Changelog.

Invites your agent’s inbox receives from Google Calendar, Outlook, Apple Calendar, Calendly or Zoom become events it can read and answer: accept, decline, tentative, or propose another time. The answer goes to the organizer only, never to Reply-To or the other guests, and their calendar updates as usual. GET /v1/inboxes/:id/calendar/events lists them and POST /v1/calendar/events/:id/respond answers.

POST /v1/inboxes/:id/calendar/events sends a calendar invitation that lands in people’s calendars, with a video link, a series rule or a note if you like. PATCH changes it for everyone and POST /v1/calendar/events/:id/cancel calls it off. Guests’ answers come back as calendar.response.received.

A series is one event with its rule. List with expand=occurrences to get each date between from and to (two years at most per list), each with the series’ id and series_id; truncated says when a series had more dates than one list gives.

Add draft: true to respond, create, update or cancel, and nothing is sent: the email waits as a draft in Approvals, and the meeting changes only when a person sends it. It needs drafts:write instead of messages:send. If the meeting changed in between, the send is refused (calendar_event_changed) and nothing goes out.

Invite text is screened for prompt injection before your agent sees the event, and a held invite shows no content until a person releases it. organizer_verified, from DMARC, says whether the organizer is who the invite claims. Nothing is sent because mail arrived: every answer and invitation is a call your code makes, through the same limits and checks as any send.

New events: calendar.invite.received, calendar.event.created, calendar.event.updated, calendar.event.cancelled and calendar.response.received. Every email that carries a meeting has calendar: { event_id, method }, with event_id null when it changed no meeting. Reading meetings needs calendar:read; answering and sending them needs calendar:write and messages:send, or drafts:write with draft: true. The Full access and Send & read presets have both calendar permissions, Read only has calendar:read.

The TypeScript and Python SDKs (agentboxd) have a calendar namespace: list, listAll (list_all in Python), get, respond, create, update and cancel, with the expand and draft options.

Six tools: list_events, get_event, respond_to_invite, create_meeting, update_meeting and cancel_meeting. list_events takes expand: "occurrences", and the four that send take draft: true to save a draft for a person to approve.

agentboxd events list (with --expand for each date of a series), events get and events respond (with --draft to save the answer for a person to approve).

Each inbox has a Calendar tab: the invites waiting for an answer and what is coming up. An email with an invite shows it in place, with Accept, Tentative and Decline. Meeting drafts appear in Approvals with what approving does: the answer, the new meeting, the change or the cancellation, and who it adds or takes off.

Rollcall is open at agentboxd.com/agents. Set an agent’s card to public and anyone can find it, look it up without an API key and read its page, within your plan’s listings (3 on Free). Its page stays out of search engines unless you also make it indexable. Until 26 October 2026, every new or changed public card is reviewed by our team after a screen that runs on our own servers, so a listing can take a little while to appear.

Give a listed agent a handle such as @acme/billing that resolves to its address, in the API, in the MCP server’s resolve_agent and on the agent’s page.

At levels 4 and 5, an email that screening couldn’t read in full is now held, as the level cards say. At levels 4 to 6, the guard now waits until your attachments have been read and checked. If that takes more than 15 minutes, the email is held and your timeline says why.

Add an agent’s inbox to Apple Mail, Outlook or Thunderbird as an IMAP account (imap.agentboxd.com, port 993, SSL/TLS) to see what your agent sees. It is read-only: your mail app can’t send, delete, move or mark anything as read. Owners create an app password per device under the inbox’s Settings › Read in your mail app (IMAP); revoking one cuts that device off within two minutes.

Each webhook’s delivery log now shows the response time next to the status code and error, marks failed deliveries, filters to failures only and pages back as long as the events are kept. Redeliver sends a delivery again: the same payload, signed with a fresh timestamp. The API has GET /v1/webhooks/:id/deliveries with a cursor and POST /v1/webhooks/:id/deliveries/:deliveryId/redeliver, and both SDKs have them.

A new Suppressions page lists the addresses your workspace no longer writes to, with the reason (hard bounce or complaint) and the date, and lets you remove one. Removing a bounce or complaint asks you to confirm first, because writing again to a bad address hurts your deliverability, and every removal is recorded as a suppression.removed event. GET /v1/suppressions and DELETE /v1/suppressions/:address do the same; MCP clients can read the list with list_suppressions.

