About Mail Mantis
A small, honest tool for people who send email from their own domain and want to know where it lands.
Why it exists
When you start sending from a new domain, Gmail has no history to go on. The usual advice is to send a few normal emails to people who will open and reply, check where they land, and fix authentication when they land in Spam. Doing that by hand means juggling an SMTP account, several Gmail tabs and a spreadsheet.
Mail Mantis puts that loop in one private dashboard. By default every send and every reply is a person’s decision, so what you measure is how inbox providers treat a real sender. When doing it daily by hand gets old, autopilot takes over: once a day it sends a few ordinary emails and moves each of its conversations on by one reply, until you pause it. It still only writes to inboxes you own or that friends lend you, and it keeps volumes small on purpose.
Architecture
The dashboard is a static page that calls a single POST /api/app endpoint with an action. The API stores everything in Postgres and is the only part that talks to SMTP, the seed inboxes and the AI service. Placement is found by searching the seed inbox for the exact Message-ID that was sent and reading where it is: SPAM, INBOX and the tab in Gmail, Junk or Focused/Other in Outlook, or the spam folder over IMAP. Some sending services rewrite the Message-ID, so Gmail lookups fall back to the sender, subject and send time.
Autopilot is the same API run on a schedule: Vercel Cron calls /api/cron once a day with a secret, and the Docker server runs it from a built-in timer. Each run uses the same draft, AI and send steps you’d use by hand, and claims the day first so it never runs twice.
Tech stack
Security & privacy
- One admin, optional members. Members you invite can only connect and manage their own inboxes; they can’t see emails, results or settings. Passwords are hashed with PBKDF2-SHA256 (310,000 rounds). Sessions use random tokens stored as hashes, in an
HttpOnly,SameSite=Strictcookie. Login attempts are rate-limited per IP. - Secrets encrypted at rest. SMTP keys, inbox refresh tokens and app passwords, AI API keys and the OAuth client secrets are encrypted with your
APP_ENCRYPTION_KEY. API responses never return them. - Narrow mailbox use. Placement checks only look up one message. Moving an email out of spam, marking it important, adding filters and sending replies only happen when you click, or when autopilot (which you switch on) continues its own conversations.
- Locked-down schedule. The daily autopilot endpoint only runs when called with your
CRON_SECRET, does nothing while paused, and runs at most once a day. - No telemetry. Your instance talks only to your database, your SMTP provider, the mail providers of the inboxes you connect, and the AI service you choose.
- Not indexed. Dashboard pages send
noindexheaders and arobots.txtthat disallows crawling.
FAQ
Will this get my email into the inbox?
No tool can promise that. Mail Mantis shows you where mail lands and gives you a calm way to send real, varied emails and replies. Authentication (SPF, DKIM, DMARC), a reputable SMTP provider, and real recipients who engage matter most.
Does it send or reply automatically?
Only if you turn on autopilot. Without it, every email and every reply is sent by you pressing Send. With it, a daily run sends 1 to 10 new emails and replies once in each of its open conversations (the seed, then your domain, then the seed again), until you pause it. Placement checks run automatically while the dashboard is open, and they are read-only.
Can the domain reply back to a seed inbox?
Yes. Once a seed inbox has replied, a Reply from your domain button appears under the email, and the answer goes out over your SMTP sender in the same thread. The conversation can go back and forth as long as you like.
Can I use it for outreach or newsletters?
No. It only sends to inboxes you connect yourself, and autopilot is capped at 10 new emails a day. It has no lists, imports or campaigns.
Which inboxes are supported?
Gmail and Google Workspace (Google sign-in), Outlook.com and Microsoft 365 (Microsoft sign-in), and Yahoo, iCloud, AOL or any IMAP inbox with an app password. The sender can be any SMTP provider on ports 587 or 465.
Which AI services can it use?
Google Gemini, Anthropic Claude, OpenAI, OpenRouter, Groq and Cloudflare Workers AI, each with your own API key. Gemini, OpenRouter’s free models, Groq and Cloudflare all have free tiers. Gemini and Claude can read your website themselves; the others use the page text Mail Mantis fetches.
Do I need an AI key?
No. Pick Chat app and Mail Mantis gives you the prompt to paste into Claude, ChatGPT or any chat app, and you paste the answer back. You can also write everything yourself. Autopilot is the exception: it writes with your default AI service, so it needs a key.
What does “Not delivered?” mean?
The email isn’t anywhere in that inbox, including Spam and Trash, 30 minutes after sending. That usually means the inbox provider refused it. Look for a bounce in your sender’s mailbox: it says why.
Credits
Built by David Karuri. Released under the MIT license. Fonts: Geist and Geist Mono by Vercel and basement.studio, under the SIL Open Font License.