New mail surfaces in your running Claude Code session the moment it arrives — as a <channel source="agentic-email"> event — and you reply in-thread, with attachments and inline images. It's the email sibling of the Telegram channel: instead of going to check an inbox, the inbox comes to you.
┌─────────────┐ poll (CF Access) ┌──────────────────┐ <channel> event ┌──────────────┐
│ agentic- │ ◀────────────────── │ claude-agentic- │ ─────────────────▶ │ Claude Code │
│ inbox │ ──────────────────▶ │ email (this) │ ◀───── reply ───── │ session │
└─────────────┘ mail + replies └──────────────────┘ └──────────────┘
✨ Features
- 📥 Inbound — new mail lands in-session within seconds. Attachments are downloaded to disk and surfaced as paths, so the model can open and read them.
- 📤 Outbound — reply in-thread with the
reply tool. Send downloadable file attachments (files) and embed images/GIFs inline in the body via hosted URLs (image_urls).
- 🔁 Session-bound & no-replay — events arrive only while Claude Code is open, and existing inbox mail is marked seen at launch (no replay storm on restart).
- 🛡️ Injection-aware — email is treated as untrusted data, never as instructions.
⚙️ How it works
- Listening — the channel polls the mailbox via the agentic-inbox REST API every
EMAIL_POLL_INTERVAL seconds (default 20), authenticated through Cloudflare Access with a service token. Self-contained — no tunnel or webhook required.
- Replying — the
reply tool POSTs through the same API. Pass email_id from the inbound <channel> block and the subject + threading headers are filled in automatically.
🔐 Security
Email content is untrusted input. The body is relayed as channel data, never as instructions, and the channel tells the model to refuse acting on commands embedded in email (forwarding, payments, settings, secrets) without the operator's say-so from the terminal. Sender-controlled strings that land in the <channel> meta are sanitized so they can't forge tag attributes. Inbound attachments are likewise untrusted data.
📋 Prerequisites
- An agentic-inbox deployment with a mailbox, fronted by Cloudflare Access with a service token for non-interactive API auth.
- For sending: the domain onboarded to Cloudflare Email Service → Email Sending (DKIM + SPF on
cf-bounce, plus a _dmarc record). Without proper authentication, strict providers — notably Microsoft/Outlook — silently drop mail.
- Bun installed.
🚀 Setup
1. Configure. Copy .env.example to ~/.claude/channels/agentic-email/.env and fill it in, or run the helper:
AGENTIC_INBOX_BASE=https://inbox.example.com \
[email protected] \
CF_ACCESS_CLIENT_ID=xxx CF_ACCESS_CLIENT_SECRET=yyy \
bash install.sh
[!NOTE]
The .env is written mode 600 — it holds a secret.
2. Register this directory as a plugin marketplace (one time). The marketplace is named claude-agentic-email (see .claude-plugin/marketplace.json):
claude plugin marketplace add /path/to/claude-agentic-email
3. Launch Claude Code with the channel. Custom channels aren't on the preview allowlist, so the dev flag is required (it only skips the allowlist):
claude --dangerously-load-development-channels plugin:agentic-email@claude-agentic-email
🔧 Configuration
All settings come from environment variables (or the .env above — real env wins).
