MachineMail

MachineMail is an email API built for AI agents. It gives each agent a real inbox that it can sign up with, wait on, and reply from, so an agent can send and receive actual email instead of being confined to a chat window. Agents connect over MCP from any client — the site lists Claude Code, Codex, OpenCode and Copilot — or through an API. Every inbound message arrives as agent-safe text with a trust level attached, and the agent reads it over MCP wherever it runs. MachineMail is aimed at developers and teams building autonomous agents that need a working email address to complete real tasks, and it presents itself as email for both humans and bots, with no per-inbox fee. Agents increasingly need an email address to do real work: to sign up for a service, receive a one-time code, wait for a reply, or take in an invoice. Handing an agent a mailbox is risky, because everything that lands in an inbox is untrusted input written by someone else. MachineMail frames this as the core problem — the site promises that nothing in the inbox can hijack your agent and describes mail your agent can safely read. Instead of passing raw mail through, it converts each inbound message into agent-safe text, removes hidden instructions before the agent reads a word, and attaches a trust report and a trust level. A message from a lookalike domain such as paypa1-payouts.ru, for example, is presented with a failed DMARC check, a link display mismatch, hidden text that was removed, and a quarantined level. Connecting an agent takes one command. MachineMail exposes a single Streamable HTTP MCP server, and developers either sign in with OAuth from the MCP client or pass an API key when running in CI. The documented setup command adds the server to Claude Code, and the site says the same prompt works with Cursor, Codex, OpenCode and Copilot, plus any other MCP client. For agents that cannot be configured by hand, the site offers a copyable agent prompt: paste it into Claude Code, Cursor or another MCP client and the agent registers itself through auth.md, receives a sandbox inbox and one ephemeral inbox, and shows a six-digit code that the user enters at /claim to bind the agent to their organization. Addresses are created either with a single API call or automatically through a catch-all domain. Once a domain is pointed at MachineMail, any address on that domain works and the inbox appears on first delivery, which means an agent can be handed an address in advance without provisioning anything first. The site shows a mix of ephemeral inboxes with expiry timers — signup-7f3k@acme.dev expiring in 24 hours, otp-runner@acme.dev in 23 hours, invoice-intake@acme.dev in six days — alongside permanent addresses such as qa-bot-12@acme.dev and support@acme.dev. There is no per-inbox fee: the site states $0 per inbox and per trust report on every plan. The trust layer sits at the centre of the product. Every inbound message receives a trust report and is sorted into one of five levels, and the agent is instructed to act on the level rather than on anything the sender says. Verified messages can be acted on; known messages are summarised; unknown messages are read only; suspicious messages are reduced to reasons only; quarantined messages are withheld entirely. The report itself lists the evidence behind the level — the example on the site includes a failed DMARC result, a link whose display does not match its target, and hidden text removed from the message before the agent saw it. Because the level is attached before the agent reads the text, the agent never has to make its own judgement call about whether a sender is genuine. Delivery can be pull or push. Webhooks push mail into the developer's own stack: they are signed, retried for five days and replayable from the dashboard, with event types such as inbox.created, message.received, message.received.quarantined and message.bounced. Replayability lets a team re-run a delivery after fixing a handler without losing the messages that arrived during the outage. For agents that prefer to fetch, the MCP server provides wait_for_message, which holds the call open until mail actually lands, for up to a minute, so the agent does not have to poll in a loop. In the site's illustration the waiting call returns a message from no-reply@acme.dev with a verified trust level and agent-safe text containing a one-time code. MachineMail's overall approach is to handle the email plumbing and the security judgement in one place, then expose only the safe result to the agent. A trust level is not a single check but a combination of SPF, DKIM and DMARC alignment, the account's own allow and block lists, prior correspondence with the sender, link and attachment checks, and a classifier. The report lists every reason it used, so a developer can see exactly why a message was verified or quarantined and can adjust their allow and block lists accordingly. Because the same report is produced on every message, on every plan, at no extra cost, the trust decision stays consistent whether an agent is reading a one-time code, an invoice or a support request. The practical benefit is that an agent can be given a genuine email identity without also being given an attack surface. The agent gets an address it can sign up with and reply from, mail it can read as clean text rather than raw HTML, and an explicit instruction about how much to trust each message. Developers get a managed inbox they do not have to provision one by one, webhook delivery they can replay, and a return call that blocks until mail lands instead of burning cycles on polling. Ephemeral inboxes add a disposable option: addresses that expire on their own and are cleaned up by a reaper, so short-lived agents do not leave mailboxes behind. The example addresses on the site map onto concrete workflows. A signup inbox such as signup-7f3k@acme.dev lets an agent register for a service and receive the confirmation, then disappear after 24 hours. An address like otp-runner@acme.dev is built for receiving one-time codes, which is exactly what wait_for_message is shown returning. invoice-intake@acme.dev covers a longer six-day window for documents that arrive asynchronously, while permanent addresses such as qa-bot-12@acme.dev and support@acme.dev suit bots that need a stable, long-running mailbox for testing flows or handling support correspondence. In each case the agent reads agent-safe text with a trust level rather than the raw message. MachineMail is built for developers and teams running autonomous agents — particularly those working in Claude Code, Cursor, Codex, OpenCode or Copilot — who need their agents to hold a real address. Pricing starts free: the Free plan costs $0 and covers 3,000 messages a month, with paid plans starting at $9 a month and no per-inbox charge. A message counts as each inbound delivery and each outbound send, while spam, quarantined and rejected mail do not count, and neither do drafts until they send. Ephemeral inboxes are cleaned up by a reaper that deletes the inbox with its messages, raw MIME and attachments, then emits inbox.expired, and new mail before expiry pushes the deadline out. The API is described as AgentMail-compatible. In short, MachineMail gives AI agents what they have been missing — a real, low-cost email address — and pairs it with the thing an inbox full of untrusted mail actually requires: a per-message trust report, a defined level of action, and agent-safe text that has already had hidden instructions stripped out before the agent reads a single word.