macOS · Local-first · Fastify · Prisma · PostgreSQL · MCP · AppleScript
Locker
Turn your inbox into a private command centre for apps, bots, and AI agents.
Locker connects to the mail accounts already configured on your Mac and turns incoming messages into triggers. A JSON condition tree decides what fires; connectors reach Slack, webhooks, and AI providers; an audit log records every action; one kill switch stops all automation. Everything — mail, rules, history — stays on your machine. The core principle is that nothing external is ever sent or posted silently: drafts and approvals come first.
- Next.js 16
- TypeScript
- Tailwind CSS
- Fastify
- Prisma
- PostgreSQL + pgvector
- AppleScript
- Model Context Protocol
Origin
How it started
Every email automation tool asks for the same thing: hand us OAuth access to your entire mailbox, and trust us with it in our cloud. That is an enormous amount of trust for the convenience of auto-filing receipts. The Mac already has authenticated access to your mail — the automation layer should sit there, next to the data, instead of copying the data somewhere it can leak.
Features
What it does
One permission prompt
macOS asks once for access to Mail.app. No OAuth flow, no API keys, no per-provider setup, no tokens to rotate or leak. The accounts you already have are the accounts Locker works with.
Rules engine
Automations fire on incoming mail from a JSON condition tree — composable predicates rather than a fixed list of filters, so rules can be generated, version-controlled, and diffed like any other configuration.
MCP-native, deliberately hobbled
A built-in Model Context Protocol server lets AI assistants search, read, and draft replies against your mail. It cannot send. That is a hard boundary in the protocol surface, not a setting — the failure mode of an agent with send access is unrecoverable.
Search that actually finds it
PostgreSQL full-text search combined with pgvector similarity and fuzzy matching, running locally against your own corpus. Semantic recall without shipping a decade of correspondence to someone else's embedding endpoint.
Audit log and kill switch
Every action Locker takes is recorded. One click disables all automation. If you cannot answer 'what did it do while I wasn't looking' and 'how do I make it stop', you should not be running automation against your email.
Under the hood
Engineering
Local-first is a threat model, not a marketing line
Mail, rules, and automation history live on the user's machine and never reach a server I control. That rules out the easy version of nearly every feature — no server-side cron, no centralized search index, no remote debugging of a user's rules. What it buys is a product that cannot leak a corpus it never held, and an install that survives the company disappearing.
Drafts and approvals before actions
The architecture assumes the automation will eventually be wrong. Connectors produce drafts and pending approvals rather than committed sends and posts, so a bad rule produces a queue to review instead of an apology to write. The MCP server inherits the same posture — read and draft, never send.