AbdelftahZowail/Quickly

Selection

Select when

• You need a self-hosted alternative to hosted cold-email campaign platforms.
• You want Gmail, Microsoft 365, Outlook.com, and SMTP senders in one campaign system.
• You need REST, webhook, n8n, or MCP access to outreach and lead workflows.
• You want reply classification through either hosted AI providers or local Ollama.
• You can administer PostgreSQL, OAuth applications, TLS, backups, and email-provider settings.
• You need campaign sequencing, inbox rotation, reply tracking, and analytics in one application.
• You are prepared to review applicable anti-spam law and provider acceptable-use policies.

Boundaries

Avoid when

• You need a native Claude Code plugin, hook, skill, or verified Claude-specific installation path.
• You want a coding-agent framework rather than a sales-outreach application.
• You cannot operate a database-backed internet service or manage production secrets.
• You require a fully audited security and privacy posture.
• You need turnkey mailbox OAuth without creating Google or Microsoft application credentials.
• You cannot accept the compliance and sender-reputation risks of automated outreach.
• You require verified MCP tool schemas, permission boundaries, or Claude Code compatibility from the supplied evidence.
• You need guaranteed encryption at rest without validating the separate encryption-key configuration.

Strengths

Capabilities

Risk profile

Risks and limitations

• Uncertainty: only selected first-party files were supplied, so MCP tool definitions, API implementation, authorization checks, queue behavior, tests, migrations, and backup code were not directly inspected.
• Uncertainty: repository creation, update, push, and example timestamps extend into 2026 relative to this analysis context, so recency and release state cannot be independently reconciled.
• Uncertainty: no supplied file documents Claude Code configuration, minimum version, integration testing, or native extension packaging.
• Uncertainty: the exact scope and write impact of the lead-related MCP tools cannot be established without the referenced docs/MCP.md file.
• The application disables Fernet protection and stores sensitive columns, including SMTP and IMAP passwords, as plaintext when QUICKLY_ENCRYPTION_KEY is absent.
• The installation guide emphasizes QUICKLY_SECRET_KEY but its supplied environment-variable table does not document QUICKLY_ENCRYPTION_KEY, increasing configuration risk.
• The repository claims self-hosted data control, but Gmail, Microsoft, SMTP, verification, webhook, tracking, hosted AI, and PaaS integrations can transmit operational or lead data externally.
• The n8n package contains placeholder repository and homepage URLs and describes Community Nodes UI installation conditionally on future npm publication.
• The two supplied READMEs differ on first-login wording, with one describing username/password registration and the installation guide directing Google or Microsoft sign-in.
• Production deployment requires OAuth applications, sender permissions, DNS, HTTPS, database persistence, and deliverability controls beyond starting containers.
• Tracking pixels, link wrapping, cold outreach, and automated classification introduce legal, consent, privacy, and provider-policy obligations not assessed by the repository evidence.
• No independent security audit, privacy assessment, deliverability benchmark, MCP safety review, or production compatibility matrix was supplied.

The supplied code implements JWT HS256, bcrypt, HMAC API keys, optional Fernet-backed SQLAlchemy fields, SSRF checks against private and reserved networks, webhook URL validation, hostname validation, CSP, frame denial, MIME sniffing protection, referrer and permissions policies, and proxy-aware HSTS. OAuth connects Google and Microsoft accounts, while n8n can use API keys or short-lived JWTs. Important caveat: if QUICKLY_ENCRYPTION_KEY is unset, the code explicitly leaves sensitive columns such as SMTP and IMAP passwords in plaintext; operators must also set a stable QUICKLY_SECRET_KEY to prevent session invalidation. No independent audit or complete authorization review was supplied.