The agent is getting hands — and each one ships with an approval gate.

A local MCP server for macOS that gives any MCP client — Claude Desktop, Cursor, Raycast — native access to Calendar, Mail, Notes, Reminders, Messages, and Contacts, plus a background Computer Use mode that clicks and types in apps without APIs, without hijacking your cursor. Everything runs on-device; permissions are granted per feature — Calendar access, Full Disk Access for Mail, Accessibility for Computer Use — and revoked in one click. One setup covers every agent you run. The free tier has all features with daily usage limits and a single connected client; a lifetime license removes both. Launched today.

Reach for it when your agent knows everything about your codebase and nothing about your Tuesday. Delete the pile of single-purpose MCP servers — one for calendar, one for mail — and the AppleScript glue between them. The tradeoff is exactly what makes it useful: Full Disk Access plus Accessibility is most of the keys to the machine, granted to a young closed-source app. Grant the narrow permissions first and treat Computer Use as the last resort it's designed to be.

A desktop email client built for shared team mailboxes where AI agents do the grunt work — triage, labels, drafts — under one hard rule: every agent action goes through human review before it ships, "like a pull request on GitHub." Unified inbox across Gmail, Google Workspace, and custom domains (Outlook coming); the team built its own mail infrastructure — deliverability, routing, queues, bounces — rather than wrapping SES or SendGrid. Early access opened today: 14 days free, two mailboxes, 100 AI credits, 500 spots.

Reach for it when a support or sales inbox is drowning and every "AI email assistant" you've tried either auto-sends things you'd never sign or is a Chrome extension squatting on Gmail. Delete the forwarding-rules-and-intern triage system, or the Zapier chain pretending to be one. Tradeoffs: it's early access with caps, desktop-only today (mobile in development), and self-built mail infrastructure means your deliverability rides on a startup's IP reputation, not Google's.

An MCP server that connects an agent to the postal service: it composes letters and postcards, pulls saved contacts, attaches files, and generates a checkout link — then a human reviews the preview and the resolved address and approves payment before anything prints. PieterPost handles the printing, stamping, and mailing; you pay per piece, no subscription. It's the same approval-gate design as everything else today, applied to the one channel with no unsend — the stated reason for the gate is keeping hallucinated addresses out of real mailboxes.

Reach for it when a workflow ends in a physical artifact — the invoice that must be posted, the contract countersignature, the thank-you note you've owed someone since March. Delete the print-envelope-stamp-post-office errand, or the Lob integration you were never going to write for a once-a-month need. Tradeoffs: per-piece pricing and country coverage aren't published on the page — you find out at the checkout link — and the human gate means this is a hands-on tool, not batch mail-merge automation. That's the design, but know what you're adopting.

A hosted replay engine for AI agents: one decorator (pip install retrace-sdk or npm i retrace-sdk, both MIT) records every LLM call, tool call, and error; when a run fails you replay it deterministically, fork from the exact step it went wrong, edit that step's input, and cascade-replay the rest to check the fix before shipping. The free tier is 1,000 traces a month with 7-day retention; paid runs $29–$399/month. If the three picks above are the gate before the irreversible action, this is the flight recorder for everything leading up to it.

Reach for it the day your agent does something wrong that you can't reproduce — the model is nondeterministic, the run is gone, and your logs say "tool called" without saying why. Delete printf archaeology over JSON logs and the re-run-and-pray reproduction loop. Tradeoffs: hosted-only, so full traces — prompts, tool arguments, whatever your agent saw — live in their cloud; and it's young enough that the SDK repo has one GitHub star. The free tier makes it a cheap experiment, not yet a proven dependency.

Off the thread but worth knowing: codex-plugin-cc (github.com/openai/codex-plugin-cc, Apache-2.0, 22.3k stars) is OpenAI's official Claude Code plugin for calling Codex from inside Claude Code — delegate a task or a code review to the competitor's model without leaving your harness. Created in March and trending again now, it's off today's thread (coding-agent interop, not real-world hands), but OpenAI shipping a first-party plugin into Anthropic's harness says more about where the agent market settled than any benchmark. And caveman (github.com/JuliusBrussee/caveman, MIT, 79.5k stars) is re-trending at 866 stars a day: a Claude Code skill that cuts ~65% of tokens by making the model talk like a caveman. A joke that ships — and a reminder that most of your context bill is politeness.