┌──────────────────────┐
  │  ✉  ───────┐         │
  │            ▼         │
  │  ╭──────────────╮    │
  │  │ ▓ DKIM ✓ ▓   │    │
  │  ╰──────────────╯    │
  │     │         │      │
  │   now       later    │
  │  verify    offline   │
  └──────────────────────┘

  mailproof

Prove an email really came from the address it says, and keep that proof checkable offline, years later.

• A verdict now. Did this email really come from that address? One answer: verified, forwarded, authorized or unverified.
• Proof later, offline. The signed headers, the signature and the sender's public key go into a git repo you own. Anyone can re-check the email from that record alone, even after the sender drops the key from DNS.
• A time seal. Records are sealed with OpenTimestamps, so you can show an email existed no later than a given time.
• Replies you can trust. replyText returns only what the sender newly wrote, and says whether those words are proven.
• A bundle for the other side. Export what you exchanged with one person; they check it with no account and no trail.

Not a mail client, not a sender, not spam filtering, not proof of delivery. It never decides what a reply means: it gives you the verified text, and acting on it is your call.

The body is never in the proof or the trail. The raw email and attachments are kept in a local store beside the trail (outside git, owner-only, removed after 730 days or by forget; content: { store: false } turns it off). Every email is recorded, even unsigned, unverifiable or over a size limit, and flagged with the reason.

npm install -g mailproof        # Node >= 22.19; optional: the `ots` binary for sealing
mailproof                       # no arguments on a terminal: the menu

First run walks you through adding an account (provider first, login tested before anything is written; the password is kept in an owner-only file or a command you name, never in the config). The menu header shows records, verified, last sync and seal state. Each item is a number (or its name) and runs the same code as the subcommand:

The same things as subcommands, for scripts:

mailproof sync --account personal
mailproof show bob@example.org        # every email with that address, and what its signature proves
mailproof verify bob@example.org      # re-check offline; exit 2 if a received email does not verify
mailproof stamp && mailproof export --with bob@example.org --after 2026-01-01 --tar
mailproof verify-bundle <bundle> --expect <sha256>     # the recipient's side, no account

mailproof help lists everything. Exit codes, systemd and cron examples, restoring a backup: usage guide. First time: the setup guide. Want your own outbound mail DKIM-signed too: self-hosting guide (OpenDKIM and Postfix).

claude mcp add mailproof -- mailproof mcp

mailproof mcp serves every configured account to any MCP client as 30 tools. Tool names equal the library method names. Two are server-only: accounts and profiles. forget, prune, export and backup only preview until called with confirm: true. Claude Code does not act on read-only/destructive hints, so scope tools by name in your allow rules. Details: usage guide. Hand your assistant the integration guide for the full contract.

npm install mailproof

import { Mailproof } from 'mailproof';

const mp = new Mailproof({ trailDir: './trails' });

await mp.check(rawEmail);                                        // a verdict now; writes nothing
const { id } = await mp.record(rawEmail, { direction: 'in' });   // keep the proof
await mp.verify(id);                                             // later, offline, from the record alone
const reply = await mp.replyText(rawEmail);                      // the sender's new words, and reply.proven

Pure ESM, types generated from JSDoc. Good for a Postfix pipe or your own pipeline.

The whole public surface. primitives.json (also at unpkg.com/mailproof/primitives.json) adds when, signature, fails and an example for each.

A risky step can wait for a human's signed email reply. mailproof supplies the facts; the rule is yours. It works with bareguard (^0.34.0), the sibling library that holds an agent's action until a rule allows it. Send the question from your own account, then read the replies:

const replies = await mp.replyFacts({ messageId: '<question-1@example.com>' });

Group them by messageKey. Allow only if at least one reply is green and none is red. Green, for example: firstLine is your approval word, from is alice@example.com, fromDkimAligned is pass, bodyProven is proven, link is signed. No reply, or a mix, means deny. A second contradictory reply can deny an approval, never grant one. The full field list and the exact rule are in the integration guide.

mailproof reads mail and writes proofs locally. Everything that uses the network:

record(), check(), verify() and every read never contact the calendars.

• Received at Gmail: the reply's words are provable, whoever sent it.
• Received at Outlook or msn from outside: Microsoft alters the body, so the words are unproven. The sender and signed headers still verify. proven tells you which case you are in.
• Unsigned mail and your own Sent copies are recorded but unverified. The proof is the other side's signed copy.
• An export proves that a domain signed those headers, and (once anchored) that the record existed by a time. It does not prove completeness: nothing shows that no other email exists.

Replies whose words matter, such as approvals, belong in a Gmail inbox.

Usage guide | Setup guide | Self-hosting guide | Integration guide | Changelog | License (Apache 2.0)