An agent gets its own @mailbox.bot addresses, one for each duty it carries. Every message arrives as JSON your code can read, announced by signed webhook, and matched to the letters and packages at the same mailing address. It is an inbox that knows what is sitting in your mailbox and can answer on paper: printed, mailed and tracked from the same account.
Launching mid-October 2026. At launch the addresses receive mail and nothing is sent from them. The payload and API outline on this page are a beta preview; the final reference is published at launch.
Give each duty its own address. The address a message was sent to is the first thing your code knows about it, before any model has read a word.
[
{ "address": "offers@mailbox.bot",
"agent": "deals",
"on_mail": "pull price and expiry, draft the counter",
"paper": "certified, owner approves" },
{ "address": "escrow@mailbox.bot",
"agent": "closing",
"on_mail": "check the sender, hold wire changes",
"paper": "closing packet, tracked" },
{ "address": "contracts@mailbox.bot",
"agent": "legal",
"on_mail": "assemble the packet, wait for approval",
"paper": "owner approves every send" },
{ "address": "realestate@mailbox.bot",
"agent": "property",
"on_mail": "file by property, line up mailed notices",
"paper": "first-class or certified" },
{ "address": "permits@mailbox.bot",
"agent": "compliance",
"on_mail": "one deadline per case, draft the response",
"paper": "certified, proof kept" },
{ "address": "invoices@mailbox.bot",
"agent": "finance",
"on_mail": "match the paper statement, flag gaps",
"paper": "dispute letter on a mismatch" },
{ "address": "hr@mailbox.bot",
"agent": "people",
"on_mail": "answer verification requests",
"paper": "letter on letterhead, approved" }
]
// These rules live in your agent stack. The address
// on each message tells them where to start.A message is data before it is prose. Each one is checked, cleaned and matched, then pushed to your stack as a single JSON object.
{
"event": "email.message.received",
"received_at": "2026-10-21T16:04:11Z",
"email": {
"to": "invoices@mailbox.bot",
"from": "billing@northridgewater.example",
"subject": "Your October statement is ready",
"auth": { "spf": "pass", "dkim": "pass",
"dmarc": "pass" },
"sender_status": "known",
"text": "Statement for 4471-20. $186.40 due Nov 12.",
"hidden_content_removed": false,
"attachments": [
{ "name": "statement-2026-10.pdf",
"type": "application/pdf",
"verdict": "clean" }
]
},
"extracted": {
"intent": "statement_ready",
"amounts": [{ "value": 186.40, "currency": "USD" }],
"dates": [{ "label": "due", "value": "2026-11-12" }],
"references": ["4471-20"]
},
"matches": [
{ "type": "letter", "item_id": "in_8f2c41",
"reason": "same sender and account reference" }
],
"content_trust": "untrusted"
}
// Preview. The final field reference is published
// at launch.GET /v1/inbound-items/{id}/pages returns the OCR text per page.Mail is some of the most sensitive data a business receives. It reaches your models as your own structured data, under your own keys.
Nothing here asks you to change frameworks. The address is a data source and a trigger for the stack you have.
https://mailbox.bot/api/mcp to any client that speaks MCP. Email tools join the same server at launch.The same thread a person would work through an inbox, a printer and a trip to the post office.
An offer for 418 Alder St reaches offers@. The webhook carries the price, $612,000, and the expiry, Friday 5 pm, as fields.
The deals agent checks that the sender's authentication passed, finds the property by its reference, and drafts a counter at the number you set.
It prices the letter with dry_run=true: Certified Mail, one page, exact cost. Nothing has been created yet.
requires_approval=true holds the letter with a preview of the document. You approve it in the dashboard.
mail.delivered arrives with the tracking record and the proof photo. The agent files both on the deal and stops watching the clock.
| A human inbox | An agent address |
|---|---|
| Someone has to open it and notice. | A signed webhook fires when mail arrives. |
| Dates and amounts are read off the screen and typed in again. | They arrive as fields. |
| The paper copy of the same notice sits in a separate pile. | Email, letters and packages are matched to each other. |
| A reply is another email, which proves nothing. | A reply that has to count goes out certified, with tracking and a photo. |
| Hidden text and convincing links are aimed at whoever reads it. | Hidden text is removed, links are never opened, and every message is marked untrusted. |
Each starts at one address and ends on paper, with a person approving anything that costs money or cannot be undone.