In a workspace that gives agents only screened mail (the default), automatic forwarding now sends only screened mail too. Mail held for a person, and mail still being checked, is not forwarded; when someone releases held mail, it is forwarded then.

Free workspaces can now have 3 people, so you can invite your team without changing plans.

The account menu has Delete account. It shows what happens to each of your workspaces first: one you are the only member of is deleted with your account, you leave the others, and if you are the last owner of a workspace other people use, you make someone else an owner first. A paid subscription that still renews is cancelled under Manage billing first. You type your email address to confirm; every session ends and you get a confirmation email.

Every refused send now has a stable code, a message that says what happened and how to fix it, the specifics in details (which recipient, which limit, until when) and a docs_url to its entry on a new page that lists every code. The SDKs expose docsUrl / docs_url, MCP tools return the same, SMTP replies carry the same reason and link, and a failed message says why in headers.x-mailroom-error-code.

When a workspace nears a bounce or complaint limit, its owners get one email saying what is happening and how to fix it. Over the limit, sending pauses (403 sending_paused) instead of suspending the workspace: mail keeps arriving, the API and dashboard keep working, and queued mail waits. Clear abuse and a second pause within 30 days still suspend.

A paused or suspended workspace has a Request review button on its banner: say what happened and what you fixed, and a person resumes sending, usually within one business day. Owners are emailed at every step.

A new Team page: owners invite people by email as a member or an owner, resend or revoke an invite, change roles and remove people. Members see the team and can leave. The invite link works once for 7 days and signs the person in; members and pending invites count as seats, and Seats used shows on the plan again.

If you belong to more than one workspace, the account menu lists them and switches with one click.

Webhooks and the event stream get member.invited, member.invite_revoked, member.joined, member.role_changed and member.removed: a record of who joined, left and could do what. The API keys a person created stay with the workspace when they leave.

When you create a key, pick when it stops working: never, in 30, 90 or 365 days, or on a date. After that, every call with it gets 401 api_key_expired, and SMTP submission and the event stream refuse it. The API keys page shows how long each key has left, and workspace owners get one email a week before a key expires.

The Inboxes page has an All mail tab: the mail of every inbox in one list, newest first, with the inbox on each row and the same filters (unread, held, needs a person, labels). A message opens in its own inbox. The API behind it is GET /v1/messages, also in both SDKs and the MCP server’s list_messages.

An inbox’s Settings → Forwarding now says plainly how to get its mail in Gmail, Outlook or any mail app, and what is not forwarded.

The everyday pages come first (Overview, Approvals, Inboxes, Contacts, API keys, Webhooks, Domains); allow and block lists, Shakehand, connected apps, knowledge and human on call sit under Advanced, which opens by itself on those pages. Each inbox has three tabs: Mail, Drafts and Settings, where sign-in, the agent card, on call, forwarding and mail sorting are sections. Old links still land in the right place.

Search mail in every inbox from the top bar (press /), or in one inbox from its toolbar. Inbox lists, contacts and knowledge now load more on request instead of stopping at the first page, and a link to any message opens it even when it is older than the list.

The inbox’s ⋯ menu has Delete inbox. You type the address to confirm, and the dialog says what happens: queued mail isn’t sent, open drafts are cancelled and the address is never given out again.

The new key’s dialog shows the MCP config and a first curl call with the key filled in, and the hosted MCP server. It closes only with “I saved it”. With an inbox in the workspace, a new key starts scoped to one inbox with Send & read.

Where send limits show, a new workspace sees its lower limits and when they end, then what applies. GET /platform/plan returns them as new_workspace.

A new page lists the apps your agents can sign in to with Shakehand, starting with Runboxd, and the dashboard’s Shakehand page shows the same list. Building a tool for agents? Add Sign in with Agentboxd in 5 minutes, then ask to be listed.

A new Approvals page lists the drafts of every inbox that wait for a person, with a count in the sidebar. Each draft opens as a card: the message it answers, then the reply, then Approve & send. Human on call can email you for each new draft (the draft_created trigger, off by default).

A code or link from mail that failed DMARC, or failed SPF without a matching DKIM signature, now carries auth_failed: true. GET /v1/inboxes/:id/verification, the SDKs and the MCP get_verification_code tool skip it unless you pass include_unauthenticated. The dashboard shows such a code as a warning, without a Copy button.

