Mail for ChatGPT

Inspiration

Small accounting and bookkeeping firms live in email. A client asks, “What are we still waiting on?” and the answer is often buried across months of threads, attachments, promises, and follow-ups.

ChatGPT is already where many founders think and write, but the existing mailbox integrations mostly assume Google or Microsoft. That leaves custom-domain mailboxes on Hostinger, Zoho, Namecheap, cPanel, Fastmail, and other IMAP providers outside the workflow.

Mail for ChatGPT closes that gap.

What it does

Mail for ChatGPT connects a business mailbox to ChatGPT without forcing the user to adopt another inbox.

From a normal ChatGPT conversation, a user can:

search recent or full mailbox history in plain language; open exact emails and reconstruct threads with visible sources; surface commitments, deadlines, missing documents, and unanswered questions; mark messages read or unread and move supported messages; draft a grounded reply using the full thread; send only after explicit user review and approval.

The web app is deliberately a control plane, not another email client. It handles onboarding, multiple mailboxes, permissions, connection health, privacy controls, cache clearing, and disconnecting. ChatGPT remains the primary working interface.

How we built it

The product is a TypeScript application built around a secure OAuth-protected MCP server:

OpenAI Apps SDK / MCP for the ChatGPT integration and tool contracts Next.js 16 + React 19 + Tailwind CSS for the marketing site and mailbox control plane Clerk for email-only authentication and OAuth authorization Convex for the application data model, authorization, rate limits, and short-lived metadata cache ImapFlow + MailParser for standards-based IMAP search, retrieval, and MIME parsing Nodemailer / SMTP for verified, explicitly approved replies Vercel for the production deployment

Mailbox credentials are encrypted at the application layer. Full message bodies are retrieved on demand and are not persisted by default. Cached metadata and derived findings expire after 24 hours, and users can clear cached data or delete credentials immediately by disconnecting.

How Codex and GPT-5.6 were used

I built Mail for ChatGPT as a solo developer with Codex and GPT-5.6 as my engineering partner.

We used a spec-driven workflow: PRD, system design, security model, UI guidelines, competitive capability plan, vertical-slice specs, implementation, tests, and end-to-end verification. Codex accelerated the work that would otherwise be difficult for a one-person team in a week:

translating the privacy requirements into an encrypted credential boundary and a minimal-retention data model; designing strict MCP schemas, OAuth discovery, impact annotations, and capability checks; implementing provider-aware IMAP and SMTP adapters with SSRF and TLS safeguards; building permission-gated read, organize, and reply actions; generating contract tests, mailbox fixtures, golden prompts, and failure-path tests; iterating on the production UI, accessibility, navigation, deployment, and domain configuration.

Key product and security decisions remained explicit: ChatGPT is the workspace, the web app is the control plane, reads are enabled by default, mailbox writes are opt-in, and every send requires review.

GPT-5.6 is also the reasoning layer in the ChatGPT experience: it turns bounded mailbox tools and exact source data into useful, grounded answers while keeping the underlying evidence visible.

Challenges

The hardest part was not merely reading email—it was making generic IMAP safe and dependable across providers while preserving a clear trust boundary.

We had to solve:

dynamic OAuth between ChatGPT, Clerk, and the MCP resource server; provider differences in folders, archive behavior, SMTP, and sent-copy handling; bounded full-history search without dumping an inbox into model context; exact-message and thread retrieval with safe text budgets; idempotent sending and permission checks that prevent accidental writes; a privacy model that is easy to understand, not just technically correct.

Accomplishments that we're proud of

A working end-to-end ChatGPT app for custom-domain IMAP mailboxes Full-history search plus exact email and thread retrieval Source-grounded answers instead of vague mailbox summaries Optional organize and reply permissions with explicit review before sending Multi-mailbox control, provider presets, and editable connection settings Application-layer credential encryption and 24-hour cache retention Immediate cache clearing and credential deletion on disconnect A polished production experience designed to WCAG 2.2 AA

What we learned

Email portability is not only a connector problem; it is a permissions, protocol, identity, and trust-design problem.

The strongest experience came from giving GPT-5.6 small, accurate tools rather than broad mailbox access. Once the tool boundaries, source identifiers, and impact annotations were right, ChatGPT could do the higher-level reasoning while the application stayed deterministic and auditable.

What's next

Next we would add attachment retrieval, shared mailboxes, team-level permissions, richer audit trails, broader provider certification, and App Directory distribution. The product direction stays the same: keep the mailbox where it is, and bring the useful context to the place the user already works.

Built With

• clerk
• codex
• convex
• gpt-5.6
• imapflow
• mailparser
• mcp
• next.js
• nodemailer
• openai-apps-sdk
• react
• tailwind-css
• typescript
• vercel