Open source · self-hosted · remote MCP server
Many Gmail inboxes, one Claude connector.
Surfski lets Claude search, read and draft email across several Gmail and Google Workspace mailboxes. You add one connector, link as many inboxes as you like, and every user only ever sees their own.
Works with Claude on the web, desktop and mobile, and with any MCP client that speaks Streamable HTTP with OAuth.
“Find anything from Acme in any of my inboxes this month.”
search_all_accounts(query="from:acme newer_than:30d")
- workInvoice #4821 — OctoberAcme BillingOct 18
- personalYour order has shippedAcme StoreOct 15
- supportRe: refund for invoice #4790[email protected]Oct 12
How it works
Two separate Google sign-ins keep two questions apart: which Claude user is asking, and which mailboxes that user has allowed. Both use the same OAuth client in your own Google Cloud project.
- 1Layer A · Who you are
Add Surfski to Claude once
Add your server as a custom connector and sign in with Google. Surfski only checks who you are against its allowlist. It never sees your password.
Scopes: openid, email
- 2Layer B · Which mailboxes
Link each mailbox under an alias
Ask Claude to “link my work Gmail as work”. You sign in as that mailbox and grant read and compose access. Repeat for personal, support, and so on.
Scopes: gmail.readonly, gmail.compose
- 3Then
Ask across all of them
Claude searches, reads threads and saves drafts in whichever mailbox you name, or across every mailbox you have linked.
What you get
Many mailboxes per person
Link any number of Gmail and Google Workspace accounts, each under a short alias like work, personal or support.
Search across every inbox
One search runs over all your linked mailboxes and tells you which mailbox each thread came from.
Drafts first
Claude writes drafts and you send them from Gmail. Opt-in sending, with confirmation links and daily caps, is on the roadmap.
Read the sending design →Strict per-user isolation
Every query is scoped to the signed-in Claude user. People who share a server never see each other’s mailboxes.
Encrypted at rest
Refresh tokens are Fernet-encrypted on your server. Access tokens stay in memory. Logs never contain tokens or message bodies.
Your Google project, your server
Self-hosting uses your own OAuth client, so you skip Google’s app verification. That works for up to 100 users.
Run your own instance
Gmail's read scopes are restricted. A public app needs Google verification and a yearly security assessment. Your own instance doesn't, as long as it stays under 100 users.
- Your own Google Cloud project and OAuth client.
- Refresh tokens never leave your server.
- One Docker container behind your TLS reverse proxy.
# on a Linux host with Docker
git clone https://github.com/rayhu/surfski /opt/surfski
cd /opt/surfski
python3 scripts/gen_secrets.py
sudo docker compose -p surfski up -d --build
# then in Claude: Settings → Connectors
# → Add custom connector → https://<host>/mcpComing later
A hosted version
A hosted Surfski is planned in steps: first an invite-only beta, then hosting for Google Workspace organizations that bring their own Internal OAuth client, and public self-serve hosting only after Google's OAuth verification and annual security assessment. There is no date and no sign-up yet.