The Overview starts with what waits for a person: drafts to approve, held mail, mail labelled ai:needs-human and recent bounces, each linking to a filtered view. GET /v1/inboxes carries the matching counts, and the message list filters by status.

Downloading an attachment from, or forwarding, a held message or one flagged as phishing, prompt injection or a DMARC failure now asks you to confirm. Mail with hidden HTML text says so and shows that text as plain text on request.

Mail from automated senders (no-reply addresses, notifications, auto-replies) no longer creates contacts, and mailing lists add only the person who wrote. The people in To and Cc of mail you receive now become contacts too. Each new contact is sorted once as a person, automated, sales or not sorted yet; writing to someone makes them a person, and you can change it yourself. The dashboard shows people first.

Remove every automated or sales contact at once, from the dashboard or with POST /v1/contacts/delete (try it with dry_run first). Delete with forget and mail from that address no longer adds the contact back; Agentboxd keeps only a keyed hash of the address, and the mail itself stays. Your agent can delete a contact with the new delete_contact MCP tool when you ask it to.

See which companies you talk to: contacts grouped by domain, in the dashboard and with GET /v1/contacts/domains, free email providers left out. Each contact also carries the subject of the latest message, so your agent knows what you last talked about without reading the thread.

To find the new part of a reply, we now read the top of each message. If the quoted history doesn’t start near the top of a long message, for example when the answers sit between quoted lines, extracted_text holds the full text.

SMTP submission now refuses a recipient that isn’t a single plain address, for example one with quotes, a comment, a comma or a semicolon in it, with 553 5.1.3. Addresses on international domains are sent in their xn-- form, so the suppression list and your send lists apply to them too.

When an app that signs agents in without registering sends a sign-in request with a mistake (no state, no PKCE, a scope it can’t have), Agentboxd now shows an error page instead of sending the browser back to the app. Anyone can publish such an app, so this stops links on Agentboxd from forwarding people to any site. Registered apps still receive errors at their redirect URI.

A hard bounce or a spam complaint now suppresses the address for the workspace that sent the mail, not for every customer. Another workspace’s bounces and complaints no longer stop you from writing to an address. Your own suppressions from before are kept.

Show original still blocks remote images, so a sender can’t tell you opened their message. A new Load remote images button loads them for that one message, when you choose to.

New workspaces now keep unchecked and suspicious mail away from their agents. An API key or MCP client gets a message’s content only once its prompt-injection and phishing check completed without a warning, on every path: the claim queue, messages/wait, verification codes, reading, threads, search, attachments and webhooks. Mail that was flagged, or whose check failed or was skipped, is held: agents see that it exists, never what it says. The dashboard shows held mail with the reason, a badge per inbox and a Release to agents button, and the people on call are told. Releasing needs a person, or a key you explicitly give the new messages:release permission. Existing workspaces keep getting every message until an owner turns on "Agents get only screened mail" in Settings. With AI processing off, mail isn’t checked and agents still get it; the message says so. Webhook handlers should take message.received, message.enriched and message.released, skip events whose content is withheld, and handle each message once: the guides and examples now do.

An app can accept agents without registering: publish a small JSON file and use its URL as the client_id. Agents sign in headless with one API call; web apps get the usual button. Every ID token now also carries actor_type: "agent".

Opening a received message in the dashboard marks it read. On the MCP server, get_message and get_thread stay read-only unless you pass mark_read: true, and the new mark_read tool sets either state. The API stays explicit: reading never changes is_read. Received messages carry auto_reply: true for out-of-office and other automatic replies, from their headers or the ai:auto-reply label, so agents can leave them unanswered. A message whose recipients are all Agentboxd inboxes is now delivered, not just sent, so message.delivered now also fires for mail between agents.

Owners find Stop all agents in the dashboard top bar, next to their account, as well as in Settings. While the workspace is stopped the top bar says so, and the banner below it has Resume. The Overview names the period of each panel and no longer reads a lack of delivery confirmations as a failure.

Approving a sign-in lets an app act as one of the workspace’s agents, so owners can approve as any agent and members only as agents they created; Agentboxd now records who created each agent. Agentboxd’s own products show a "Verified Agentboxd product" mark, and no other app can use their names. The consent page is also in French, following your browser.

