Private beta · Gmail and Google Workspace

Your agents don’t need your whole inbox.

comail is a permission layer between Gmail and the AI agents that connect to it. Every agent reads exactly the threads carrying its label, and nothing else. Approve what it sends. Revoke a thread from your phone.

Request access How it works

Early-bird pricing is $99/month per inbox, and beta users keep it. Applying takes a minute and doesn’t need a card.

MCPmcp.comail.io/a/investor-relations

Ruleset for the investor-relations agent
Order	Permission	Policy	Applies to
1	view	deny	no-co:investor-relations
2	view	allow	co:investor-relations
3	view	deny	default
4	draft	allow	—
5	send	approval	—
6	modify	deny	—

MCPmcp.comail.io/a/internal-team

Ruleset for the internal-team agent
Order	Permission	Policy	Applies to
1	view	deny	no-co:internal-team
2	view	allow	co:internal-team
3	view	deny	default
4	draft	allow	—
5	send	deny	—
6	modify	allow	—

MCPmcp.comail.io/a/life-admin

Ruleset for the life-admin agent
Order	Permission	Policy	Applies to
1	view	deny	no-co:life-admin
2	view	allow	co:life-admin
3	view	deny	default
4	draft	allow	—
5	send	approval	—
6	modify	allow	—

Evaluated top to bottom, on every request. First match wins, so a no-co: label always beats a co: one.

Three agents on one mailbox. None of them can read the others’ mail.

Full inbox access is the wrong default.

Google’s OAuth scopes are all or nothing. The moment an agent can read your mail, it can read every thread in it — the term sheet, the diagnosis, the severance letter.

Contexts bleed

An agent that has read your board threads will draw on them when it writes to a vendor. Not maliciously — that’s just what a context window does. Separate scopes are the only reliable way to keep separate contexts separate.

Every email is untrusted input

Prompt injection arrives as ordinary mail, from anyone who knows your address. An agent confined to one label can only be steered inside that label, and can’t send anything you haven’t seen.

Revocation shouldn’t mean starting over

Narrowing an OAuth grant means a new consent screen and a new token. Taking a thread back from an agent is one label, removed from your phone, and it applies to that agent’s very next request.

How it works

Three steps, then the agent is boxed in.

1

Connect your mailbox

You authorize comail against your Google account once, from the web. comail becomes the only thing holding that grant — agents never see a Google credential, and never talk to Google directly. There is nothing to install in Gmail.
2

Create an agent and label its threads

Every agent gets two Gmail labels of its own. Start it blind and let co:agent-name hand it threads one at a time, or start it with the mailbox and take pieces away with no-co:agent-name. Apply the labels by hand, from a Gmail filter you already wrote, from the comail dashboard — or write a rule that matches a sender, a domain or one of your own labels, and let comail keep them applied.
3
Hand the agent its endpoint

Each agent gets its own MCP URL and its own key. Every tool call is checked against that agent’s ruleset before comail touches the Gmail API.
claude_desktop_config.json
```
{
  "mcpServers": {
    "inbox-investors": {
      "url": "https://mcp.comail.io/a/investor-relations",
      "headers": { "Authorization": "Bearer cml_live_7f3a…" }
    }
  }
}
```
Any MCP client works — Claude, Cursor, or an agent you wrote yourself.

Labels

The label is the permission.

Not a rule that stands in for one. Every agent owns two Gmail labels — co:agent-name hands it a thread, no-co:agent-name takes one away — and comail checks them on every single request. There is no policy engine hiding behind our UI to be wrong about.

Gmailin:inbox

Sequoia Capital Term sheet — redlines from counsel co:investor-relations
Gusto March payroll is ready to approve no agent
Ana — Engineering Week 12: what we shipped co:internal-team
Wilson Sonsini Re: board consent, execution copy no agent
United Airlines Your flight to SFO is confirmed co:life-admin
Dr. Okafor’s office Results are back — please call no agent

One mailbox, three agents. Search label:"co:investor-relations" in Gmail and you are looking at that agent’s entire world — on any device, without opening comail. Hide the label from your sidebar and message list and you will never see it again unless you go looking.

Allow-list an agent

Default it to deny and it starts blind. Every thread you put co:investor-relations on becomes visible to it, and nothing else exists. This is the right shape for most agents.

Or deny-list one

Default it to allow and it starts with the mailbox. no-co:triage removes a thread. Sometimes the list of things to withhold is far shorter than the list of things to share.

`no-co:` always wins

Put both labels on a thread and the agent is out. So a rule can label broadly on your behalf while you carve one thread back out by hand, from your phone, and nothing comail does will undo you.

Segmentation

Give each agent the smallest inbox that still works.

Six agents one founder might run at once, on the same mailbox. Five are allow-lists. One is a deny-list, because sometimes the shorter list is the one you withhold.

