namailuEmail for AI agents
The agent gets a mailbox of its own — not access to yours. Over MCP, REST API or A2A, with a precisely scoped grant you can withdraw at any time.
The idea
A mailbox of its own is not a shared password.
The usual way to give a program email is to hand it the password to your mailbox. That gives it everything: old correspondence, invoices, password resets. We do it the other way round — the agent has its own address and cannot see into yours.
- An agent mailbox with its own address, on our domain or yours.
- Consent to specific mailboxes. You choose which ones — not “the account”.
- Separate scopes for reading and sending. An agent allowed only to read cannot send anything.
- Withdrawal takes effect immediately. It is checked on every request, not at token expiry.
- Second factor when granting — delegating mailbox access is not the same as signing in.
How an agent connects
Three ways, depending on what your agent speaks.
- MCP — for Claude, Codex, Cursor, Antigravity and other clients that speak the Model Context Protocol. Step by step in the MCP manual.
- REST API — a key bound to a single mailbox, when you write the agent yourself. See the API manual.
- A2A — when your agent talks to other agents and discovers them
by card. Address and skills live in
/.well-known/agent-card.json.
An agent that has nobody here yet can ask for access itself; the procedure is in auth.md. A person still has to issue it — they type in a six-digit code and pick the mailboxes.
Safety
We assume a model can be misled.
- The text of someone else's message is input, not an instruction. Message content is returned to the agent explicitly marked as untrusted — otherwise an email from anyone acts as an order nobody approved.
- Listing messages shows neither subject nor body. An agent that merely polls for new mail cannot be steered by a subject line.
- Attachments are scanned, and anything that cannot be inspected (an encrypted archive) is delivered with an explicit note that it was not.
- Hourly, daily and monthly limits are a circuit breaker against a looping agent, not a commercial brake.
Frequently asked
What people ask most.
Will the agent see my personal mail?
No. The agent has its own mailbox and cannot see into yours. If you do grant access, you pick specific mailboxes — not the whole account.
How do I take access away?
In the portal, with one click. Withdrawal is checked on every request, so it takes effect immediately rather than at token expiry.
Which clients do you support?
Anything that speaks MCP — Claude, Codex, Cursor, Antigravity and others. If you write the agent yourself, use the REST API; agents speaking A2A discover the agent card.
What if the agent gets stuck in a loop?
Hourly, daily and monthly limits stop it before it becomes a problem. They are circuit breakers, not a commercial brake.
Can the agent send email in my name?
Only from the mailboxes you explicitly allowed, and only if it holds the send scope. Without it, reading is the most it can do.