Box Ox
Website · Screenshots · Setup guide · API reference
Box Ox is a mail client and transactional email API that you install in your own Cloudflare account.
One installation serves your domains, people, and agents. Cloudflare Email Service handles sending and receiving.
A Worker serves the React app, with D1 metadata, R2 mail storage, and Cloudflare Access sign-in.
It includes threaded mail, compose and scheduled sends, labels, spam and phishing checks, search, and developer tools.
Optional AI adds classification, priority and category views, summaries, and reply suggestions.
Agents connect through OAuth/MCP or the grant-limited agent API.
Current release: 2.4.9 — a security release that requires a patched Node.js and clears high-severity zod, undici, and body-parser advisories. See the release notes. CLI 0.3.0 and email skill 0.5.0 are described in the tools release notes.
Deploy with the Cloudflare button
| Profile | Deploy in your Cloudflare account |
|---|
| Free inbox: receiving, keyword search, and mail-reading agents | |
| Paid: adds sending, optional AI, semantic search, and browser features | |
If your account uses Workers Free, choose Free inbox. R2 must be activated, and account quotas apply.
After deployment, follow the Cloudflare button guide for the build-token permissions, Access, and domain steps.
Leave the Node.js version setting in Workers Builds unset. The build reads .nvmrc.
Install from source
Requirements:
- Node.js 22.23.4, 24.22.1, or 26.12.1 or newer on those lines. Odd-numbered lines such as 25 are unsupported.
pnpm install stops on an unpatched version.
- pnpm 10.25.0, Git, and Bash (use WSL on Windows).
- A Cloudflare account with R2 activated and Cloudflare Access. Workers Free runs the inbox profile; Workers Paid runs the full profile.
- A domain on Cloudflare DNS for mail. The app can run on workers.dev before you connect one.
- Require two-factor sign-in on Cloudflare and GitHub. Use security keys where possible.
Follow the setup guide for the full procedure:
- Clone this repository, or download and review a source release from boxox.dev/downloads and verify its checksum. If you use a ZIP, initialize and commit a local Git repository as the setup guide describes.
- Run
pnpm install --frozen-lockfile and pnpm exec wrangler login.
- Set
CF_ACCOUNT_ID and OWNER_EMAIL. Leave BOXOX_URL unset for the workers.dev address, or set it to your custom HTTPS origin.
- Run
pnpm run deploy from a clean checkout. (pnpm deploy is a different pnpm command.)
- Configure Cloudflare Access and its public-path exceptions.
- Set the setup token, open
/setup, and review every DNS and processing choice. See the token template and permission checklist.
- Test sending, receiving, delivery events, and grants. A successful
/health response does not prove mail delivery.
- Remove
CF_API_TOKEN after setup.
Receiving moves the domain's mail to Box Ox. Enabling Email Routing can replace existing MX records. The setup wizard shows them and asks before replacing another mail provider.
To update, follow the upgrade guide: rerun the installer from the newer source with the same settings.
To remove an installation, follow the uninstall guide.
Prefer reviewed signed release tags over main when they are available. Current releases are unsigned: published SHA-256 checksums confirm the download is unchanged, not who published it. Review changes before deploying them.
Sending restrictions and cost
Use the developer API for transactional mail from domains you own or have permission to use.
Box Ox has no broadcasts, audiences, or marketing campaigns.
Cloudflare's Email Service terms limit sending to messages tied to a specific customer interaction or transaction. Get confirmation from Cloudflare before relying on it for general conversational sending.
As checked on October 18, 2026:
| Item | Starting cost |
|---|
| Workers Paid | $5 per month minimum |
| Email Sending | 3,000 emails per account per month included, then $0.35 per 1,000 |
| Email Routing | No per-message receiving charge. Worker execution and storage still count. |
| AI and other bindings | Usage-based. OpenAI/Anthropic through AI Gateway require prepaid credits. |
Check Workers pricing and Email Service pricing before enabling paid features.
New sending accounts may have Sandbox limits or recipient restrictions.
What reads your mail
AI stays off until the owner enables it. Setup offers three separate choices, which you can change later under Settings → Processing:
| Choice | Data flow |
|---|
| Local filters | Authentication checks, rules, Bayes learning, and campaign fingerprints run in your Cloudflare account. |
| Reputation lookups | Link domains go to Cloudflare's security DNS resolver. An optional Spamhaus key adds IP/domain checks. OpenPhish is a downloaded feed. |
| AI: OpenAI or Anthropic | Selected mail content goes to the chosen provider through your account's AI Gateway. |
| AI: Cloudflare only | An allow-listed open-weight model runs on Workers AI. |
Box Ox requests disabled gateway logging and caching and a zero-data-retention routing preference. This does not guarantee provider retention behavior. Cloudflare processing can occur outside the United States.
Mail is stored readable in R2 and D1, encrypted at rest by Cloudflare. Anyone with sufficient account access can read it.
Link previews run only after you confirm them. AI reply suggestions open in the composer and are never sent automatically.
See the processing guide, the AI model reference, and the threat model.
Developer and agent access
- Developer API: domain keys, templates, message logs, received mail, and signed webhooks. Read the API and SDK guide.
- CLI, SDK, and email skill: direct downloads from boxox.dev, not npm packages.
- MCP:
/mcp with OAuth, PKCE, owner-approved clients, and revocation. Request exact mailbox permissions before login with scopes such as boxox:read:[email protected], or let boxox mcp request build them. Agents stay subject to mailbox grants, sending caps, and the kill switch.
See agent automation for connecting agents and processing mail reliably.
Cloudflare services
Box Ox uses Workers, Static Assets, D1, R2, KV, Durable Objects, Queues, Workflows, Email Service, Email Routing, DNS, Access, Rate Limiting, and Cron Triggers.
The Paid profile can also use Workers AI, AI Gateway, Vectorize, and Browser Run.
The Cloudflare services reference explains each binding and the differences between profiles.
Contributing
See CONTRIBUTING.md for the source layout and checks.
License
Functional Source License 1.1, MIT Future License (FSL-1.1-MIT).
Internal use is permitted; competing commercial products and services are restricted.
Each version becomes MIT-licensed two years after release. Read the license for full terms.
