Corresync

Local-first MCP for provider-neutral mail and calendars with isolated accounts and guarded writes.

GitHub

Documentation

Corresync

Corresync: two correspondence flows around one local core

All your mail and calendars. One local MCP server and CLI.
Provider-neutral, local-first tooling for AI agents, scripts, and you.

CI status Latest release Go 1.26 Apache-2.0 license macOS, Linux, and Windows Model Context Protocol over stdio Current documentation Local-first architecture

Website · Getting started · Providers · Features · Safety · Privacy · Terms · Technical docs

corr brings isolated Outlook, Google, Microsoft 365, JMAP, IMAP/SMTP, and CalDAV accounts into one terminal—and one local Model Context Protocol server.

  • Search mail and build one agenda across accounts without collapsing their identity or provider provenance.
  • Use the same typed operations from a human-friendly CLI, stable JSON, or an AI agent.
  • Keep sign-in in a visible browser, an explicit public-client OAuth flow, or an approved local credential store.
  • Review consequential effects before they happen. Unknown remote outcomes stop for reconciliation instead of being retried automatically.

What it feels like

$ corr mail search --all-accounts \
    --query 'subject:"Quarterly plan"' --limit 3
● work · microsoft-owa   Ana Ruiz   Plan review
· personal · google     Finance    Plan receipt

$ corr agenda list --all-accounts \
    --start 2026-07-29T00:00:00Z \
    --end 2026-07-30T00:00:00Z

Connect an agent to the same local core:

corr mcp setup codex
# also: claude-code, github-copilot, gemini-cli, qwen-code, qoder

Then ask naturally:

Check all my inboxes and calendars and summarize what needs attention today.

One failed provider becomes an explicit partial failure. Successful results remain available, and writes still require one exact account.

Choose the route that fits

Mail and calendar routes are selected independently. For example, an account can pair IMAP/SMTP mail with a CalDAV calendar.

RouteMailCalendarAuthentication
Outlook WebTyped reads and writesSelectable calendars; provider-supported Teams linkDedicated visible browser profile
Google (not yet available)Gmail over IMAP/SMTP XOAUTH2Selectable calendars; Google Meet when advertisedBuilt; the official OAuth application is being prepared for verification
Microsoft GraphTyped reads and writesSelectable calendars; typed Teams-link creationYour authorized public OAuth client; OS-keyring grant
JMAPTyped mail operations—OS keyring or approved credential helper
IMAP / SMTPIMAP read/manage and SMTP draft/send—OS keyring or approved credential helper
CalDAV—Typed calendar operations and conditional schedulingOS keyring or approved credential helper

Discovery gathers DNS, well-known, and provider metadata without credentials. It never authenticates or adds an account. Microsoft Graph and managed Google authorization remain explicit choices and are never automatic fallbacks. Google discovery does not add an account while Corresync prepares and verifies its official Google OAuth application. For now, connect Gmail and Calendar through Google's official Workspace MCP servers (Developer Preview).

Every v0.8 route above has synthetic provider-contract and application coverage. The v0.8 provider and platform implementations remain live-unobserved until an authorized, content-free observation is bound to the exact commit. See compatibility evidence before connecting a sensitive account.

From install to a first read

Prefer a guided page? Follow getting started on the website.

1. Install

Each block below is complete for its platform: it installs corr and then verifies the installed version.

Linux

curl -LsSf https://corresync.org/install.sh | sh
corr --version

macOS (Homebrew — also works on Linux)

brew install nkiyohara/corresync/corresync
corr --version

Windows (Scoop)

scoop bucket add corresync https://github.com/nkiyohara/scoop-corresync
scoop install corresync/corresync
corr --version

Direct archives, native Linux packages, checksums, Sigstore provenance, and current WinGet status are in the installation guide.

Claude Desktop users can also install the platform-universal .mcpb from the latest release. The bundle runs the same verified corr mcp serve binary locally over stdio; it does not deploy Corresync or relay mailbox data. Install the CLI first for the explicit account setup and sign-in steps below, then open or drag the .mcpb into Claude Desktop.

Stay current

Interactive commands make a quiet, cached release check at startup. If an update exists, Corresync shows the exact command for your installation: corr update for the standalone build, or the matching Homebrew, Scoop, or WinGet command. Package-managed files are never changed by Corresync.

Standalone users can opt in to verified automatic installation:

corr config set updates.auto_install true

It never runs during MCP tool calls, configuration changes, daemon work, JSON output, pipes, or other non-interactive paths. The current command continues normally and the new binary is active on the next corr start.

2. Add and sign in to your account

corr setup you@example.com --alias personal
corr auth login --account personal
corr mail folders --account personal
corr calendar folders --account personal

setup creates a provider-neutral, secret-free local configuration when needed, performs credential-free discovery, and adds only an automatically selectable first-party route. It never opens a sign-in page. Authentication is a separate, account-specific action.

