Agentic Inbox Review: AI Webmail on Cloudflare Workers
Agentic Inbox is Cloudflare’s open-source, self-hosted webmail with a built-in AI agent. It’s clean, fast and easy to deploy, but it has gaps and a shared-access security model you should understand first.
Agentic Inbox is Cloudflare’s open-source, self-hosted webmail client with an AI agent built in, running entirely on Workers. In my testing it was clean, fast and easy to deploy, and its AI drafting was less intrusive than I expected. It is also a young project with a few gaps and a security model you need to understand before you put real mail through it.
As edge-native email tools evolve, moving from traditional webmail to self-hosted, serverless email on Cloudflare is becoming a realistic option. Agentic Inbox is published by Cloudflare on GitHub under the Apache 2.0 licence, and it shows how far the developer stack has come: Durable Objects with SQLite, R2 storage, Workers AI and Email Routing.
I recently reviewed Mailflare and have now deployed Agentic Inbox. Both are built for Cloudflare and rely on its native building blocks, with Email Routing for inbound mail and Cloudflare’s sending service for outbound. Agentic Inbox takes a distinct approach by embedding an AI agent directly into your mail flow.
Short answer: a good, minimal webmail for tinkerers who already live on Cloudflare, with drafting help that stays out of the way. It isn’t yet a complete daily driver: I found no attachment upload in the composer and no alias support, and anyone who passes your Access policy can reach every mailbox.
At a Glance: Who Agentic Inbox Is (and Isn’t) For
| User Profile | Best Fit? | Core Value Drivers / Key Trade-offs |
|---|---|---|
| Developer already on Cloudflare | Ideal | One-click style deploy, edge speed and full ownership. Some setup steps remain manual. |
| Self-hoster who wants a simple webmail | Strong fit | Minimal interface, no paywalled features. Young project with gaps. |
| Someone wanting AI help with routine replies | Strong fit | Drafts replies in the background and asks before sending. Workers AI processes your mail text. |
| Small team sharing one deployment | Partial fit | Access is the only trust boundary, so everyone it admits can see all mailboxes. |
| Non-technical user wanting a mailbox that just works | Alternative needed | A hosted provider such as Fastmail is far less work. |
Interface and Daily Speed: Clean, Basic and Snappy
My immediate impression on logging in was the restraint of the design.
- Minimalist by design. The interface strips away clutter in favour of pure utility. It feels basic, which I count as a positive: in my testing I saw no heavy third-party tracking scripts and no bloated layout.
- Noticeably snappy. Day to day it felt faster than Mailflare. Thread loading, search-as-you-type and folder navigation were close to instant. This is my impression of using it, not a benchmark.
- No paywalled tier. There are no upsell pop-ups, artificial rate limits or “Pro” features locked away. It is open source, so you get the complete tool.
The AI Integration: Less Intrusive and Surprisingly Practical
If you’ve read my post on AI and email, you’ll know I’m generally sceptical about putting generative AI into personal communication. Outsourcing your written voice often produces sterile, corporate noise. Even so, the AI features here felt less intrusive than typical inbox assistants.
- Background drafting. According to the README, the agent can auto-draft replies to new inbound mail. It is built on the Cloudflare Agents SDK and Workers AI, and the README describes a side panel with tools for reading, searching, drafting and sending.
- Human in the loop. Drafts always need your explicit confirmation before anything is sent. The README is clear about this, but note that the agent also has a sending tool, so that confirmation step is doing real work. Don’t switch it off or wave things through on autopilot.
- Good for one-liners. In testing it performed well. I still prefer to write detailed messages myself, but it works if you want to whizz through a morning inbox and clear routine emails.
- MCP endpoint. For power users it exposes a Model Context Protocol endpoint at
/mcp, behind Zero Trust Access. External tools such as Cursor or Claude can connect and work with a mailbox by passing a mailbox ID.
Installation and Architecture
I found deploying Agentic Inbox slightly easier than Mailflare, though the README warns that clicking the deploy button is only part of the setup. The pieces fit together like this:
| Component | What it does |
|---|---|
| Email Routing | Receives inbound mail and passes it to the Worker through a catch-all rule |
| Durable Objects with SQLite | One isolated object per mailbox for mailbox state |
| R2 | Stores attachments |
| Workers AI | Runs the agent’s model. The README lists @cf/moonshotai/kimi-k2.5 |
Email sending (send_email binding) | Dispatches outbound mail |
| Cloudflare Access | Authenticates everyone who reaches the app |
The README’s deployment steps are: deploy through the Cloudflare button, which provisions R2, Durable Objects and Workers AI and asks for your domain; enable Access on the Worker and save POLICY_AUD and TEAM_DOMAIN as secrets; create a catch-all Email Routing rule that points to the Worker; enable Email Service and the send_email binding; then create a mailbox in the app.
Authentication and the Security Model
Instead of maintaining a fragile local password database, Agentic Inbox relies on Cloudflare Zero Trust Access. Once your policy is matched and the two secrets are saved, authentication is offloaded to Cloudflare. In my setup that meant One-Time PINs.