A new check on our own server reads every received message in full, including text hidden in the HTML (invisible fonts, white on white, off-screen text, comments) and text past what the AI check reads. Mail that tries to instruct an AI gets the label local:injection-risk, with the reasons in ai.local_screen. It runs with AI processing off too, and nothing leaves the server for it. With AI processing on, JEV now also reads the hidden HTML text and a sample from further down a long message, clearly marked.

Bulk marketing gets the label local:spam. In the dashboard, mail labelled local:spam or ai:sales can be kept out of the main list and shown under Promotions & spam; it is never deleted, and the API still returns it (?promotions=exclude or only). On by default for role addresses such as hello@ and support@, and a switch on every inbox.

Runboxd, our product that gives agents their own computers, signs in with Shakehand. Every Agentboxd plan now includes some Runboxd capacity: 1 computer and 20 computer hours a month on Free, more on paid plans after the beta. The pricing page lists it per plan and links to Runboxd’s own plans, which add to it. Runboxd receives your workspace’s id, name and plan when you sign in to it; other apps never do without your opt-in.

A workspace an agent created and no person has claimed can now schedule sends at most 24 hours ahead, to at most 20 different people, the same as its daily limit. New workspaces also pause sending after 3 hard bounces in their first sends, instead of waiting for 20 sends. This protects the shared sending reputation every customer relies on.

When a receiving server answers "try again later" (greylisting, a rate limit), we now keep trying for about 48 hours instead of a few minutes, like any mail server. Meanwhile the message stays queued, with the server’s answer in its headers. As soon as one recipient has it, it shows as sent and message.sent fires; the others keep being tried, and nobody gets it twice.

On a verified domain of your own you can now create no-reply@ and noreply@ inboxes, as you already could postmaster@, abuse@ and dmarc@. These names stay reserved on our domains.

A draft that goes out now names the person, API key or connector that approved it, when, and a hash of exactly what they approved. It shows in the dashboard, in GET /v1/drafts and in the draft.sent event, and the sent message keeps the same record after the draft is deleted, so a security review can trace each send to a name. Changing what a scheduled draft sends puts it back to draft, to approve again.

Every incoming message and every attachment you send is now scanned for malware on our own server. Infected mail is refused before it is stored, so your agent never sees the file; a send with an infected attachment fails with 422 attachment_infected.

An inbox can now copy every email it receives to up to 3 outside addresses, for example so a person sees what reaches hello@ in their own mailbox. Each address confirms by email first, mail flagged as phishing or prompt injection stays behind, and copies can never loop. Messages also have a Forward button in the dashboard, and the MCP server a forward_email tool.

Adding a custom domain now reads its nameservers: the dashboard tells you where its DNS is hosted, opens that provider’s steps (Cloudflare, GoDaddy, Namecheap, Route 53, OVHcloud, Gandi, IONOS and more) and gives each record’s exact host part. A record typed under its full name, and so published twice over, is pointed out with the fix.

The whole /v1 API is described in OpenAPI 3.1 at /openapi.json, for Postman, Insomnia, client generators and agents; it is generated from the routes themselves, so it stays in step. Add .md to any docs page URL for a plain-markdown copy.

GET /v1/threads lists threads across every inbox a key can see, for a supervisor agent or your own dashboard. Filter by inbox, labels, date, participant or subject, oldest first if you like; the per-inbox list takes the same filters. DELETE /v1/threads/:id removes a thread with its messages and attachments.

Forward a message to new recipients with a note and its attachments (POST …/messages/:id/forward). Fetch up to 100 messages in one call, or apply the same labels and read state to all of them (POST /v1/messages/batch-get and batch-update). In both SDKs.

Add up to 10 headers to every delivery, such as your own Authorization token, next to our signature. Values are stored encrypted and never shown again; the webhook lists only their names.

The protections every message goes through now have one name and one page: sender checks, prompt-injection and phishing scores and untrusted-content markers on the way in; send limits, suppression and automatic suspension on the way out.

For its first 3 days a new Free workspace sends at most 20 emails a day and 10 per 5 minutes, then the plan’s limits apply. The workspace’s new_workspace_limits_until says when, and the 429 error says so too. Paid plans are not affected.

When an Outlook or Hotmail user marks mail from Agentboxd as spam, Microsoft now reports it to us: the recipient is suppressed, the message is marked complained (message.complained) and the workspace’s complaint rate counts it. Only reports carrying the provider’s own signature count.

What we plan to build next (an approvals hub, a signed activity ledger, outgoing mail checks) and later, and what we are only exploring.

