Pidgeon Email
Email channel for OpenClaw: mail to your agent's own address starts a conversation and gets a reply in its thread. Resumes after restarts and dropped connections; holds prompt-injection mail before the agent sees it.
Install
Current stable OpenClaw · through 2026.10.4
openclaw plugins install clawhub:@pidgeon-ai/openclawUpdated OpenClaw · main/dev
openclaw plugins install @pidgeon-ai/openclawRequires a build with ClawHub-default support.
@pidgeon-ai/openclaw
Email for OpenClaw. Mail to your agent's Pidgeon address starts an OpenClaw conversation, one per email thread, and the agent's answer goes back as a reply in that thread. A reply to the reply continues the same conversation.
openclaw plugins install @pidgeon-ai/openclaw
openclaw config set channels.pidgeon '{}' --strict-json
openclaw channels login --channel pidgeon
channels login opens Pidgeon's sign-in in your browser. You choose what the
channel can do and which addresses it reaches; the channel only needs read and
send. On a server with nobody there to sign in, give the Gateway an API key in
PIDGEON_API_KEY instead and skip the login.
Then check it:
openclaw channels status --channel pidgeon --probe
OpenClaw asks you to accept the plugin's capabilities when it installs; a
scripted install passes --accept-capabilities.
Requires OpenClaw 2026.10 or later. Pure TypeScript, no native code: run end to end on macOS, and installed and loaded on Linux x64 and arm64.
What reaches the agent
- The Firewall's clean text. The agent reads the email as a person would see it, with hidden text removed, never the raw HTML. Its sender, address, subject and attachment names come first.
- Not spam, and not what the Firewall flags. Mail Pidgeon filed as spam
is never a turn. Mail Pidgeon Firewall
marked suspicious — addressed to an AI, asking to send mail elsewhere — is
held in the inbox, and
openclaw channels statuscounts it. Set"suspicious": "deliver"to have it delivered with the warning instead. - Only new mail. A first start begins at the present; installing the channel does not answer a mailbox's history.
How it stays up
It reads Pidgeon's event log every five seconds from a cursor kept in
OpenClaw's state store, and puts each message in OpenClaw's durable ingress
queue before the cursor moves. A dropped connection is one failed request; a
Gateway restart resumes from the cursor; mail sent while the Gateway was down
is answered when it is back. Every failure is retried and reported:
channels status says recovering with the reason, or blocked when it is
not signed in, never running while nothing arrives.
Settings
All optional, under channels.pidgeon in openclaw.json:
| Setting | Default | What it does |
|---|---|---|
addresses | every address it reaches | Which of your addresses start conversations |
dmPolicy | "open" | "allowlist" to answer only allowFrom, "disabled" for nobody |
allowFrom | [] | Senders for "allowlist": ana@customer.com, or @customer.com for a domain |
suspicious | "hold" | "deliver" gives flagged mail to the agent with the Firewall's warning |
pollSeconds | 5 | How often it reads new mail, from 2 to 300 |
apiKeyEnv | "PIDGEON_API_KEY" | The environment variable holding a key, when not signed in |
baseUrl | "https://pidgeon.ai" | Only for a Pidgeon you run yourself |
accounts | Named accounts, each with these settings; the top level is what they inherit |
Replies only: the agent answers the email in front of it, or another one by
message:<id>. It cannot write to a new recipient or start a new thread, so a
prompt in one email cannot send mail anywhere.
The full setup is at pidgeon.ai/docs/openclaw.