Agentic Inbox lets you send, receive, and manage emails through a modern web interface -- all powered by your own Cloudflare account. Incoming emails arrive via Cloudflare Email Routing, each mailbox is isolated in its own Durable Object with a SQLite database, and attachments are stored in R2.
An AI-powered Email Agent can read your inbox, search conversations, and draft replies -- built with the Cloudflare Agents SDK and Workers AI.
Read the blog post to learn more about Cloudflare Email Service and how to use it with the Agents SDK, MCP, and from the Wrangler CLI: Email for Agents.
Important: Clicking the 'Deploy to Cloudflare' button is only one part of the setup. You must follow the After deploying steps as well. For a full step-by-step guide with screenshots, refer to this comment: cloudflare#4 (comment)
-
Deploy to Cloudflare. The deploy flow will automatically provision R2, Durable Objects, and Workers AI. You'll be prompted for DOMAINS, a comma-separated list of domains (for example,
yourdomain.com, anotherdomain.com) to receive emails for (such asemail@yourdomain.com). Mailbox creation is restricted to these domains unless EMAIL_ADDRESSES is configured with an exact-address allowlist. -
Configure Cloudflare Access -- Enable one-click Cloudflare Access on your Worker under Settings > Domains & Routes. The modal will show your
POLICY_AUDandTEAM_DOMAINvalues.TEAM_DOMAINcan be either your Access team URL or the full.../cdn-cgi/access/certsURL. You must set these as secrets for your Worker. -
Set up Email Routing for every domain -- In the Cloudflare dashboard, open each domain > Email Routing, enable it, and create a catch-all rule that forwards to this same Worker. Repeat this separately for every value in
DOMAINS; a domain listed in the Worker configuration is not onboarded automatically. -
Enable Email Sending for every domain -- The worker needs the
send_emailbinding, and each sending domain must be onboarded separately with Cloudflare Email Sending. See Email Service docs. Use the same Worker for every domain. -
Create a mailbox -- Visit your deployed app and create a mailbox for any address on your domain (e.g.
hello@example.com)
For each domain configured in DOMAINS, verify:
- Inbound: mail is routed to the mailbox named by its SMTP envelope recipient, even when MIME
Todiffers or is empty for BCC delivery. - Metadata: the original MIME
To,Cc, andBccheaders remain visible in the stored message source. - Outbound: a new message sends through Email Sending with the selected mailbox's domain.
- Reply and forward: replies and forwards send from the receiving mailbox and keep its domain in the sender and
Message-ID. - Isolation: create
hello@domain-aandhello@domain-b, then verify their settings, attachments, emails, and Email Agent conversations never cross domains.
- If you see
Invalid or expired Access token, that usually meansPOLICY_AUDorTEAM_DOMAINsecrets are incorrect.- Resolution: turn Access off and back on for the Worker to get the Access modal again, then reset your Worker secrets to the latest
POLICY_AUDandTEAM_DOMAINvalues shown there.
- Resolution: turn Access off and back on for the Worker to get the Access modal again, then reset your Worker secrets to the latest
- If you see
Cloudflare Access must be configured in production, this application is intentionally enforcing Cloudflare Access so your inbox is not exposed to anyone on the internet.- Resolution: enable Access using one-click Cloudflare Access for Workers, then set the
POLICY_AUDandTEAM_DOMAINWorker secrets from the modal values.
- Resolution: enable Access using one-click Cloudflare Access for Workers, then set the
- Full email client — Send and receive emails via Cloudflare Email Routing with a rich text composer, reply/forward threading, folder organization, search, and attachments
- Per-mailbox isolation — Each mailbox runs in its own Durable Object with SQLite storage and R2 for attachments
- Built-in AI agent — Side panel with 9 email tools for reading, searching, drafting, and sending
- AI-assisted drafting — Ask the agent to draft replies when needed, with explicit review before sending
- Configurable and persistent — Custom system prompts per mailbox, persistent chat history, streaming markdown responses, and tool call visibility
- Frontend: React 19, React Router v7, Tailwind CSS, Zustand, TipTap,
@cloudflare/kumo - Backend: Hono, Cloudflare Workers, Durable Objects (SQLite), R2, Email Routing
- AI Agent: Cloudflare Agents SDK (
AIChatAgent), AI SDK v6, Workers AI (@cf/moonshotai/kimi-k2.5),react-markdown+remark-gfm - Auth: Cloudflare Access JWT validation (required outside local development)
npm install
npm run devRun the local Worker behavior tests (including local R2 and Durable Object bindings) with:
npm run test:worker- Set your comma-separated domains in
wrangler.jsonc(for example,"DOMAINS": "yourdomain.com, anotherdomain.com") - Create an R2 bucket named
agentic-inbox:wrangler r2 bucket create agentic-inbox
npm run deploy- Cloudflare account with a domain
- Email Routing enabled for receiving
- Email Service enabled for sending
- Workers AI enabled (for the agent)
- Cloudflare Access configured for deployed/shared environments (required in production)
Any user who passes the shared Cloudflare Access policy can access all mailboxes in this app by design. This includes the MCP server at /mcp -- external AI tools (Claude Code, Cursor, etc.) connected via MCP can operate on any mailbox by passing a mailboxId parameter. There is no per-mailbox authorization; the Cloudflare Access policy is the single trust boundary.
┌──────────────┐ ┌──────────────────┐ ┌─────────────────┐
│ Browser │────>│ Hono Worker │────>│ MailboxDO │
│ React SPA │ │ (API + SSR) │ │ (SQLite + R2) │
│ Agent Panel │ │ │ └─────────────────┘
└──────┬───────┘ │ /agents/* ──────┼────>┌─────────────────┐
│ │ │ │ EmailAgent DO │
│ WebSocket │ │ │ (AIChatAgent) │
└─────────────┤ │ │ 9 email tools │
│ │────>│ Workers AI │
└──────────────────┘ └─────────────────┘
Apache 2.0 -- see LICENSE.