The TypeScript SDK now includes the command line (npx agentboxd) and the agent-directory and signing-key helpers, and the MCP server has 45 tools, including the directory, agent keys and emergency stop.

An agent can register its own Ed25519 or P-256 signing keys (the private key never leaves it) with a proof of possession, rotate and revoke them, and sign what it writes: send and reply take agent_signature, and recipients get author: { verified, kid } next to our own per-copy signature, which now names it. The signature covers the text, HTML, data and attachments exactly as written, so it proves who wrote a message even to parties that don’t trust us. A signed message goes out exactly as signed: it keeps the Agent-Disclosure header and the signed disclosure claim, but no visible disclosure line is added, so put one in your own text before signing if you need it. New in both SDKs: generateAgentKey, createKeyProof, signAgentMessage and verifyAuthorSignature (and their Python equivalents).

An agent whose address is on a custom domain your workspace verified now carries the domain-verified badge and assurance domain_verified, on its card and in the signatures of its messages. It follows the domain: if the domain stops verifying, the badge goes too.

Export your agent’s card as an OASF record (GET /v1/inboxes/:id/agent/oasf) for directories that speak the Open Agent Schema Framework. Publishing it (and a signed A2A agent card) for anyone opens with the public directory.

The Agent tab of an inbox lists the agent’s keys (retire, revoke), shows the domain-verified badge and exports the card as OASF. The MCP server adds list_agent_keys; search_public_agents and handles in resolve_agent answer once the public directory opens.

On 26 October 2026 you can opt in to list an agent publicly at agentboxd.com/agents under a handle such as @acme/billing, within your plan’s listings (3 on Free, 25 on Builder, 250 on Team). Until then public visibility and handles are refused. Scheduled sub-processor change, effective 26 October 2026 (notice sent 26 September 2026): JEV will also read the text of agent cards a workspace lists publicly (name, description, skills, address), to check them for impersonation and prompt injection before they are listed.

Every email your agents send now carries an Agent-Disclosure header saying an AI agent sent it and for whom (your custom domain, or the workspace name if you allow it), covered by our DKIM signature. A visible line is optional per workspace under Settings; by default mail still goes out exactly as written. Received mail shows the sender’s disclosure as ai_disclosure, marked verified only when we could check it.

Stop every agent in a workspace with one click in Settings or POST /v1/emergency-stop (new permission workspace:emergency): no sends, identity tokens or scheduled sends until an owner resumes, while mail keeps arriving and everything stays readable. Owners get an email, and webhooks get workspace.stopped and workspace.resumed.

Name up to five people who get an email when mail needs a human or looks like phishing, a scheduled send fails, or the workspace is stopped. Addresses confirm first; alerts respect an hourly limit, optional digests and quiet hours, and leave the message body out unless you ask for an excerpt. Per-inbox overrides, GET/PUT /v1/escalation, SDK and MCP tools.

Give any agent an identity in one call — inbox optional. POST /v1/identities creates an agent that signs in to apps with Sign in with Agentboxd but has no mailbox: its tokens carry no email and a new mailbox: false claim, mail to its handle is refused and it can’t send. Identities have their own plan limit (Free 100, Builder 1,000, Team 10,000) and don’t count toward inboxes. In the dashboard (Identity → New identity), both SDKs (identities.create), the MCP server (create_identity, list_identities) and agent self-signup (kind: "identity").

New product names: Homingbox (email inboxes for agents) and Shakehand (agents sign in to your app), alongside aSIM. Only the names changed: the API, the SDKs, the MCP server, webhook events and the Sign in with Agentboxd button are the same, and /agent-login now redirects to /shakehand.

Agentboxd is in public beta: free during the beta, paid plans open later at $15 Builder and $60 Team. Homingbox and Shakehand are both in beta. Every workspace uses the Free limits; need more? Write to hello@agentboxd.com, or use Request higher limits under Settings, and a person raises them. You’ll get notice before any paid plan starts, and nothing is charged automatically. Promo codes for startups and hackathons work during the beta and after it.

The pricing page now covers each product. Shakehand: apps are free and unlimited on every plan, and Free includes 100 identities without a mailbox and 10,000 sign-ins a month. aSIM shows its planned pricing (early access): agent-to-agent messages free on every plan under fair use. Paid plans get add-ons after the beta, such as a dedicated sending IP at $29 a month with warm-up and monitoring, +100 inboxes at $3 and +1 seat at $5. Plan prices are unchanged, and everything paid still starts after the beta.

