If you want your AI agent (Claude Desktop, Claude Code, Codex) to actually touch your Gmail, a Gmail MCP server is the fastest way there, and for a lot of people it is genuinely enough. The interesting question is not whether it works. It is what happens the moment your agent decides to act.
What a Gmail MCP server does well
Give it credit up front: the popular Gmail MCP servers are free, open source, and capable. GongRzhe/Gmail-MCP-Server, its ArtyMcLabin fork, and Google’s own Gmail MCP guide all expose a large slice of the Gmail API. You get real Gmail-syntax search, sending plain and HTML mail with attachments, label management, and batch operations. Your agent talks straight to the Gmail cloud with your OAuth token, so it reads and writes at API speed. If your work is mostly read-heavy (search my inbox, pull that thread, find every receipt from March), this is a clean, direct path, and there is little reason to reach for anything heavier.
Where the model gets thin
The gap that matters is not whether it can do things. It is what happens when it does. With a raw MCP server, every tool call executes immediately. There is no step between “the agent decided to send” and “the mail left your account.” No pause, no preview, no second look. There is also no unified audit log across actions and no autonomy dial that lets you say draft it but do not send it. The agent’s judgment is the only thing standing between a bad prompt and a sent reply.
You also own the setup and the blast radius. Standing one up means a Google Cloud project, an OAuth consent screen, a Desktop client ID, a keys file, and a refresh token in a local folder. And it is mail only. The day you want Calendar, Reminders, Notes, Contacts, Messages, or Finder in the same workflow, each is another server and another OAuth flow, with no shared record tying them together. It is also worth deciding where an always-on agent should live: on a Mac you own, not a rented server.
Where Alfos fits
Alfos is not a bigger Gmail API. It is the governance layer over the native Mac apps you already sign into. It drives the Mail app on your Mac directly, so there is no Google Cloud project, no consent screen, no keys file, and no refresh token to manage. The same interface covers Calendar, Reminders, Notes, Contacts, Messages, and Finder: 60 tools in all, every one of them logged.
The difference is what sits between decision and execution. Alfos classifies every tool by Effect: read (changes nothing), create (reversible and low-stakes, like a draft or a reminder), and destructive (irreversible, like send, reply, forward, delete, move, or archive). Destructive actions route to a human approval queue in every mode except YOLO. When approval is needed, the action lands in a local pending queue and nothing runs until a person taps approve in the cockpit, after seeing a blast-radius preview (for example, 594 messages, 96.7 MB). Your agent can queue an action or cancel it, but it can never approve its own.
An autonomy slider sets the posture. Panic runs reads only. Copilote, the shipped default, runs creations and holds destructive actions for approval. YOLO runs everything, audit-only. Cockpit, CLI, and the MCP shim all funnel through one runner, so an agent using the shim can do nothing your posture and deny-rules forbid, and a deny-rule blocks even under YOLO. Every action, whether executed, pending, denied, rejected, or errored, is journaled to a single local SQLite log you can search: timestamp, actor, tool, args, result, and reason.
It stays local. Alfos sends nothing home beyond a license check and app updates, and your own AI provider still sees only its own prompts. Alfos brings no model and holds no API key: you bring the agent (Claude Code, Codex, Gemini, Grok) and the model. It runs on a Mac you own, macOS 14 or later. Free covers reads, captures, flagging and drafting replies, up to 3 automations, and nothing irreversible. Pro, a one-time purchase (29 EUR, no subscription), unlocks acting at full scale.
It is not either/or
You do not have to choose. Keep a Gmail MCP server for fast, read-heavy work, and let Alfos own the actions you want reviewed. Direct API access and a reviewed queue can live side by side, each doing the job it is actually good at.