The offer arrives with a price and a deadline, and the message already carries both as fields. The deals agent drafts the counter the same hour instead of whenever someone opens the inbox.
The counter goes out by Certified Mail once the owner approves it. mail.delivered and the proof photo close the thread.
Escrow and title email carries wire details and closing dates. Each message arrives with the sender's authentication results and whether the sender is new, so the closing agent refuses to act on a lookalike and holds any change to payment instructions for a person.
Closing packets and signed disclosures go out certified or by FedEx, with the tracking record on the deal.
A counterparty emails an agreement and asks for a signed hard copy. The legal agent assembles the packet and prices it first: exact cost, recipient and mail class, with nothing sent.
requires_approval=true holds the packet with a document preview. The email's message ID rides along in the mail job's metadata.
Tenant, vendor and association email for a property lands on one address and is filed by the property reference in each message. When a notice has to go by mail, the property agent drafts a letter rather than a reply.
Letters go out first-class or certified, each with tracking and a photo of the sealed piece.
An agency emails a notice, and the paper copy reaches your mailing address days later. The two are matched, so the compliance agent tracks one deadline with both sources attached instead of two loose items.
The response is mailed certified, and the delivery record stays with the case.
The statement email is matched to the paper statement when it is scanned. The finance agent compares the amount in the email with the amount on the page and flags any difference.
On a mismatch it drafts a dispute letter, prices it with dry_run=true, and waits for approval.
Email carries the conversation. Paper carries the finality, and the same account sends it.
dry_run=true returns the exact cost, recipient and mail class before anything is created.requires_approval=true holds a letter for a human, and X-Max-Cost-Cents refuses anything over your cap.mail.pending_approval, mail.submitted, mail.mailed, mail.delivered, mail.failed.{
"source": "agent_email",
"email_address": "contracts@mailbox.bot",
"email_message_id": "<msg_123@counterparty.example>",
"workflow": "signed_agreement_packet",
"counterparty": "Harbor Supply Co.",
"deadline": "2026-11-12",
"document_type": "signed_agreement"
}
// Sent as metadata on the mail job, so the paper can
// always be traced back to the thread that caused it.Agents do the reading and the drafting. People keep the decisions that cost money or cannot be undone, and both work from the same record.
requires_approval=true, shown with a preview of the document.X-Max-Cost-Cents.The first shape of the API, so you can plan against it. Names can change before launch, and this section is updated as they settle.
GET /v1/email/address
your address, its aliases and status
POST /v1/email/aliases
add an address for another duty
DELETE /v1/email/aliases/{alias}
retire one
GET /v1/email/messages
?since=&until=&intent=&from_domain=&q=&limit=&cursor=
GET /v1/email/messages/{id}
one message object
GET /v1/email/messages/{id}/html
sanitized HTML
GET /v1/email/messages/{id}/attachments/{n}
one-time download link
POST /v1/email/messages/{id}/spam
{ "spam": true | false }
DELETE /v1/email/messages/{id}
POST /v1/email/messages/export
JSON Lines, one-time link
PATCH /v1/email/settings
notifications, retention, blocked senders
// Beta outline. Names can change before launch.email.message.received and email.message.updated, signed, carrying the message object.email_list_messages, email_get_message, email_search, email_get_attachment_link, email_update_settings. No tool sends, forwards or opens a link.email.read for ordinary mail; email.read_security for sign-in mail, off by default and granted per agent; email.settings; email.delete. There is no send permission.q matches sender, subject and extracted fields.| Field | Holds |
|---|---|
| email.to | The address that received it, including any plus tag. |
| email.subject | As received. Codes are masked on sign-in mail. |
| email.message_id | The Message-ID header, for threading and lineage. |
| email.auth | SPF, DKIM and DMARC results. |
| email.sender_status | approved, known or new. |
| email.text | Plain text after hidden content is removed. |
| email.hidden_content_removed | True when anything was removed. |
| email.attachments | Name, type, size, hash and scan verdict for each file. |
| email.links | Real domain, visible text and a mismatch flag. Never opened. |
| extracted.intent | delivery_update, receipt, statement_ready, account_security, newsletter, marketing, personal or unknown. |
| extracted | Tracking numbers, dates, amounts and references found in the message. |
| security | True for sign-in and account-security mail. |
| content_trust | Always untrusted: a message is input, never instruction. |