Nuncio is in active development — building in the open, not shipping vapor.
Nuncio App IconNuncio
Nuncio — Sovereign, Fast & 100% Open Source. Under active construction.

Email Rebuilt for Today.
Private, Fast & AI-Integrated.

No paid subscriptions, closed formats, or locked-away data. We're building four extraordinary interfaces, an AI-driven NSQL filter engine, and cryptographic audit logs on a single sovereign core — in the open, from day one.

Notify me at launchFollow the build on GitHubSee the roadmap
Local AES-256 encryption at restPlanned100% Free & Open SourceHMAC Cryptographic WORM Audit LogsAvailable nowNative apps for macOS, Linux & WindowsPlanned
Product preview — a concept mockup of the vision, not a screenshot of a real build
Nuncio Sovereign Mail & Calendar — Concept for a Native macOS / Linux / Windows Shell
Nuncio Desktop GUI (Tauri v2 Native)
Native Glassmorphism
Inbox Envelopes
Project Lead12:42 PM

Architecture review for the filter engine

Calendar Assistant (AI agent)11:15 AM

Calendar event confirmed via MCP

CI BotYesterday

Nightly build finished

Architecture review for the filter engine

From: Project Lead

Concept UI

Please review the sovereign mail architecture spec ahead of the next milestone...

At-rest encryption — planned
Built on Sovereign Principles

Email Rebuilt for Today.
Private, Fast & Secure.

Break away from paid cloud subscriptions, closed proprietary formats, locked-away data, and fragmented user experiences across platforms.

1. Sane & Controlled AI Access

Planned

AI co-pilots should empower you, not exfiltrate your life. The plan: a policy gateway that enforces granular RBAC capability flags, folder boundaries, and automatic redaction of sensitive data before any payload touches an LLM.

2. First-Class UI/UX in Every Space

Planned

No second-class interfaces, by design. A single frozen gRPC contract is meant to guarantee equal polish and feature parity across a native desktop app, a Vim-style terminal TUI, a scriptable POSIX CLI, and an MCP AI agent bridge — not left to each client's discipline.

3. Uncompromising Speed & Performance

Engineered in native Rust over single-writer SQLite WAL storage, so search, filtering, and sync stay fast as your mailbox grows. We'll publish real, methodology-backed benchmarks as the engine matures — not invented numbers.

4. Sovereign Control & Zero Closed Formats

No cloud lock-in, no proprietary sync servers, no closed formats. Your emails, accounts, rules, and calendars live in standard local SQLite files on your disk, with MBOX/EML/JSON export already working today. You own your data.

5. Zero-Trust Security & Encryption

Planned

Column-level data-at-rest encryption, hardened attachment ciphers, and HTML email sandboxing with tracking-pixel neutralization are on the security hardening milestone — real engineering targets, not shipped yet.

6. WORM Cryptographic Audits

Available now

Every automated rule match, account mutation, and tool call is recorded in an append-only, hash-chained Write Once Read Many (WORM) audit ledger — working today, not a future promise.

Read The Full Nuncio Story & Vision
Four Interfaces, One Vision

One Engine. Four Ways to Work.

A sleek desktop window, lightning terminal keybindings, Unix shell scripts, and AI co-piloting — all built on one gRPC contract. The reference CLI is real today; the rest are on the roadmap.

1. The Desktop Workspace

Beautiful visual elegance for everyday productivity

Planned

A native desktop app, planned as a thin client over the same gRPC API every other interface uses, designed for seamless daily flow: a clean inbox, visual calendar scheduling, and drag-and-drop filter creation.

The vision:
  • Sandboxed HTML email inspector with tracking-pixel neutralization
  • Unified inbox across all your personal, work, and custom domain accounts
  • Visual drag-and-drop rule builder and interactive calendar planner
  • Native performance targeting minimal RAM and battery usage
Nuncio Desktop App — planned for macOS, Windows, Linux

2. The Vim Keyboard Terminal

Keyboard velocity for triage without touching the mouse

Planned

A Ratatui-based terminal client on the roadmap for developers and power users who want maximum speed: Vim motions, single-key triage chords, and split-view previews, all driven by the same engine.

The vision:
  • Vim navigation (`j`/`k`/`h`/`l`/`g i`) & single-key archive/delete chords
  • Instant split-pane previewer for text & HTML email content
  • Interactive NSQL rule editor & dry-run condition tester built in
  • Runs directly in any terminal tab or SSH session
nuncio-tui — planned

3. The Developer Command Shell

Instant inbox queries & automation right from your shell

Available now

The in-repo reference client and E2E driver for the engine. Build it from source today to search messages, sync IMAP/SMTP accounts, and drive the daemon over its gRPC API directly from your shell.

