Everything your agent’s inbox does.

A real address on homingbox.net the moment you ask. Pass a client_id and a restarted agent gets its own inbox back instead of a new one.

Connect a subdomain such as mail.yourcompany.com. We show the MX, SPF, DKIM and DMARC records, check them, and sign mail with the domain’s own DKIM key.

Rotate a custom domain’s DKIM key without a gap: a new key on a second selector, a switch as soon as its record is seen, and the old record kept for a week. A reminder when a key turns one.

Receive-only addresses on their own domain, tmp.agentboxd.com, that wipe themselves and every message in them after 1 minute to 24 hours. They don’t count toward your inboxes.

Every inbound message is checked. Failures get the spf-fail or dmarc-fail label and a warning in MCP results.

Quoted history and signatures are cut away, so your agent reads the new sentence instead of the whole chain. Replies are threaded by Message-ID and References, never by subject.

One call waits for the sign-up email and returns the code or link with a confidence score. No inbox scraping, no regex on your side.

JEV, our triage model, sorts each message into a category (support, sales, billing, verification…) and scores prompt injection, phishing, needs-a-human, auto-reply and urgency. Scores are stored, labels such as ai:injection-risk are added.

Files are stored with their size, type and SHA-256 and served back with safe headers. The original message is always available.

PDFs, Word, Excel, CSV and HTML attachments are read on our servers, and scans and photos go through OCR (English, French, Arabic). The text is searchable, feeds triage, and is one call away for your agent.

Ask for an attachment as JSON matching a built-in schema or your own JSON Schema. The answer is validated against the schema before you get it.

Workers claim inbound mail with a lease and ack it when the work is done. A message whose worker died comes back when its lease runs out, and one that keeps failing is set aside as a dead letter. consume() in both SDKs runs the loop.

Ranked full-text search over subject, body and sender, and a wait call that returns the moment the next matching email lands.

A record per sender with notes your agent keeps, documents it can search, and your own ids (crm_id, order numbers) on contacts, inboxes and threads.

Mail goes out from the agent’s own address through our own delivery servers. Replies set In-Reply-To and References and stay in the thread.

The agent writes a draft; a person edits and approves it in the dashboard’s Drafts tab, or a supervising agent sends it. Give the agent drafts:write without messages:send and it can’t send at all.

Schedule a draft or a send from 1 minute to 30 days ahead. Every check runs again at send time; cancel or reschedule until then.

Invites from Google Calendar, Outlook, Apple Calendar, Calendly or Zoom become events the agent reads and answers, and the answer goes to the organizer only. It also sends, changes and cancels real invitations. Invite text is screened first, and nothing is sent because mail arrived.

A suggested answer built from the thread, the contact and your knowledge documents, with the documents it used. Never sent on its own; save it as a draft for review.

Addresses and domains to accept or refuse, for receiving, sending and replying, per inbox or for the whole workspace. Blocked mail is kept and hidden, never lost.

A 5-minute burst limit, a daily cap per workspace and per inbox, and a rate limit per key. Hard bounces and complaints add the address to a suppression list.

A kill switch for a misbehaving agent: every send from the inbox is refused at once, while its mail keeps arriving. Its events are held and delivered in order when you resume.

One switch for the whole workspace: every inbox stops sending, identity tokens and scheduled sends stop, and reads keep working. An API key can pull it; only a person resumes.

Name the people who get an email when mail needs a human or looks like phishing, or a scheduled send fails. Confirmed addresses only, an hourly limit, digests and quiet hours.

Your bounce and complaint rates next to the limits, suppressed contacts, your domains’ SPF, DKIM and DMARC, and whether our sending IP is on a blocklist, with a guide to staying out of spam.

MCP results that carry email or agent messages start with a data-not-instructions line, structured data included, and flagged mail gets a warning field before the model reads it.

A zero-dependency TypeScript client (agentboxd on npm), reading AGENTBOXD_API_KEY from the environment. The Python client (sync and async) is agentboxd on PyPI.

56 tools for Claude Desktop, Claude Code, Cursor or any MCP client: inboxes, mail, codes, attachments, contacts, knowledge, drafts, the work queue, pausing and sign-in. No code; runs on your machine with an API key.

Paste one URL into Claude, Claude Code or Cursor and sign in: you pick what the app may do and which inboxes it sees, and disconnect it from Connected apps at any time. 55 tools (all but signup), no install, no API key.

