NexusAGYmail

NexusAGYmail

Gmail for Google Antigravity, safe to leave alone.

Antigravity's store has no Gmail connector: one local MCP server gives it your Gmail through the official Gmail API, and sends a draft only after your explicit yes for that exact draft. Nothing is ever deleted for good.

▶ Click to watch the video · more on julienpiron.fr

Why NexusAGYmail

📬 Your Gmail in Antigravity Search, read, attachments, drafts, labels and a reversible trash, through the official Gmail API. ✋ Sends only on your yes A single-use accord bound to the exact draft, valid 10 minutes; an email can never trigger a send. ♻️ Nothing deleted for good Trash is reversible for 30 days; there is no permanent-delete tool, and the code is tested for it.

🧩 Same tools as Google's The tool names and parameters of Google's official Gmail MCP server, plus four of its own. 🛡️ Guardrails in the code Every email is framed as data, hidden instructions are flagged, secrets are never attached. 🔐 Only you and Google Your own OAuth client, a DPAPI-encrypted token, no telemetry, no cloud relay, no browser automation.

Windows 10 and 11 (x64 and Arm64): one native executable compiled ahead of time (Native AOT, 8 MB), nothing else to install (no Python, no .NET runtime). Everything sent to the client is in English. The same tools work without enrolling in the Workspace Developer Preview or enabling a remote MCP endpoint: it runs on your machine, with any personal Gmail.

Quick start

You need Windows 10 or 11 and a Google account. About 5 minutes, once.

[!TIP]

Let your AI install it. Paste this into Claude Code, Codex or Antigravity:

`text

Install NexusAGYmail by following https://raw.githubusercontent.com/pironjulien/NexusSystem/main/INSTALL-AI.md

`

Or use the NexusSystem app from the Microsoft Store (winget install --id 9NSH2P3QLWT1 --source msstore). New versions are no longer published to PyPI (0.13.0, the last Python version, stays available there).

Manual install (verified)

Install, then run the guided sign-in (PowerShell, no administrator rights). Download the release files, check them, then run the installer as a file:

$r = 'https://github.com/pironjulien/NexusAGYmail/releases/latest/download'

Invoke-WebRequest "$r/get.ps1" -OutFile get.ps1 Invoke-WebRequest "$r/SHA256SUMS.txt" -OutFile SHA256SUMS.txt (Get-FileHash get.ps1 -Algorithm SHA256).Hash # must match the get.ps1 line of SHA256SUMS.txt gh attestation verify get.ps1 --repo pironjulien/NexusAGYmail # optional: build provenance powershell -NoProfile -ExecutionPolicy Bypass -File .\get.ps1 -Auth

It downloads the release for your PC (x64 or Arm64), checks it against the release's SHA256SUMS.txt, installs it in ~\.nexus\nexus-agymail\app\ , adds the nexus-agymail plugin to Antigravity, then connects Gmail (without -Auth: install or update only).

Each release attaches NexusAGYmail-win-x64.zip, NexusAGYmail-win-arm64.zip, MCP bundles (nexus-agymail- -win-x64.mcpb, nexus-agymail- -win-arm64.mcpb), SHA256SUMS.txt and their build provenance: check a file with gh attestation verify --repo pironjulien/NexusAGYmail.

Connect Gmail (guided, once)

Gmail scopes are restricted, so every user creates their own free OAuth client in their own Google Cloud project: your mail never goes through anyone else's app. The assistant (get.ps1 -Auth) opens each Google page in your browser at the right place and says what to click (it first asks which Gmail address to connect, so the pages open on that account):

1. create a project (name it NexusAGYmail);
2. turn on the Gmail API;
3. the consent screen (*Get started*, *External*); on *Branding*, a home page, a privacy policy link and an authorized domain (the assistant gives this repository, its Privacy section and github.com: Google requires them before publishing); then Publish app (unpublished, Google blocks the sign-in with *Error 403: access_denied*);
4. a client of type Desktop app (leave *Use this client for an AI-powered agent* unchecked), then Download JSON: the assistant finds the file in your Downloads folder by itself;
5. sign in. Google shows "Google hasn't verified this app": it is your own app, click *Advanced > Go to NexusAGYmail (unsafe)*.

Then it checks what can be checked: the Gmail API answers, and the app is really published (Google returns a 7-day sign-in for apps left in *Testing*); if not, it opens the page that fixes it and signs in again.

Restart Antigravity, then ask, for example: *"Summarize my unread emails from this week"*, *"Archive the newsletters older than a month"*, *"Draft a reply to the last email from Alice saying I agree, and show it to me before sending"*.

Antigravity by hand (mcp_config.json), if you skip setup

{

"mcpServers": { "nexus-agymail": { "command": " \\NexusAGYmail.exe", "args": ["--mcp"] } } }

Commands, Claude Desktop and Google's own server

Already have a Desktop app client JSON? NexusAGYmail.exe auth --client-secret skips the console steps. NexusAGYmail.exe status shows where the token is and which scopes it carries, as JSON (no secret shown). NexusAGYmail.exe setup declares the server to Antigravity again; get.ps1 -Remove removes it.

Claude Desktop: download the .mcpb bundle for your PC (x64 or Arm64) from the latest release, check it against SHA256SUMS.txt, then open it (or drag it onto *Settings > Extensions*): Claude Desktop installs the extension. Sign in once with the NexusAGYmail.exe auth command shown in its settings, or with get.ps1 -Auth.

Rather not create a client? Google's own Gmail MCP server runs on Google's side (same tool names) but is a developer preview: it needs the Google Workspace Developer Preview Program and a Google Cloud project as well, and it cannot send. NexusAGYmail exists because Antigravity has no Gmail connector of its own, and for confirmed sending.

How it works

flowchart LR

A[Google Antigravity] -- MCP stdio --> S[nexus-agymail on your machine] S -- HTTPS, official Gmail API v1 --> G[(Gmail)] S -. token, encrypted .- T[~/.nexus/nexus-agymail] S -. attachments .- D[Downloads/NexusAGYmail]

The server is a plain local process: no cloud relay, no browser automation. It talks to gmail.googleapis.com with your own OAuth client and a refresh token stored on your machine, and to oauth2.googleapis.com to refresh it.

Tools

Names and parameters follow Google's official Gmail MCP server and its extensions (update_draft, trash_*), plus four of its own: send_draft, list_new_messages, download_attachment, auth_status.

All tools

| update_draft | Rewrites a draft (empty fields unchanged), thread, reply and attachments kept; attachments adds,