Email Intelligence: local-first knowledge for agent workflows

Email Intelligence turns local mail into a continuously enriched knowledge base. Maildir stays the immutable source of truth. SQLite stores metadata, full-text search, embeddings, action items, facts, drafts, and append-only events. Agents query it through MCP.

The important distinction is level of abstraction. Agents should not only search messages. They should find decisions, waiting replies, open tasks, sender context, related threads, and safe draft workflows.

Design

Maildir stays the immutable source of truth. SQLite holds the enriched knowledge store — metadata, FTS5 full-text search, embeddings via sqlite-vec, action items, drafts, and an append-only event feed — and agents reach it through a narrow MCP tool surface. Outgoing mail is draft-first with allowlist-guarded sending, so every write-back is reviewable by default.

Why I built it

Email is full of operational knowledge, but most automation treats it as a mailbox API. That forces every agent to rediscover context from raw messages. The platform makes email state queryable, enriched, and writable without sending private data to a hosted inbox product.

What to inspect

• Maildir ingestion into SQLite with FTS5 and vector search.
• LLM enrichment for summaries, facts, entities, decisions, and action items.
• Append-only event feed for reactive agents.
• Draft-first outgoing mail and allowlist-guarded sending.
• Prompt-injection and untrusted-content guardrails.

Evidence

The evidence is the public repository: ingestion, enrichment, event-feed, and write-back behavior are covered by tests and CI checks, and the security posture — prompt-injection handling, untrusted-content guardrails, allowlist-guarded sending — is documented rather than implied. The platform is in active development, so the honest read is to inspect the repo and its decision record, not a launch announcement.

Boundary

Local-first is the hard edge: no hosted inbox, no third-party data flow. It is not a mail client and not an autonomous sender — drafts wait for review and sending is confined to an explicit allowlist. Enrichment quality still depends on the model you point it at; the platform guarantees structure and auditability, not model judgment.

Why it belongs here

This is a practical example of agent infrastructure that respects local control, auditability, and security. It combines retrieval, enrichment, write-back, and operational safety in one inspectable system.