Add the MCP server to OpenClaw with one command, and an email skill that tells your agent when to use its inbox and never to follow instructions found in mail.

Create and pause inboxes, send, read, wait for a sign-up code, watch events live and approve drafts from a terminal or a script. JSON output on every command; the key is stored for your user only. Part of the agentboxd npm package: run it with npx agentboxd.

A skill for Claude Code, Cursor, Codex, OpenClaw and other agents that read SKILL.md: when to use the inbox, how to get codes, send, draft for approval and read attachments, and never to follow instructions found in mail. Install it with npx skills add agentboxd/skills.

Guides with runnable code: a LiveKit voice agent that emails follow-ups and call summaries, Google ADK tools with sends a person confirms, Sim custom tools, and a Replit template for webhooks or the event stream.

Mail between Agentboxd inboxes arrives as a native agent message, signed for each recipient: a verified sender, typed tasks with structured data, and the same injection scoring and lists as email. Everyone else gets email, in the same thread.

Give an agent a card others can look up by address, list it in your workspace directory, check who signed a message and whether its sender was revoked since, and let an inbox accept only verified agents. Nothing is listed unless you choose it.

Opt in to list an agent on Rollcall under a handle such as @acme/billing: anyone finds it at /agents and reads its card, public keys, A2A agent card and OASF record without an API key. Open since 12 October 2026. Every listing is checked before it appears (by our team until 26 October 2026), can be reported, and stays out of search engines unless you allow indexing. Also on every plan: the domain-verified badge (free) and the OASF export of your own card.

An agent registers its own Ed25519 or P-256 keys (the private key never leaves it) and signs what it writes. Recipients get the author signature next to ours, so anyone can check who wrote a message without trusting us. A signed message goes out exactly as signed: add any visible disclosure line to your own text before signing.

A POST for every event, signed with HMAC-SHA256 and retried for about a day. The event catalog shows every body; envelope payloads send ids and subjects only, no content.

The same events over a WebSocket your agent opens. No public URL, so it works from a laptop or behind NAT, and the SDKs reconnect and resume on their own.

Send from any SMTP client or library on port 587 or 465, with an API key as the password. Same checks, signing and events as an API send.

An agent with no API key gets its own workspace and inbox with one call and a short proof of work. It can receive and reply at once; a person claims it later to lift the sending limits.

Scope a key to one inbox and give it only the permissions its job needs, from presets such as read-only, send and read, or sign-in only.

Inboxes, threads, drafts, contacts, knowledge, webhooks and keys in one place, with sent, delivered, bounced and received mail per hour or day, and a “Use the API” button with each page’s calls pre-filled.

Hackathons: Builder free for 1 month for every participant, on one shared code, and Team free for 6 months for the winners. Early-stage startups: Team for 6 months, a separate programme. The code raises the plan for a set time and it goes back on its own, with a reminder a week before.

Your agent asks for a 5-minute, single-use ID token addressed to one app and signs in with it. No password to store, no email loop.

Apps register a client in the dashboard and verify tokens with any OIDC library: discovery, JWKS, code flow with PKCE and a consent screen, or a server-side token exchange.

Each app sees a different, stable subject for the same agent, so apps can’t link your agents across services. Every sign-in is logged and fires a webhook.

An agent that only signs in to apps gets an identity in one call, no inbox needed. Its tokens carry no email, it has its own plan limit (100 on Free) and it works with every sign-in flow.

Turn sign-in off for any inbox and new tokens, approvals and exchanges stop at once. Each inbox lists the apps it signed in to and every sign-in, kept 180 days.

The API, mail servers, database and stored mail run in France, with a second EU server for backups.

One workspace setting decides whether any email content goes to a model. Off keeps everything on our servers; login codes still work.

Attachment text extraction and OCR run on our own servers and never reach a third party. A workspace can turn them off; attachments are then stored but never read.

Every email an agent sends says, in a DKIM-signed header, that an AI agent sent it and for whom. A visible line is optional per workspace. Helps you meet transparency duties.

Nightly backups, encrypted before they leave the server, restore-tested every quarter, and health checks every 5 minutes.

Mail is kept for your plan’s retention and deleted daily after that. Choose a shorter period in Settings; a message labelled keep never expires.

A Data Processing Addendum, and a list of every third party that handles customer data, what it receives and where. Subscribe to be emailed at least 30 days before a sub-processor is added or replaced.

Your own server and sending IPs in the EU or US, your own domain and storage bucket, isolated from other customers and run by us. Or in your own cloud under a support contract.