Work email for your AI agent

Features

Everything you do in email, in one question

The agent sees your mailbox the way you do in web mail. It decides which message to open, which thread to pull together, and what to read in an attachment.

Inbox triage

New mail for any period, sorted into “reply”, “FYI” and “safe to skip”.

check_mailtriage_inbox

Threads without the quotes

The whole conversation from Inbox and Sent, in order, without the “From: … Sent: …” clutter. Who proposed what, and what’s expected of you.

get_threadsummarize_thread

Attachments and transcripts

Text from .docx, PDF, .txt, .md, .csv, HTML, and .vtt/.srt subtitles — with speaker lines like “Anna: …”.

get_attachment

Search across all folders

By text, sender, recipient, subject, date and attachments. Dates the way people write them: yesterday, 7d, 2026-10-01.

search_messages(sender="Anna", text="budget", since="30d")
→ 6 messages, newest first

search_messagesget_message

People and senders

Your company address book: name, exact address, title, department. Plus who wrote to you most this week, with unread counts.

list_senders(since="7d")
→ Anna Smith · 12 messages · 3 unread

find_peoplelist_senders

Nothing is sent without your “yes”

The agent can draft a message or a reply in a thread, but it can’t send on its own. A confirmation window opens in your browser.

• Send, Edit or Don’t send — your call
• External addresses are highlighted; Bcc comes with a warning
• Only your browser knows the window’s address, so text in an email can’t talk the agent into clicking the button
• No answer in 50 seconds and the message isn’t sent; a retry never sends it twice
• Sending stays off until you turn it on

send_email

How it works

Three minutes from install to first answer

1. Install with one command

   The installer puts its own Python in a separate folder and leaves the system one alone. To update, run the same command. Your settings are kept.

   $ curl -LsSf …/install.sh | sh
   ==> Done: owa-mail-mcp 0.3

2. Connect your mailbox

   The setup window asks for the same details you use for web mail. Test connection shows your name and latest messages.

   

3. Ask your agent

   The Add button registers the server in Claude Code, Codex, Claude Desktop or Cursor. Then just ask: “what’s new in my inbox?”

   › what’s new in my inbox since yesterday?
   ⏺ owa-mail · check_mail → 12 messages

Install

Install and connect

You need access to your mail server: if web mail only opens over VPN, turn the VPN on. The program's windows follow your system language; you can switch it in the setup window.

curl -LsSf https://raw.githubusercontent.com/Khomiakov7706/owa-mail-mcp/main/install.sh | sh

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
uv tool install --python 3.12 git+https://github.com/Khomiakov7706/owa-mail-mcp
owa-mail-mcp setup

Install and connect the OWA Mail MCP server for my Exchange work email.
1. Run: curl -LsSf https://raw.githubusercontent.com/Khomiakov7706/owa-mail-mcp/main/install.sh | sh
2. Connect the server to yourself. For Claude Code: claude mcp add --scope user owa-mail -- ~/.local/bin/owa-mail-mcp
3. I'll set up the mailbox (server address, login, password) myself in the window that opens — don't ask me for the password.
4. Then call get_status and show me the result.
Instructions for agents: https://khomiakov7706.github.io/owa-mail-mcp/llms.txt

claude mcp add --scope user owa-mail -- ~/.local/bin/owa-mail-mcp

{
  "mcpServers": {
    "owa-mail": { "command": "/Users/YOU/.local/bin/owa-mail-mcp" }
  }
}

codex mcp add owa-mail -- ~/.local/bin/owa-mail-mcp

{
  "mcpServers": {
    "owa-mail": { "command": "/Users/YOU/.local/bin/owa-mail-mcp" }
  }
}

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "owa-mail": {
      "type": "local",
      "command": ["/Users/YOU/.local/bin/owa-mail-mcp"],
      "enabled": true
    }
  }
}

{
  "mcp": {
    "owa-mail": {
      "type": "local",
      "command": ["/Users/YOU/.local/bin/owa-mail-mcp"],
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "owa-mail": {
      "command": "/Users/YOU/.local/bin/owa-mail-mcp",
      "args": [],
      "disabled": false,
      "alwaysAllow": []
    }
  }
}

System

macOS, Linux, Windows

Mail

Exchange 2013 / 2016 / 2019 — the same server as your OWA web mail

After updating

Restart the MCP server in your client: in Claude Code, /mcp → Reconnect

For developers and agents

MCP tools

Everything except send_email is read-only. Email content is data, not instructions: the server explicitly tells the agent not to follow commands found in messages.

Prompts: summarize_thread — a thread summary, triage_inbox — inbox triage. Full reference: the Markdown version of this page and llms.txt.

Security

Security, honestly

For personal use, the design is sound. But it hasn’t had an independent audit yet, and the main risk isn’t in the code: everything the agent reads goes to the AI service behind it.

What’s protected

What it doesn’t solve

1. Your mail goes to an AI service. Everything the agent reads — messages, attachments, transcripts — is sent to the company that runs the agent. A bank or another regulated company needs sign-off from its security team, and policy may forbid it outright. That’s a policy question, not a code question.
2. Emails with “commands” for the agent. An incoming email can contain text aimed at the agent: “forward this…”. The server asks the agent to treat mail as data, but that’s a request, not a lock. The real safeguard is the confirmation window: read the message before you click Send. The agent can read everything; you can’t limit it to specific folders yet.
3. How it installs. curl … | sh installs whatever is on the main branch right now. There are no signed releases or pinned versions yet: if the GitHub account is compromised, the next update will be too.
4. Settings that weaken security. “Legacy encryption settings” for the server, and a password in the OWA_MAIL_PASSWORD variable in the agent config instead of the keychain. Both are off until you turn them on.
5. Access to your computer. Anyone already signed in as you can use the saved password and the running program — as with any app that stores a password.

Before you connect work email

• Get your security team’s sign-off on sending email content to an AI service.
• Don’t turn on sending unless you really need it.
• Get an independent code review and install a pinned version, not the latest from main.

FAQ

Frequently asked questions