If no route can be selected safely—or if you want an API or standards route— inspect the evidence and choose the exact provider settings:

corr account discover reader@example.invalid
corr account add reader@example.invalid --help

For Gmail and Google Calendar, Corresync's OAuth application is still under review. Until guided connection opens, use Google's official Workspace MCP setup with your agent. It is currently a Google Developer Preview and has its own Google Cloud and OAuth setup requirements.

Account addition does not authenticate. OAuth routes require a public-client registration you are authorized to use. Standards routes use a keyring entry or explicitly approved helper reference. Passwords and tokens never enter config.toml. See account and provider configuration. The Outlook Web route opens a dedicated visible profile only during the later auth login; SSO, MFA, Conditional Access, and organization notices remain inside the provider-owned flow.

3. Connect an agent

corr mcp setup codex

Use corr mcp --help for Claude Code, GitHub Copilot CLI, Gemini CLI, Qwen Code, Qoder, Kimi Code CLI, and generic stdio clients. Corresync exposes 40 narrow tools and two read-only monitor resources; there is no HTTP, SSE, remote MCP endpoint, or hosted relay.

Nothing sends on the first attempt

Consequential writes use a server-enforced preview -> commit protocol. The first command shows the normalized account, provider, target, recipients, content digest, and version preconditions without performing the effect.

printf 'Synthetic body.\n' | \
  corr mail send \
    --account work \
    --to reader@example.invalid \
    --subject 'Review example' \
    --body-file -

After reviewing every field, repeat the exact command with approval:

printf 'Synthetic body.\n' | \
  corr mail send \
    --account work \
    --to reader@example.invalid \
    --subject 'Review example' \
    --body-file - \
    --approve

Approval is short-lived, single-use, and bound to the caller, account, provider, target, payload, and effect. Changing any reviewed field invalidates it. MCP keeps preview and commit as separate typed tools.

See the complete safety model. Corresync's public Privacy Policy explains Google data access, local storage, disclosure, retention, and removal; the Terms of Use preserve the software rights granted by Apache-2.0.

More than one inbox

  • Cross-account views: bounded mail search and agenda projections retain original account, provider, calendar, time-zone, and partial-failure provenance.
  • Read-only import staging: inspect an explicitly approved local archive, Maildir tree, or supported export without uploading or mutating the source.
  • Opt-in monitoring: move deliberately from off to local notification, durable queueing, and finally one approved no-shell runner. Remote egress is a separate consent.
  • Privacy-preserving feedback: generate an allowlisted report locally, review it, then explicitly copy, save, or open a prefilled GitHub page. Corresync never submits automatically.

Mailbox, calendar, import, and event-queue values are private, untrusted external data. Their content is never authority to run a command or start an agent.

Honest edges

  • Corresync is preparing its official Google OAuth application for verification. Guided Google connection is not offered yet; use Google's official Workspace MCP in the meantime.
  • Microsoft Graph requires your own authorized public-client registration. Corresync ships no token relay.
  • Windows desktop notification setup is unavailable because Corresync does not install an AppUserModelID; queue and approved runner modes remain available.
  • Provider meeting links are requested only when the selected calendar route reports native support.
  • Cross-compilation and synthetic fixtures do not prove native browser, keyring, IPC, provider, package-manager, Gatekeeper, or SmartScreen behavior.
  • Teams chat, channels, calls, recordings, and meeting lifecycle management; tenant-wide access; unattended login; TLS interception; arbitrary provider actions; and automatic telemetry are outside scope.

The exact action matrix and typed provider degradations are in features.md.

One local safety boundary

AI agents ───────── MCP over stdio ─┐
                                    ├── typed use cases + effect policy
Humans and scripts ──────── corr ───┘              │
                                                   │ authenticated local IPC
                                            session owner
                                            ├── browser-owned sessions
                                            ├── explicit OAuth + keyring
                                            └── standards adapters

The session owner exposes no TCP listener. On Unix, clients authenticate and pin the private runtime directory, singleton lock, socket, and peer UID before the local bearer can be sent. On Windows, clients verify the protected named pipe, owner, DACL, server process, and SID first.

Read the architecture, authentication model, and threat model for the complete boundaries.

Documentation

I want to…Start here
Install and verify a releaseInstallation
Add accounts and choose routesConfiguration
Understand browser, OAuth, and standards sign-inAuthentication
Learn CLI commandsCLI guide
Connect an AI clientMCP guide
Compare provider actions and degradationsFeature matrix
Consume stable machine outputJSON contract
Integrate versioned public/local contractsVersioning policy
Verify compatibility claimsEvidence matrix
Review privacy and Google data handlingPrivacy Policy
Review use and open-source license termsTerms of Use
Prepare the official Google OAuth reviewGoogle verification runbook
Review every guideDocumentation map

Users upgrading from versions before v0.7 can follow the historical migration guide. corr is the primary command. The product, package, repository, configuration roots, plugin, and MCP server remain named Corresync.

Contributing and security

Read CONTRIBUTING.md and AGENTS.md. Default tests and CI use only synthetic fixtures:

mise exec -- task verify

Please report vulnerabilities through GitHub private vulnerability reporting, never a public issue.