Version 0.2.0 of the agentboxd npm package adds a command line. Log in once, then create and pause inboxes, send and reply, list and read mail, wait for a verification code (it prints just the code), watch events live over the stream and approve drafts. --json on every command for scripts and agents.

A skill that teaches Claude Code, Cursor, Codex, OpenClaw and other agents when and how to use their inbox through the MCP tools, the CLI or the SDKs, with the rules for untrusted mail. It installs with npx skills add agentboxd/skills.

Workers claim inbound mail with a lease and ack it once the work is done, so a message whose worker crashed is handed out again instead of lost. nack retries with a delay, extend keeps a long job’s lease, and a message that fails 10 times becomes a dead letter. consume() in both SDKs, claim_messages and ack_message in MCP, and queue depth in GET /v1/metrics.

A LiveKit voice agent that emails follow-ups and call summaries, ADK function tools whose sends a person confirms, Sim custom tools and a webhook-triggered workflow, and a Replit template for webhooks or the event stream. Each has a runnable copy checked against a live stack.

The sub-processor list has a “Notify me of changes” form. Confirm your address once and we email you whenever a processor is added or replaced, at least 30 days before it receives any data, with an unsubscribe link in every message. The address is stored encrypted and used for nothing else. The list itself now says in one line what it covers: three sub-processors, an EU-hosted core, no analytics or trackers.

Mail between two Agentboxd inboxes now arrives as an agent message: channel: "agent", a verified sender in message.agent, and a signature per recipient that anyone can check against our published keys. Send a type (message, task, event) and structured data with the same send and reply calls; people in the same send get normal email with the data attached, and threads mix both. In both SDKs (with verifyAgentMessage / verify_agent_message), MCP (send_message, reply_to_message) and SMTP submission. Sub-processor scope: when AI processing allows it, JEV now also sees up to 1,000 characters of an agent message’s structured data, so injection scoring covers it.

Give an agent a card that says what it is, what it can do and what it accepts: PATCH /v1/inboxes/:id/agent, or card on POST /v1/inboxes in the same call. Cards are private until you list them in your workspace directory. Other agents look a card up by address (GET /v1/directory/resolve), your agents search your workspace (GET /v1/directory/search), anyone holding a signed agent message can check its sender is still in good standing (POST /v1/directory/verify), and abuse can be reported. Revoking a card stops the agent signing at once; deleting it removes it at once. New permissions directory:read and directory:write, events agent.updated, agent.revoked, agent.deleted and agent.reported. In both SDKs (agents and directory, and checkRevocation in verifyAgentMessage), and MCP (resolve_agent, search_agents, verify_agent_message, update_agent_card).

Receive lists take three new tokens: agents:any, agents:verified and workspace:self. Allow agents:verified on an inbox and only signed messages from agents with an active card in a claimed workspace reach it; plain email never matches a token, whatever its From says.

Sending to an address in your own workspace that has no inbox (a deleted inbox, or your verified domain) now fails at once with 422 recipient_not_found. An unknown address on our domains is no longer put on the suppression list, so an inbox created later under that name receives mail.

New inboxes now get an address on homingbox.net, Homingbox’s own domain, such as support-bot@homingbox.net. Inboxes you already have keep their agents.agentboxd.com address and keep receiving and sending exactly as before; nothing to change in your code. Temporary inboxes stay on tmp.agentboxd.com, and your own domain works on every plan.

Add Agentboxd to Claude (claude.ai, desktop and mobile), Claude Code, Cursor or any MCP client by pasting https://mcp.agentboxd.com/mcp and signing in. You choose what the app may do and whether it sees the whole workspace or one inbox; every connected app is listed on Connected apps, where one click disconnects it. No Node install and no API key to copy. Webhooks get connector.authorized and connector.revoked.

Agentboxd is now three products. Agentboxd Mail is the email inboxes. Agent Login, Sign in with Agentboxd, has its own page for the apps that let AI agents sign in and the agents that do. aSIM, a SIM card for AI agents that makes them reachable, verifiable and discoverable, is in development: its page has the plan and an early-access list. Nothing in aSIM is live yet.

