Mail

Every email your sites send is caught by Mailpit and kept on your computer. Nothing reaches a real inbox, so a password reset or an order email is safe to test.

How it's caught#

PHP's mail() hands every message to Mailpit, on every site. That covers WordPress and plain PHP, whether the mail comes from a page, a cron run or cove wp. A Laravel app is set up with the sendmail mailer, which goes the same way:

MAIL_MAILER=sendmail
MAIL_SENDMAIL_PATH="/Users/you/Cove/App/cove-sendmail.sh -t"
MAIL_FROM_ADDRESS=hello@myapp.localhost

Anything that sends over SMTP can use Mailpit directly: 127.0.0.1, port 1025, no username or password.

Reading it#

Open mail in the dashboard, at https://cove.localhost/mail. New mail arrives while you watch.

• Each message has a chip for the site that sent it. Click it to see only that site's mail, at /mail/<site>.
• A message opens beside the list as html, text or headers. The HTML runs no scripts and loads nothing from the internet. Images sent inside the message show, and remote ones are blocked.
• Every link in a message is pulled out into a row with a copy button, since most local mail exists to carry a reset or login link.
• Mark a message unread or mark them all read, delete one, or delete everything that matches.

Mailpit's own interface is at https://mail.cove.localhost, if you prefer it. Both answer only on your own computer.

How long it's kept#

Forever, until you delete it. Mailpit normally keeps only the last 500 messages; Cove lifts that limit, because the point of catching mail is having it later.

For scripts and agents#

An AI agent connected through cove mcp can read a site's mail, with its links as a list, which lets it finish a sign-up or password reset on its own. See AI agents.

While cove demo is on, only the demo sites' mail shows. Mail from other sites is held and delivered when you run cove demo off.