AI email assistant review
MailFlow review
Open sourceBest for: Privacy-conscious self-hosters and homelab users who want one modern web interface across several existing mailboxes, plus user-invoked AI features backed by a model endpoint they choose.
Our review
The full take on MailFlow
MailFlow is the open-source maathimself/mailflow project: a Docker-hosted unified webmail app for Gmail, Outlook, iCloud, Fastmail, and other IMAP/SMTP accounts, with an optional AI assistant that can summarize threads, draft or rewrite replies, answer questions about a message, and reclassify mail. It is best suited to technically comfortable users who want a modern multi-account webmail interface and control over both hosting and the AI endpoint. It is not a turnkey autonomous inbox agent: users must operate the server and configure an OpenAI-compatible provider, and current first-party evidence does not establish proactive bulk triage, learned personal style, follow-up automation, or automatic sending.
Features and fit
What MailFlow does
Summarize threads; generate a reply from a short prompt; rewrite an existing draft for tone and length; answer questions grounded in the selected message; and invoke AI to correct a message category. MailFlow accepts a local or cloud endpoint that implements the OpenAI API, including Ollama, LM Studio, OpenAI, or a compatible gateway, and also documents a ChatGPT Codex subscription connection in its repository README.
Product type
Self-hosted, open-source unified webmail application delivered through Docker; usable as an installable PWA. It is a mail client/aggregator, not an email-hosting or mail-delivery provider.
Email and platform support
Gmail over IMAP with a Google App Password; iCloud Mail with an App-Specific Password; Microsoft 365 work/school accounts through OAuth2 and Azure App Registration; personal Outlook.com/Hotmail through OAuth2 device-code flow and an Azure App Registration; Fastmail and any standard IMAP/SMTP server through custom settings.
Canonical identity
mailflow.sh and github.com/maathimself/mailflow. Always use the .sh domain or repository owner when naming it because several unrelated email products also use “MailFlow.”
Non-AI email capabilities
Unified inbox, multi-account search, real-time IMAP sync, threads, rich-text compose, snooze, inbox rules, block list, one-click unsubscribe, contact autocomplete, CardDAV, Todoist, optional GTD folders, 2FA, SSO/OIDC, and push notifications.
Pricing
Plans and cost
Personal self-hosting and open-source use are offered under AGPL-3.0 with all features and unlimited accounts. A separate commercial license is listed at $500 per installation, one time, for deployments that do not want to comply with AGPL obligations. A fully hosted MailFlow service is only a waitlist on the reviewed homepage, with no public hosted price.
Free plan or trial
There is no hosted free plan or SaaS trial to evaluate. The self-hosted AGPL edition is free to download and run, but infrastructure and any cloud AI-model usage are separate user costs.
Privacy and security
What happens to your email data
The software runs on the user's server, and the vendor says it cannot access a self-hosted instance's email accounts, messages, or passwords. First-party documentation says credentials are encrypted at rest with the deployment's ENCRYPTIONKEY, PostgreSQL and Redis are not exposed by default, login and registration are rate-limited, session cookies are HttpOnly/SameSite=Lax, TOTP is supported, and HTML email is sanitized. For AI actions, selected mail content is sent to the AI provider the user configures; using a cloud endpoint therefore means that content leaves the MailFlow server and is governed by that provider's terms. The broad homepage statement that mail “stays on your server” must not be repeated without this AI-provider qualifier.
Security certifications and data-handling commitments are attributed to the vendor unless the supporting audit artifact was independently reviewed.
Independent signal
What users are saying
The strongest current positive signal is that self-hosters like the modern UI and multi-provider aggregation. The strongest concern is whether a very young, contributor-concentrated, heavily AI-assisted project is mature enough for a security-sensitive email workload. GitHub activity is much stronger than the discussion volume: v2.3.1 through v2.9.0 produced nine releases in the window, and v2.9.0 addressed concrete IMAP, self-hosting, and dependency issues.
Moderate for current maintenance; weak-to-moderate for independent named-product sentiment; no meaningful recent evidence specifically evaluating the AI assistant's output quality.
2026-07-10 through 2026-08-09.
