- Cloudflare just open-sourced Agentic Inbox — a self-hosted email client with an AI agent that reads your inbox, drafts replies, and holds every send until you confirm.
- Runs entirely on Workers, Durable Objects, and R2.
TL;DR
During Agents Week 2026, Cloudflare open-sourced Agentic Inbox — a full email client with a built-in AI agent that runs 100% on your own Cloudflare account. The agent reads your inbox, searches conversations, and auto-drafts a reply the moment any new email lands, but never sends anything without explicit human confirmation. Apache 2.0, one-click deploy, no third-party servers touching your email.
What's new
Cloudflare shipped Agentic Inbox as a reference application alongside the public beta of Cloudflare Email Service. It's the first serious attempt at treating email as a first-class agent interface instead of a notification channel.
- Open-source email client — send, receive, threading, search, attachments, rich-text composer.
- Built-in AI agent with a side panel, 9 email tools, and streaming responses.
- Auto-draft on inbound — every new email triggers an agent draft in the background.
- Human-in-the-loop guardrail — drafts are held; the agent cannot send on its own.
- One-click deploy that auto-provisions R2, Durable Objects, and Workers AI.
- Built-in MCP server so external agents can plug in.
Why it matters
Every "AI email" product so far — Superhuman AI, Shortwave, the various Gmail add-ons — ships your mail to someone else's servers for inference. For legal, healthcare, exec comms, or anyone who dislikes handing their inbox to OpenAI, that's a dealbreaker.
Agentic Inbox inverts the model. The code, the model calls, the storage, the routing — everything stays in your Cloudflare tenant. You own the identity layer your agents operate on. And because it's Apache 2.0, you can fork it, strip what you don't need, and plug your own model in.
Quote from Cloudflare's announcement that sums up the pitch: "A chatbot responds in the moment or not at all. An agent thinks, acts, and communicates on its own timeline." Email is the protocol that lets agents do that asynchronously — and now the whole stack is open.
Technical facts
The architecture is where this gets interesting. Each mailbox is its own isolated Durable Object with a SQLite database, so there's zero shared-tenant blast radius. Attachments land in R2. Inbound goes through Email Routing; outbound uses the new Email Sending binding (SPF/DKIM/DMARC configured automatically).
| Layer | Technology |
|---|---|
| Frontend | React 19, React Router v7, Tailwind, TipTap, Zustand, @cloudflare/kumo |
| API / SSR | Hono on Cloudflare Workers |
| Mailbox storage | Durable Object per mailbox + SQLite |
| Attachments | Cloudflare R2 |
| Inbound mail | Email Routing (catch-all) |
| Outbound mail | Email Sending (send_email binding) |
| Agent | Cloudflare Agents SDK (AIChatAgent) + AI SDK v6 |
| Model | Workers AI — @cf/moonshotai/kimi-k2.5 |
| Auth | Cloudflare Access JWT |
| License | Apache 2.0 |
The 9 built-in tools wrap reading, searching, drafting, and sending primitives — enough for the agent to do inbox triage end-to-end. Replies are routed securely using HMAC-SHA256 signing, and address-based routing (support@yourdomain, sales@yourdomain) maps inbound mail to specific agent instances.
Comparison
| Option | Self-hosted | Open source | Agent-native | Mail leaves your tenant? |
|---|---|---|---|---|
| Gmail API + custom bot | No | No | DIY | Yes (Google) |
| SendGrid / Resend / Postmark | No | No | No | Yes |
| Superhuman AI / Shortwave | No | No | Partial | Yes |
| AgentMail (SaaS) | No | No | Yes | Yes |
| Agentic Inbox | Yes | Apache 2.0 | Yes | No |
Use cases
- Founder inbox triage — agent reads every new email, drafts a reply using your writing style, you click send.
- Support automation with a human brake — drafts go out to queue, a human approves, the agent learns from approvals.
- Form intake & ticket routing — address-based routing sends
bugs@to one agent instance,sales@to another. - Agent-to-agent comms — email becomes a durable, auditable channel between autonomous workers.
- Regulated industries — legal, healthcare, finance teams that need mail to stay inside their own cloud boundary.
Limitations & pricing
A few honest caveats before you deploy it to prod:
- Single trust boundary. Cloudflare Access gates the whole app — any authenticated user can open any mailbox. It's a reference app, not multi-tenant SaaS. Fork it if you need per-user isolation.
- Email Sending is still public beta as of April 2026. Deliverability is strong (auto SPF/DKIM/DMARC), but beta terms apply.
- Prerequisites: Cloudflare account + a domain, Email Routing enabled, Email Service enabled, Workers AI enabled, Access configured for production.
- Pricing: no per-seat fee. You pay standard Cloudflare usage — Workers invocations, Durable Objects, R2 storage/egress, and Workers AI tokens. For most solo users this lands in the "rounding error" tier.
What's next
The obvious next steps are multi-tenant patterns, richer MCP tooling, and GA for Email Sending. But the bigger story is that Cloudflare is quietly assembling every primitive an autonomous agent needs — compute (Workers), state (Durable Objects), storage (R2), queues, inference (Workers AI), and now a real email identity — under one account. Agentic Inbox is the first fully open reference of how those pieces click together.
If you've been waiting for an email stack where your AI works for you instead of for someone else's data warehouse, this is the one to try.
Nguồn: GitHub — cloudflare/agentic-inbox, Cloudflare Blog, The Agent Times.