An agent with no API key can create its own workspace and inbox: Agentboxd.signup() in both SDKs, or the signup tool when the MCP server starts without a key. Until a person claims it from the emailed link, it replies freely but emails at most 20 new recipients a day.

Attachments are read on our servers: PDFs, Word, Excel, CSV and HTML directly, scans and photos by OCR. Read the text with one call, find mail by what its attachments say, and turn invoices, receipts and tax forms into validated JSON. Two new MCP tools and methods in both SDKs. Sub-processor scope: when AI processing allows it, JEV now also sees up to 2,000 characters of attachment text for categorisation, and DeepSeek receives the document text (up to 40,000 characters) only when you request structured extraction with AI processing set to full. The sub-processors themselves are unchanged; text extraction and OCR run on our own servers.

A kill switch for a misbehaving agent: POST /v1/inboxes/:id/pause (or the Pause button) refuses every send from the inbox while mail keeps arriving, and resume delivers the held events in order. In both SDKs and as pause_inbox and resume_inbox in MCP.

A guide to staying out of spam, and GET /v1/deliverability: your bounce and complaint rates, suppressed contacts, domain authentication and our sending IP’s blocklist status, also on the Overview.

Rotate a domain’s DKIM key from its page or the API without a gap in signing, with a yearly reminder.

Give an OpenClaw agent its own inbox: the MCP server under mcp.servers and an email skill with the safety rules.

Builder for 3 months for hackathons and Team for 6 months for early-stage startups. Apply by email and redeem the code under Settings.

HTML drafts now show a sandboxed preview in the Drafts tab, and their HTML can be edited or removed before you approve them.

Every inbox is now also an identity. Your agent asks for a 5-minute, single-use ID token and signs in to apps that accept it, over standard OpenID Connect at id.agentboxd.com. Apps register in the new Identity page of the dashboard.

Agents can write drafts that a person approves in the inbox’s Drafts tab, and any draft or send can be scheduled 1 minute to 30 days ahead with send_at. Six new MCP tools, and drafts in both SDKs.

The webhook events over a WebSocket at /v1/stream, with replay after a disconnect. No public URL needed. mr.stream() in the TypeScript SDK and AsyncAgentboxd.stream() in Python.

Send from any SMTP client on smtp.agentboxd.com, ports 587 and 465, with an API key as the password. Messages go through the same checks and delivery as the API.

Free, Builder, Team and Scale plans measured in emails and AI calls, with overage on paid plans. Mail is kept for the plan’s retention (the keep label opts a message out), and a 5-minute send limit stops runaway loops.

Scoped API keys with permission presets, allow and block lists, a metrics overview, a webhook event catalog with envelope (no-body) payloads and 24-hour delivery stats, and a “Use the API” button with the calls for the page you’re on.

What protects your agents’ mail today and what is still planned, a GDPR Data Processing Addendum, the list of sub-processors, and /.well-known/security.txt.

The service runs in France (EU). Nightly backups are now encrypted before they leave the server, kept on a second EU server, and restore-tested; health checks run every 5 minutes.

Webhook URLs must be public HTTPS endpoints. Hostnames are checked when you save a webhook and again before every delivery, and redirects are not followed.

Step-by-step guides for MCP clients, LangChain, CrewAI, the OpenAI Agents SDK, the Vercel AI SDK, n8n and Playwright, each with a runnable example.

New name, same service. The packages are agentboxd and @agentboxd/mcp on npm (the Python agentboxd package is coming soon to PyPI), and the SDKs read AGENTBOXD_API_KEY (the old variable names still work).

Create an inbox with one API call and receive mail on our own MX, with SPF, DKIM and DMARC checks, threading, attachments and extracted_text. Agents send and reply DKIM-signed from their own address.

waitForVerification returns the login code or magic link from a sign-up email with a confidence score.

JEV categorises every inbound message and scores prompt injection, phishing, needs-a-human, auto-reply and urgency. One workspace setting (off, categorize or full) decides what content may reach a model.

A contact per sender with notes and metadata, searchable knowledge documents, and DeepSeek reply drafts that cite them and are never sent on their own.

Send and receive on your own subdomain with its own DKIM key, and create receive-only inboxes on tmp.agentboxd.com that wipe themselves when they expire.

An MCP server for Claude Desktop, Claude Code and Cursor, and TypeScript and Python SDKs.

Signed webhooks with retries, long-poll wait endpoints and full-text search.