A current self-hoster said they “REALLY like it so far,” while another participant immediately asked which same-named Mailflow product was meant and questioned the project's AI-assisted development history.
Direct recent use signal plus unusually clear evidence that the brand name is ambiguous. The discussion is small and cannot establish broad satisfaction.
A poster praised the interface, any-provider compatibility, and emerging outside contributions, while commenters questioned trusting a young, heavily AI-assisted codebase with sensitive email.
Captures the central tradeoff: attractive open-source control versus security and maintainer-maturity concerns. The criticism is community opinion, not a reported vulnerability or audit finding.
A parallel post asked developers to contribute and described the UI positively.
Corroborates early community interest but is effectively cross-posted advocacy, not an independent second review.
Trendshift recorded the repository as a self-hosted AGPL project with six contributors and recent social mentions. Its cached counts lagged GitHub.
Confirms discovery momentum, but GitHub is the canonical source for live repository metrics.
Limitations
What to know before choosing MailFlow
- Severe name collision: mailflow.sh is distinct from mailflowai.com (hosted AI drafts for Gmail support teams), mail-flow.app (beta AI inbox-automation SaaS), PitchQuill's MailFlow cold-email product, Chrome extensions named easy MailFlow and MailFlow Pro, and older Visnetic MailFlow software. Directory titles, slugs, metadata, and research queries must use MailFlow (mailflow.sh) or maathimself MailFlow where ambiguity matters.
- The repository was less than four months old when reviewed. Release velocity is high, but longevity and production stability are not yet proven.
- Contribution history is concentrated in one maintainer. There are meaningful outside contributors, but the project remains exposed to maintainer availability and bus-factor risk.
- Community concern about AI-assisted code is not proof of a vulnerability, but it raises the standard for independent review because this application stores credentials and processes sensitive email. No independent penetration test, security audit, SOC 2 report, or formal security program was found.
- Marketing copy says email stays on the user's server, while the AI documentation correctly states that message content goes to the configured provider. Public directory copy must explain the local-provider versus cloud-provider difference.
- The homepage and repository can drift. For example, the homepage roadmap described desktop apps as future work while v2.9.0 release notes already discussed Linux desktop update behavior. Prefer release notes and documentation for shipped-state claims.
- “Free for personal use” marketing language should not be paraphrased as a general ban on commercial AGPL use. The source repository offers AGPL-3.0 plus a paid alternative license for users who do not want AGPL obligations; licensing interpretations should be reviewed by counsel rather than inferred editorially.
- The fully hosted version is not launched, so it should not be represented as available or assigned an expected price.
- There is no current independent evidence about AI reply accuracy, hallucination rate, tone quality, latency, provider compatibility in practice, or time savings.
- The directory owner also builds Inbox Zero, a potential comparison product. Any ranking or comparison involving MailFlow and Inbox Zero needs a visible ownership/conflict disclosure.
- No affiliate program or paid relationship with MailFlow was found. Recheck before monetizing outbound links.
Evidence
Sources behind this review
Product facts come from current first-party pages. Independent and community sources are used for context—not as proof of every product claim.
MailFlow is a self-hosted unified webmail client for Gmail, iCloud, Outlook, Fastmail, and any IMAP account.
The AI assistant summarizes threads, drafts and rewrites replies, answers questions about a selected message, and connects to a local or cloud OpenAI-compatible endpoint.
Gmail uses an App Password, iCloud uses an App-Specific Password, Microsoft accounts use OAuth2, and custom IMAP/SMTP is supported.
The application runs in Docker and uses PostgreSQL and Redis; production operators are responsible for secrets, HTTPS, backups, registration, and hardening.
Personal/open-source self-hosting is available under AGPL-3.0; the alternative commercial license is $500 per installation.
The website has no analytics or tracking cookies; the vendor says it has no access to data inside self-hosted MailFlow deployments.
v2.9.0 fixed an IMAP-timeout backend crash, private SMTP relay handling, a Docker/Caddy configuration error, Linux update handoff, and dependency advisories.
The live repository showed 334 stars, 23 forks, 695 commits, 17 open issues, and 14 open pull requests and was not archived.