Know the limits: the README states that any user who passes the shared Access policy can access all mailboxes in the app, by design, and there is no per-mailbox authorisation. If you only run your own mail, that is fine. If you add a colleague, or an AI tool through the MCP endpoint, remember they can reach everything. Keep your Access policy tight.
Privacy: Where Your Mail Goes
Self-hosted doesn’t mean off-cloud. Your mail passes through Cloudflare’s Email Routing, sits in your own R2 bucket and Durable Objects, and any message the agent reads is processed by Workers AI. According to Cloudflare’s Workers AI privacy page, it doesn’t use your customer content to train the models on Workers AI, or to improve Cloudflare or third-party services, without your explicit consent, and it doesn’t make your content available to other Cloudflare customers. The page describes the models as third-party services subject to their own licences. Read it, and the model’s licence, before you route sensitive mail through the agent. This is not end-to-end encrypted email. For that, see what secure email actually means.
Requirements and Costs
| Item | What Cloudflare says |
|---|---|
| Email Routing (receiving) | Available on the Free and Paid plans |
| Email sending | In beta, and requires the Workers Paid plan |
| Workers AI | Needed for the agent. Check current usage pricing |
| Access | Required for any deployed or shared environment |
| Agentic Inbox itself | Free and open source (Apache 2.0) |
I haven’t costed a typical month, and prices change, so check Cloudflare’s pricing pages. The README doesn’t say which plan the whole stack needs, but because sending is a paid-plan beta feature, don’t assume the whole thing runs free.
Areas for Improvement and Wishlist
The speed and execution are impressive, but two gaps stop it being a complete daily driver for me:
- Attachment uploads. I couldn’t find a way to attach local files to outbound drafts in the composer, unless I’m missing something in the UI. Incoming attachments render fine from R2. The README lists attachments as a feature, so this may depend on the version you deploy. Check before you rely on it.
- Aliases. Managing multiple sub-aliases or sending from secondary addresses isn’t something I could do. The client ties to the mailbox you create in the UI. Alias mapping, which Mailflare handles well, would make this a complete webmail replacement.
It is also a young project. When I checked, the repository showed no published releases, so expect change and keep your own backups.
Agentic Inbox vs Mailflare vs a Hosted Provider
| Feature | Agentic Inbox | Mailflare | Hosted provider (e.g. Fastmail) |
|---|---|---|---|
| Where it runs | Your Cloudflare account | Your Cloudflare account | Provider’s servers |
| Speed (my impression) | Fastest of the two | Slower in my testing | Fast |
| Setup | Slightly easier than Mailflare | More involved | Minimal |
| Aliases | Not supported in my testing | Handled well | Built in |
| AI drafting | Built in, with confirmation before sending | See my Mailflare review | Varies by provider |
| Support | Community and GitHub issues | Community | Provider support |
| Full Review | You are here | Mailflare review | Fastmail review |
Pros and Cons
| Strengths | Weaknesses |
|---|---|
| Fast, minimal interface with no paywalled features | No attachment upload in the composer that I could find |
| Unobtrusive AI drafting with explicit send confirmation | No alias support in my testing |
| Easy deployment for Cloudflare users | Anyone passing Access can reach every mailbox |
| Open-source, Apache 2.0, with an MCP endpoint | Young project, no published releases when I checked |
| Complete ownership of your mail infrastructure | Sending is a beta, paid-plan feature and not end-to-end encrypted |
Frequently Asked Questions
What is Agentic Inbox?
A self-hosted email client with an AI agent that runs on Cloudflare Workers, published as an open-source project by Cloudflare.
Does the AI send emails automatically?
It can auto-draft replies to new inbound mail, but the README says drafts always require explicit confirmation before sending.
Is Agentic Inbox free?
The software is free and open source. You pay for the Cloudflare services it uses. Email sending is a beta feature that requires the Workers Paid plan, so check current pricing.
Is my email private in Agentic Inbox?
You control the storage, but mail is processed by Cloudflare services, including Workers AI if the agent reads it. It isn’t end-to-end encrypted.
Can I use more than one mailbox?
Yes, you can create mailboxes in the app, each with its own storage. Everyone who passes the shared Access policy can access all of them.
Can I connect other AI tools?
Yes. The /mcp endpoint lets tools such as Cursor connect, behind Cloudflare Access.
The Verdict
I really like this simple, clean webmail. Despite my general reluctance towards AI in my inbox, Cloudflare’s implementation feels utility-focused rather than gimmicky. By combining Cloudflare’s edge with lightweight auto-drafting and an open MCP endpoint, Agentic Inbox gives you a fast, zero-bloat webmail client and complete ownership of your email infrastructure. The missing attachment upload and aliases, the shared-access model and its youth keep it from being something I would recommend to everyone.
Note: this article contains no affiliate links. Sources: cloudflare/agentic-inbox README; Cloudflare Email Service docs; Cloudflare Workers AI privacy. Checked 9 October 2026.