Fundraising

investor-relations

Drafts the monthly update and answers diligence questions. A filter labels everything from your investors; that label is all it can see. It has never met a payroll thread.

view	allow	co:investor-relations
view	deny	default
draft	allow	—
send	approval	—

Internal comms

internal-team

Summarizes what the team shipped this week. Board threads and anything from outside counsel never carry its label, so they are not merely filtered — they are absent.

view	allow	co:internal-team
view	deny	default
send	deny	—
modify	allow	—

Personal

life-admin

Books flights, files receipts, chases refunds. Cannot read a single work thread, so nothing personal ends up in a work context either.

view	allow	co:life-admin
view	deny	default
draft	allow	—
send	approval	—

Hiring

recruiting

Reads candidate threads and writes the reply. You still press send — drafts land in your Gmail like any other draft, flagged as the agent’s.

view	allow	co:recruiting
view	deny	default
draft	allow	—
send	deny	—

Finance

bookkeeping

Pulls invoices and receipts into the ledger. Strictly read-only, and only on the threads a Stripe filter has labelled for it.

view	allow	co:bookkeeping
view	deny	default
draft	deny	—
send	deny	—

Operations

triage

Sorts and labels the whole inbox, minus the parts that matter most. The only agent here that starts open — you take threads away from it rather than handing them over.

view	deny	no-co:triage
view	allow	default
draft	deny	—
modify	allow	—

Features

What an agent can do, and how you constrain it.

Permissions

Permission What the agent can do Scoped by Approval gate

view Search, list and read threads The agent’s own co: and no-co: labels, and its default policy for threads carrying neither —

draft Create and edit drafts, on threads it can already view Agent-wide default —

send Deliver mail from your address Agent-wide default Optional — hold every send for your review

modify Label, archive and mark messages read Agent-wide default Optional

Permission	What the agent can do	Scoped by	Approval gate
`view`	Search, list and read threads	The agent’s own `co:` and `no-co:` labels, and its default policy for threads carrying neither	—
`draft`	Create and edit drafts, on threads it can already view	Agent-wide default	—
`send`	Deliver mail from your address	Agent-wide default	Optional — hold every send for your review
`modify`	Label, archive and mark messages read	Agent-wide default	Optional

no-co: beats co:, and co: beats the default. Labels are read at the moment the agent asks, not at the moment the mail arrived, so a thread you unlabel is gone by the agent’s next call. An agent can never act on a thread it cannot view, so the label decides everything else too.

Where you control it

Capability Gmail itself Web dashboard Gmail add-on optional

Give an agent one thread, or take it back

Label threads automatically as they arrive Gmail filters comail rules

Hide an agent’s labels from your inbox

Add, suspend and revoke agents

Switch an agent between allow-list and deny-list

Set draft, send and modify defaults

Approve, edit or reject a pending send

Explain why an agent can or can’t see a thread

Audit log of every access decision Recent only

Billing and account

Because access is a Gmail label, Gmail is a first-class control surface: the thing you most often need to do — hand an agent a thread, or take one back — you can do from the app on your phone. The dashboard is for everything Gmail has no place to put. The add-on is optional, and only earns its keep once you want comail’s controls beside the thread you’re already reading.

Questions

Before you apply.

Do agents get my Google credentials?

No. comail holds the OAuth grant. Each agent authenticates to comail with its own key, and comail calls the Gmail API on its behalf — only within that agent’s rules. Rotate or revoke one agent’s key and the others are untouched.

Do I need the Gmail add-on?

No. Access is decided by Gmail labels, so the day-to-day work happens in Gmail and everything else lives in the web dashboard. The add-on is optional. It exists for the things that have to sit inside Gmail rather than beside it: the approval queue, a per-thread answer to “why can this agent see this?”, and internal messages between you and an agent on the thread you’re reading.

Does comail change my labels?

comail creates and maintains only co: and no-co: labels. Your own labels are read — a rule can match one — but never created, edited or deleted, unless you grant an agent modify, and then only on threads it can already view.

Won’t my label list turn into a mess?

Gmail lets you hide a label from the sidebar and from the message list independently. comail’s labels are hidden by default, so ten agents is ten labels you never see. Show one when you want to watch what that agent sees, then hide it again.

Which mailboxes are supported?

Gmail and Google Workspace, and nothing else during the beta. comail used to be a full mail client for any IMAP account; the relaunch is Gmail-first on purpose, because Gmail labels give you a permission model you already maintain.

Which agents can connect?

Anything that speaks the Model Context Protocol — Claude, Cursor, or an agent you built yourself. comail exposes a standard MCP server per agent identity, so there’s no comail-specific SDK to adopt.

Can an agent send mail as me?

Only if you allow it. Three settings cover most people: no sending at all; drafts only, where the agent writes and you press send; or sending allowed but every message held in an approval queue you clear from the dashboard.

What happens when I revoke an agent?

Its key stops working on the agent’s next request, and anything it had queued for approval is cancelled. Suspending is the reversible version of the same thing.

Pricing

$99 / month

per inbox · up to 10 agents

Early-bird rate for the private beta

Beta users keep $99/month after general launch, for as long as the subscription stays active.

Web dashboard, plus the optional Gmail add-on
A dedicated MCP endpoint and key per agent
Allow-list or deny-list per agent, by Gmail label
Rules that keep the labels applied for you
Approval queue for outbound mail
Audit log of every access decision

Billing starts when your inbox is provisioned. Cancel any time.

Request access

The beta is small and we onboard in batches. Tell us what you’d point an agent at — the more specific, the better your odds.