What works today:
  • Pipeable JSON outputs for shell scripts & custom automations (`--json`)
  • Local SQLite FTS5 full-text search over your synced mail
  • Talks to the headless background sync daemon (`nunciod`) over gRPC
  • Multi-account IMAP sync and SMTP send, tested against mock servers
cargo run -p nuncio-cli -- mail search --query 'urgent'

4. The AI Executive Assistant

AI co-pilots working alongside you with granular privacy

Planned

A governed MCP bridge, planned as a separate client, that lets local LLMs and AI agents (Claude, Cursor, and others) talk to Nuncio through a policy gateway — never handed raw IMAP or provider credentials.

The vision:
  • Aggregate multiple accounts into a single local vault the agent can query
  • Controlled AI gateway: no direct, uncontrolled access to raw providers
  • Every AI tool call recorded in the WORM audit ledger
  • Built on the same frozen gRPC contract as every other client
nuncio-mcp --stdio — planned
Nuncio SQL Filter Language (NSQL)

Live Interactive NSQL Grammar Demo

Edit the NSQL rule below and run it against one sample message right here in your browser. This demo re-implements the grammar in JavaScript to preview the language — it isn't the compiled Rust engine, and rules like this don't act on your real mailbox yet.

Parser & dry-run: real today. Firing on synced mail: planned
Read Full NSQL Language Specification & Grammar Docs→
NSQL Grammar Editor (browser demo)✓ Mirrors the 6-pass grammar
Evaluated against one sample message, in your browser

Dry-Run Evaluation Output

Edit the query in the editor and click "Run Dry-Run Preview" to parse your NSQL text and evaluate real condition matches against sample email envelopes.

Real Engine Defenses (Rust, Not This Demo)

These properties describe the actual nuncio-filter engine today — not the JavaScript grammar preview above, and not yet wired into live sync.

  • Parameterized SQL binding — no string-concatenated queries.
  • Static rejection of dangerous nested-quantifier regex patterns before a rule can be saved.
  • Webhook dispatch blocks redirects and known private/loopback IP targets.
  • Every matched rule and webhook dispatch is signed with HMAC-SHA256 and hash-chained into the WORM audit ledger.
Design goal: one contract, no second-class clients

One Core Engine. Four Great Interfaces.

Every capability in Nuncio is designed against a single versioned gRPC contract, so the CLI, TUI, GUI, and MCP bridge can't drift out of sync the way bolt-on clients usually do. That's the architecture's job, not a promise about what's built yet — the CLI is the only client that exists today; the rest are planned thin clients over the same API. The Status column below reflects the real, current state of each underlying capability.

Capability CLI TUI GUI MCPStatus
List Accounts
Account Management		nuncio account listAppMode::AccountSettingsConfigured Accounts Listnuncio_account_listAvailable now
Add Account Profile
Account Management		nuncio account add[a] Add Account ModalAdd Account Formnuncio_account_addAvailable now
Test Connectivity
Account Management		nuncio account test[t] Test ConnectionTest Connection Buttonnuncio_account_testAvailable now
Sync Mailboxes (IMAP/SMTP)
Email Operations		nuncio mail syncSync (s)Sync ButtonCoreCommand::SyncAllAvailable now
Search Messages (FTS5)
Email Operations		nuncio mail searchSearch Mode (/)Filter & Search Inputnuncio_mail_searchAvailable now
Send Email / Outbox
Email Operations		nuncio mail sendCompose Modal (c)Compose Modal Componentnuncio_mail_sendAvailable now
Export Mail (MBOX/EML/JSON)
Email Operations		nuncio mail export[x] Export DrawerExport Panelnuncio_mail_exportAvailable now
List / Create Rules
NSQL Automation		nuncio filter create --sqlAppMode::FilterRules<RuleBuilderForm />nuncio_filter_createIn progress
Dry-Run Preview
NSQL Automation		nuncio filter test --sql[t] Dry-Run Previewer<ConditionTester /> Panenuncio_filter_testIn progress
Rules Firing on Live Sync
NSQL Automation		nuncio filter logs[l] Log Drawer<AuditLogInspector /> Tabnuncio_filter_logsPlanned
CalDAV Calendar Sync
Calendar & Contacts		nuncio cal listAgenda / Calendar PaneCalendar Grid Viewnuncio_cal_list_eventsPlanned
CardDAV Contacts Sync
Calendar & Contacts		nuncio contacts listContacts PaneContacts List Viewnuncio_contacts_listPlanned
OS Keyring Credential Vault
Security & Vault		keyring cratekeyring cratekeyring cratekeyring crateAvailable now
At-Rest Body Encryption
Security & Vault		PayloadCipherPayloadCipherPayloadCipherPayloadCipherPlanned
HTML Sanitization
Security & Vault		n/a (headless)sandboxed renderersandboxed renderern/aPlanned
WORM Audit Ledger
Security & Vault		nuncio audit verify[l] Audit Drawer<AuditLogInspector />nuncio_audit_readAvailable now

