sends wait in the meantime.
| Capability | Gmail itself | Web dashboard | Gmail add-on optional |
|---|---|---|---|
| Give an agent one thread, or take it back | |||
| Label threads automatically as they arrive | Gmail filters | comail rules | |
| Hide an agent’s labels from your inbox | |||
| Pause an agent in one inbox, or in all of them | |||
| Add, suspend and revoke agents | |||
| Delegate setup to an agent management MCP, time-boxed or pausable | |||
| Switch an agent between allow-list and deny-list | |||
Set draft, send and modify defaults | |||
| Approve, edit or reject a pending send | |||
| Explain why an agent can or can’t see a thread | |||
| Audit log of every access decision | Recent only | ||
| Billing and account |
Day-to-day access happens right in Gmail: sharing a thread or taking it back is just adding or removing a label on desktop or mobile. The web dashboard handles setup, rules, approvals, and the audit log. The optional Gmail add-on brings the approval queue and per-thread access details into the Gmail sidebar.
FAQ
No. comail holds your Google OAuth grant. Each agent connects to comail using its own OAuth session or API key, and comail calls the Gmail API on its behalf only after checking that agent’s permissions. You can disconnect or rotate one agent’s credentials without affecting any other agent.
No, it’s completely optional. Since permissions are regular Gmail labels, you can grant or revoke access in any email client and manage rules and settings in the web dashboard. Install the add-on only if you want to review pending sends or check which agents can see a thread without leaving Gmail.
comail only manages its own co: and no: labels. It can read your existing labels so rules can match them, but it never creates, edits, or deletes your own labels unless you explicitly grant an agent the modify permission (and even then, only on threads that agent is allowed to view).
No. Gmail lets you hide labels from both the sidebar and the inbox list. comail sets its labels to hidden when it creates them, so ten agents won’t clutter your UI. You can toggle any label visible whenever you want to inspect it, or search label:"co:agent-name" anytime.
Personal Gmail and Google Workspace accounts. We built comail specifically around Gmail’s native label system so you can audit and control agent access directly from the inbox you already use.
Yes. You can attach multiple connected mailboxes to a single agent, using one MCP URL and one credential. Each mailbox has its own co: and no: labels and its own default policy, and the agent specifies which mailbox it’s querying on each tool call. You can also pause an agent in one mailbox while leaving the others active.
Any client that supports MCP over HTTP, including Claude Desktop, Claude Code, ChatGPT, Cursor, Codex, OpenClaw, and custom scripts. Each agent gets a standard MCP server URL, so there is no custom SDK to install.
Yes. An agent can call create_notification_url over MCP and listen for new or newly labeled threads using standard HTTP streaming (SSE) or long polling. You don’t need to set up a webhook server, a public URL, or Google Cloud Pub/Sub. See how notifications work.
No. Agents only receive events for threads their labels currently allow, and the notification payload contains only opaque mailbox and message IDs. To read the email itself, the agent still has to call get_thread, which re-checks its permissions.
Yes, via the management MCP endpoint. Connect an agent to the setup URL, sign in, and ask it in plain English to create agents, connect inboxes, and configure routing rules. Management access is off by default and can be enabled for a 60-minute window (so an agent can’t later widen its own permissions) or left on until you disable or pause it. The management endpoint can never read or send email, cannot modify rules or labels you created yourself, and logs every change to the audit trail.
Only if you allow it. Most people choose one of three setups: read-only, drafts-only (the agent writes drafts in Gmail and you hit send), or send-with-approval (outbound messages wait in a queue until you approve them).
Revoking an agent immediately invalidates its credentials and cancels any messages waiting in the approval queue. If you just want a temporary hold, you can suspend the agent altogether or pause it on a single inbox; its credentials, labels, and rules stay intact for when you’re ready to resume.
We’re onboarding beta users in small batches. Tell us what you want your agent to handle; specific use cases go to the front of the line.