MailDigest

Version 0.3.1 · MIT licence · Source on GitHub

The mail summariser you can hand a phishing mail to.

MailDigest is a self-hosted e-mail summariser. You forward your mail to a dedicated mirror mailbox; MailDigest reads it over IMAP, summarises every message with a language model, has a second, independent model check it for phishing, and sends you the result as plain text on Telegram, Discord or Signal. You see what is going on in your inbox without opening your inbox — and without anything clickable ever reaching you. It runs on a small VPS or a Raspberry Pi and needs no access to your real mailbox.

Real mailbox ──forwarding──► Mirror mailbox ──► MailDigest ──► Messenger

What arrives on your phone

A normal mail becomes a few lines. Links are replaced by their defanged domain, so your messenger cannot turn them into something tappable:

📧 Invoice 2026-0917 for September hosting is due on 30 September [important]
From: Hetzner Online (hetzner[.]com) · 19.09. 08:41
The invoice for server AX41 (EUR 46,41) is attached; payment is collected by SEPA
direct debit on 30.09. No action is needed unless the bank details have changed.
— invoice_2026-0917.pdf: One-page invoice, amount EUR 46,41, due 30.09.2026.

A phishing mail gets a warning banner from the critic model and the deterministic sender checks, and still nothing clickable:

⚠️ SUSPECTED PHISHING: sender domain does not match the claimed bank, urgency and a
login link, SPF and DKIM failed
📧 "Your account will be suspended within 24 hours" asks you to log in via a link
From: Sparkasse Kundenservice (sparkasse-sicherheit[.]top) · 19.09. 03:12
Claims unusual activity on the account and demands an immediate login through
[Link #1: sparkasse-sicherheit[.]top] to keep the account open.
🔍 Notes: sender checks failed: SPF, DKIM

The security model in five sentences

  1. MailDigest never gets access to your real mailbox, only to a dedicated mirror mailbox — and it deletes nothing there.
  2. Before a language model sees anything, deterministic code reduces the mail to plain text: no HTML, no MIME parts, no attachment binaries.
  3. The language models have no tools, no network access and no file access — the only thing they can produce is text in a validated JSON field.
  4. What reaches you has been checked by code one last time: no clickable links, no attachments, no markup — domains appear defanged as example[.]com.
  5. If anything goes wrong, you get a note instead of unchecked content — nothing disappears silently.

A successful prompt injection can at most produce a wrong summary, against which a second model with its own prompt stands. It cannot make MailDigest click, fetch, send or delete anything, because there is nothing it could do that with. The attacker model, the sanitizer rules and the invariants are written up in docs/SECURITY.md.

Install

MailDigest has its own signed package repositories, so installation and updates run through the tool you already use. You also need a second, empty IMAP mailbox as the mirror and a Telegram bot, a Discord webhook or a running signal-cli. A language model is optional; without one you get the deterministic checks and the sender and subject lines.

Debian, Ubuntu, Kali (apt)

Add the key and the repository once:

curl -fsSL https://kpafi.github.io/maildigest/apt/maildigest-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/maildigest-archive-keyring.gpg > /dev/null

echo "deb [signed-by=/usr/share/keyrings/maildigest-archive-keyring.gpg] \
https://kpafi.github.io/maildigest/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/maildigest.list

sudo apt update && sudo apt install maildigest

From then on apt upgrade carries new versions along on its own. Supported are Debian 13 and newer, Kali Rolling and Ubuntu 26.04 and newer.

Fedora (dnf)

sudo dnf copr enable kpafi/maildigest
sudo dnf install maildigest

Everywhere else (pip, pipx)

The package is on PyPI:

pipx install maildigest

Docker (amd64 and arm64)

The image ghcr.io/kpafi/maildigest runs as an unprivileged user and holds no configuration and no secret; the compose file applies the same hardening as the systemd unit. Setup runs interactively, one command at a time:

mkdir -p maildigest/data && cd maildigest
curl -fsSLO https://raw.githubusercontent.com/kpafi/maildigest/main/docker-compose.yml
docker compose run --rm maildigest init
docker compose run --rm maildigest connect-mail
docker compose run --rm maildigest connect-messenger
docker compose up -d

Then maildigest init walks you through the configuration; the operations guide covers the mirror mailbox, the messengers, the model providers and running it as a service.