TUI, GUI, and MCP columns above show design-target command surfaces for interfaces that don't exist yet — see the four interfaces for what's actually built today.

Security as a design goal, not a finished guarantee

Privacy and Security by Design.

Nuncio is being built around column-level encryption at rest, secure memory zeroing, sandboxed web rendering, and cryptographic audit ledgers. Two of these are real today; the rest are hardening work tracked on the roadmap — the badge on each card tells you which.

Planned

AES-256-GCM & age Stream Cipher

The design target: email bodies encrypted at rest with column-level AES-256-GCM, and large attachments streamed through modern age X25519 ciphers. Not implemented yet — today, message bodies are stored unencrypted in the local SQLite database.

  • Goal: zero unencrypted body text written to disk
  • Key material zeroing on drop — in progress, not verified complete
Available now

OS Keyring Credential Vault

Passwords and OAuth tokens are stored exclusively in native OS credential enclaves (Windows Credential Manager, macOS Keychain, Linux Secret Service) — this one is real today, not a plan.

  • Zero credentials stored in SQLite or config files
  • Backed by the OS-native credential store on every platform
Available now

Cryptographic Hash-Chain Ledger

Filter and account mutations already write an immutable entry linked via HMAC-SHA256 hash chains (H_n = HMAC(K, H_n-1 || data)) — this ledger is real and verifiable today.

  • Automated chain integrity verification
  • Tamper-evident operational audit trail
Planned: Model Context Protocol (MCP) Client

Sane & Controlled AI Agent Architecture

A governed MCP bridge is on the roadmap as a separate client over the same gRPC contract — not a direct line from your inbox to an LLM. It doesn't exist yet; here's the design.

Planned client — not built yet

1. A Single Local Vault for Every Account

The design goal: aggregate every account you connect — IMAP today, JMAP once it lands — into one local SQLite vault an agent can query, instead of handing separate credentials to separate tools.

2. Controlled Gateway, Not Direct Access

Local LLMs and AI agents are meant to never see raw passwords or get direct, uncontrolled access to your accounts. Every AI action would pass through Nuncio's security enclave under an RBAC policy with automatic PII redaction.

3. WORM Audits for Every AI Action

The plan is that every AI agent tool call, read, draft, and send lands in the same immutable, HMAC-SHA256 hash-chained audit ledger that already exists for other engine actions today.

Target config shape (not usable yet)

nuncio-mcp doesn't exist as a binary today
{
  "mcpServers": {
    "nuncio": {
      "command": "nuncio-mcp",
      "args": ["--stdio"],
      "env": {
        "NUNCIO_LOG_LEVEL": "info"
      }
    }
  }
}

This is what a client config would look like once the MCP bridge ships — pasting it into an MCP client today will not connect to anything.

Designed to run under an RBAC policy, folder whitelists & automatic PII redaction — none of which exist yet.
Explore the MCP vision page
Nuncio is pre-alpha — there is no installer yet

Be there for launch day

There's no packaged app to download today. Follow the build in the open on GitHub, watch the roadmap for milestones, or build it yourself from source right now.

Follow the build

Every commit, PR, and milestone happens in public. Star the repo to watch progress.

Follow the build on GitHub

See the roadmap

See exactly what's shipped, what's in progress, and what's planned before v1.

See the roadmap

Notify me at launch

Watch on GitHub for releasesSee the roadmap

No email list exists to sign up for. On GitHub, set Watch → Custom → Releases on the repo and you'll get notified the moment there's a build worth installing.

Developer? You can build it from source right now

$git clone https://github.com/KofTwentyTwo/nuncio.git && cargo build --workspace

Clones the daemon (nunciod) and reference CLI (nuncio-cli) — no packaged installer, no GUI, no TUI yet.