Features in plain language

Everything you can do—and exactly where the edges are.

The CLI, your scripts, and MCP agents all call one typed application core, so every capability below works the same way everywhere. What each account can actually do depends on its provider route—check yours first—and any missing capability is reported explicitly instead of being hidden or emulated.

Set it up in four steps How these claims are backed

Across your accounts

Mail and calendars, without merging your identities.

Reads span every account you connect while keeping each result's account, provider, and time-zone provenance. Writes are deliberately different: each one targets exactly one account and consequential effects are previewed first.

Mail

Metadata comes first: lists and searches never include bodies or attachments, which are separate, explicit, bounded reads.

Search one account or all of them, with explicit partial-failure reporting
List folders and messages; read a body or one attachment on request
Save drafts that can never send themselves
Send, reply, reply-all, and forward—text or HTML, bounded file attachments
Move messages, set read state, and—where the provider reports support—permanently delete, each with a review

Every write is attempted exactly once. An unknown remote outcome is reported for reconciliation, never retried automatically.

Calendar and agenda

One agenda projection across every account, with original calendars, time zones, and provider provenance attached to each event.

Discover selectable calendars per account
List bounded windows or one cross-account agenda
Create, update, and cancel events with preview → commit
Supported recurrence creation, replacement, and removal
Required and optional attendees, with the route's notification behavior named in the review
Meeting links only where native: Teams on Microsoft routes, Google Meet when the calendar advertises it

Agents and automation

The same core for AI agents and your scripts.

Nothing here is a second implementation. MCP tools and --json output call the identical use cases and pass the identical policy checks as the interactive CLI.

For AI agents, over local stdio

Corresync exposes 43 narrow, typed tools and two read-only monitor resources. There is no HTTP, SSE, remote endpoint, or hosted relay.

Metadata-first tools with per-account provenance in every result
Preview and commit are separate tools for every consequential write
Account lifecycle and everyday settings use preview → commit pairs too
Agents can add, rename, and remove accounts through those lifecycle tools
Signing in, enabling monitoring, approving a runner or remote egress, purging queues, imports, and binary updates stay CLI-only human actions
Tool annotations inform client UX but never replace server-side policy

Connect your client — Codex, Claude Code, GitHub Copilot CLI, Gemini CLI, Qwen Code, Qoder, Kimi Code CLI, or any stdio MCP client.

For scripts, with stable JSON

Add --json to a command and it emits exactly one unstyled JSON value on stdout—same isolation, bounds, and preview rules as everywhere else.

corr mail search --all-accounts \
    --query 'subject:"quarterly plan"' --json

The same account isolation, bounds, and preview rules apply to every JSON response.

On your machine, on your terms

Local capabilities you switch on deliberately.

Read-only import staging

Inspect one explicitly approved local source—recognized archives and exports, a Maildir tree, or a Thunderbird profile—into bounded account-local staging.

Nothing is scanned until you re-run with the explicit read approval
Never authenticates, uploads, sends, or mutates the source
Purge removes only Corresync-owned staging, never your files

Opt-in monitoring

Monitoring starts off for every account and advances one consent boundary at a time: off → local notification → durable queue → one approved runner.

Quiet hours, debounce, hourly limits, deduplication, and a circuit breaker
Desktop notifications use local tools on Linux and macOS; on Windows they are unavailable (no registered AppUserModelID), while queue and runner modes work
The runner is one absolute executable, invoked without a shell, fed bounded JSON; remote egress is a separate explicit approval

Privacy-preserving feedback

corr feedback builds a redacted, allowlisted report locally—build, platform, install method, config validity, aggregate capabilities, and optionally a sanitized error class.

Addresses, credentials, content, queries, and private paths are excluded by construction
Generation makes no network request
Copying, saving, or opening a prefilled GitHub page each require an explicit flag; that manual flow never submits
A separate default-off choice may submit a smaller allowlist-only public issue through your authenticated GitHub CLI after an interactive failure

Common questions

Answers before you install anything.

Will it work with my accounts?

Outlook Web, Microsoft Graph, Todoist, TickTick, JMAP, IMAP/SMTP, and CalDAV routes are available now; Gmail, Google Calendar, and Google Tasks use a Desktop OAuth client in a Google Cloud project you control. You pick mail and calendar routes independently per account, and any degradation is explicit. The optional private compatibility checker sends only the domain after the @, or you can skip it and discover locally after installation.

Does it cost anything?

No. Corresync is open source under the Apache-2.0 license. You bring the accounts you already have. Microsoft Graph needs a public OAuth client you are authorized to use; Google needs your own Desktop OAuth client. Corresync-managed Google OAuth stays dormant.

Where does my mail live?

With your provider, as before. Corresync runs entirely on your machine—there is no hosted relay and no cloud copy. Local state such as cursors, staging, queues, and pending previews stays in local, account-isolated storage.

Can an AI agent send something without me?

A consequential write first returns a review of the exact effect. Committing requires that exact reviewed payload; approval is short-lived, single-use, and bound to the caller, account, target, and content. Read the safety model.

Does Corresync phone home?

There is no telemetry pipeline or raw crash upload. An interactive CLI may quietly check for a newer public release—sending only the Corresync version string, cached for 24 hours, disabled for MCP, pipes, and JSON output—and you can turn that off in configuration. A separate default-off feedback choice can use your authenticated GitHub CLI to post a small allowlist-only public issue after an interactive failure. Standalone installs can also opt in to verified automatic updates or signed preview releases; package catalogs remain stable-only and Corresync never mixes installation ownership.

What if a send fails halfway?

Every write is attempted once. If the provider may have changed remote state but confirmation failed, Corresync stops and reports reconciliation instead of risking a duplicate through an automatic retry.

Honest limits

What Corresync deliberately does not do.

Per-account differences—like a JMAP server without submission or an IMAP server without UIDPLUS—surface as typed capabilities and degradations, never as silent fallback to another route.

Google connections require your own OAuth client. Guided setup validates a downloaded Desktop client and keeps its credential and each account grant in the OS keyring. Follow the illustrated guide.
No token relay. Microsoft Graph uses a public client you register and are authorized to use.
Teams chat and channels are not enabled in this release. Their implementation remains behind release evidence gates. Calls, recordings, presence, and meeting lifecycle management remain out of scope.
No mailbox-rule or delegate-permission management, generic provider property access, or arbitrary provider actions.
No unattended login, tenant-wide access, or TLS interception. Sign-in stays visible and provider-owned.
No Windows desktop notifications yet—queue and approved runner modes remain available.

Claims follow evidence

How compatibility is stated—and what it is not.

Every v0.8 provider route ships with deterministic synthetic provider-contract and application coverage. That is a strong statement about the implementation—and a deliberately limited one. Google authorization and bounded reads now have one commit-bound macOS arm64 observation; Google writes and other routes remain live-unobserved until a separately authorized, content-free observation is recorded against the exact Corresync commit, provider route, and platform.

A missing observation is never reported as a pass, and default tests and CI never activate a live mailbox or calendar. Check the current evidence before connecting an account you consider sensitive.

See the safety boundaries behind every provider route.

Try it on your own accounts

Four clear steps from install to a cross-account answer.

Install with one command, sign in visibly, and connect the agent you already use.

Follow getting started Choose your provider route