Open source · MIT licensed

Organisational email, under your control.

Give your organisation real email: personal inboxes for everyone, shared addresses for teams, and clear control over who can access what. It runs in your own Cloudflare account, on your own domain — not a service you rent from us.

Deploy your own Security & assurance View the source

MIT licensed Your domain, your data Sign in with Google, Microsoft, or an email code

Product tour

See it before you set it up

Real cmail screens, filled with sample data. Personal mail, shared team mail, and admin tools all live in one place — with no shared passwords and a clear record of who did what.

cmail shared Community Enquiries inbox showing mailbox navigation, unread messages, importance, attachments, search, and bulk actions
Personal and shared mailboxes in one workspace Switch between your own inbox and any shared team address. Folders, search, and unread counts work the same in both.
cmail management overview showing account, mailbox, message, deployment readiness, and directory privacy summaries
Management overview One place to check accounts, mail flow, policy, and recent activity across your organisation.
cmail shared mailbox administration showing named delegates and Read, Send as, and Full access permissions
Shared mailbox delegation Create an address like support@yourcompany.com, then decide exactly what each person can do with it.
cmail signature settings showing a personal signature layered above a locked organisation signature
Personal and organisation signatures Everyone can set their own signature. Managers can lock a standard one and add a company-wide signature underneath.
cmail policy management showing a current organisation IT policy and acknowledgement progress
IT policy sign-off Publish your IT policy and require people to accept it before they can use mail. cmail keeps a record of who agreed, and when.

Capabilities

What you get

The features that matter for running organisational email well.

Shared team addresses

Set up addresses like support@ or sales@, and choose exactly who can read, send as, or fully manage each one.

Sign in with Google or Microsoft

People use the account they already have, or a one-time email code for a mailbox hosted elsewhere. No extra password for you to store, and managers can restrict sign-in to approved countries.

Sends and receives real mail

Mail flows through Cloudflare, or Postmark if you prefer — not a sandbox or a demo.

Find out what happened

When someone asks “did my email arrive?”, search delivery history and admin activity in one place.

Signatures and policy, handled

Require people to accept your IT policy before they get mail access. Layer personal and company signatures automatically.

Catches obvious scams

Flags suspicious links, look-alike senders, and messages from people you’ve never heard from before.

Your team, organised

Set up teams, roles, and reporting lines. Directory details stay internal by default.

Works like an app

Install cmail on a phone or desktop, and get notified when new mail arrives.

AI assistants, on your terms

Connect Claude or another MCP client with a browser sign-in. People choose the mailboxes and permissions; sending stays off unless they turn it on. How it works

Shared mailboxes

A team address without a shared password

Everyone signs in with their own Google or Microsoft account — nobody shares a password. A manager creates the shared address and decides exactly what each person can do with it. Afterwards, it’s clear who did what.

Folders, read status, and sent mail are shared with everyone who has access. Drafts stay private until sent. (cmail borrows the term “Exchange-style” from Microsoft Exchange for these permission levels — it’s an independent, Cloudflare-native product, not a Microsoft Exchange server.)

ReadOpen and read messages, and mark them read or unread.
Send asEverything in Read, plus writing and replying from the shared address.
Full accessEverything in Send as, plus moving, starring, archiving, and deleting messages.

MCP integration

Let an AI assistant help with mail, without handing over the keys

cmail includes a remote Model Context Protocol (MCP) server. An AI app such as Claude can search, read, draft and organise mail for you, but only in the mailboxes and only with the permissions you approve, in a sign-in window that cmail controls. It's off until your organisation turns it on.

  1. Add one address Paste your cmail server address into the AI app's connector or MCP settings. https://mail.your-domain/mcp
  2. Sign in, the usual way A cmail window opens. Sign in with Google, Microsoft or an email code. The AI app never sees a password.
  3. Choose, then allow Tick what the app may do and which mailboxes it may use. You're returned to the app, connected.

You decide, mailbox by mailbox

The consent screen names the app (and, where it can, the website that vouches for it), shows where you'll be sent back, and starts with the safest choices: read and draft on; send, organise and calendar off. Personal mail is ticked; shared team mailboxes are opt-in.

Every request is checked again against what you approved and what you can still access. Lose access to a shared mailbox and the app loses it on its next request.

Sending is opt-in. An app can only send if you tick "Send email as you". Even then it's limited per hour, and drafting for your review stays the recommended default.

Connect an AI app Allow "Example Assistant" to use your mail? Returns to: an app on this computer · Signed in as you
What it may do
Read mailSearch and read the mailboxes you choose
On
Write draftsSaved to Drafts, never sent
On
Send email as youOff unless you turn it on
Off
Organise mailArchive, move, mark, star
Off
Which mailboxes
you@your-domainPersonal
Shared
support@your-domainTeam mailbox
Not shared
DenyAllow

Security built in, not bolted on

  • Admin off-switch. Off by default. A Manager turns it on, can turn it off, and can disconnect every AI app at once.
  • Revoke any time. Each person sees their connected apps, what they can do, when they were last used, and a Disconnect button that works immediately.
  • Audit log for every call. Time, person, app, tool, mailbox and result are recorded. Message content never is.
  • Prompt-injection aware. Mail is written by strangers. Everything an app reads is labelled untrusted, and cmail never acts on instructions found in an email.
  • Short-lived, bound tokens. OAuth 2.1 with PKCE. One-hour access tokens that only work on your server, rotating refresh tokens, and automatic disconnection if a token is ever replayed.
  • Nothing secret at rest. Codes and tokens are stored only as hashes, and connections expire after 90 days.
  • Same rules as the web app. Drafts and sends go through cmail's own compose path, with the same permissions, limits and send journal.
  • Current MCP, open standards. Streamable HTTP for the 2026-07-28 revision and earlier clients, with OAuth discovery, client metadata documents and dynamic registration.

Designed for MCP clients that support remote servers with OAuth sign-in, such as Claude's custom connectors and Claude Code. Like the rest of cmail it's pre-1.0 and hasn't been independently audited: review it for your own requirements, and remember that an app you approve can read the mail you share with it. Read the MCP guide and threat model.

Deploy

Bring your own domain and providers

Clone the repo, create your Cloudflare database and storage bucket, set up sign-in, and store your secrets — then verify mail flow before you go live.

cmail is pre-1.0 software. Work through the deployment and security checklists, set up backups, and test with real accounts before going live.

Read the deployment guide

# clone, configure, and validate
git clone https://github.com/Rob142857/cmail.git
cd cmail
pnpm install
pnpm setup
pnpm validate