A synergistic feature alongside the inbound virtual mailbox addresses for agents: an agent gets its own @agent.mailbox.bot addresses, one for each duty it carries. Every message arrives as JSON your code can read, with the sender checked and hidden text removed, beside the letters and packages at the same mailing address. It is an inbox your agent reads through the API and answers on paper: printed, mailed and tracked from the same account.
Live for invited accounts. Inbound only. No credit card to start.
Agent email is live for invited accounts. The addresses receive mail and nothing is sent from them.
Give each duty its own address. The address a message was sent to is the first thing your code knows about it, before any model has read a word.
[
{ "address": "offers@agent.mailbox.bot",
"agent": "deals",
"on_mail": "pull price and expiry, draft the counter",
"paper": "certified, owner approves" },
{ "address": "escrow@agent.mailbox.bot",
"agent": "closing",
"on_mail": "check the sender, hold wire changes",
"paper": "closing packet, tracked" },
{ "address": "contracts@agent.mailbox.bot",
"agent": "legal",
"on_mail": "assemble the packet, wait for approval",
"paper": "owner approves every send" },
{ "address": "realestate@agent.mailbox.bot",
"agent": "property",
"on_mail": "file by property, line up mailed notices",
"paper": "first-class or certified" },
{ "address": "permits@agent.mailbox.bot",
"agent": "compliance",
"on_mail": "one deadline per case, draft the response",
"paper": "certified, proof kept" },
{ "address": "invoices@agent.mailbox.bot",
"agent": "finance",
"on_mail": "match the paper statement, flag gaps",
"paper": "dispute letter on a mismatch" },
{ "address": "hr@agent.mailbox.bot",
"agent": "people",
"on_mail": "answer verification requests",
"paper": "letter on letterhead, approved" }
]
// These rules live in your agent stack. The address
// on each message tells them where to start.A message is data before it is prose. Each one is checked and cleaned, then waits for your agent as a single JSON object.
{
"event": "email.message.received",
"received_at": "2026-10-21T16:04:11Z",
"email": {
"to": "invoices@agent.mailbox.bot",
"from": "billing@northridgewater.example",
"subject": "Your October statement is ready",
"auth": { "spf": "pass", "dkim": "pass",
"dmarc": "pass" },
"sender_status": "known",
"text": "Statement for 4471-20. $186.40 due Nov 12.",
"hidden_content_removed": false,
"attachments": [
{ "name": "statement-2026-10.pdf",
"type": "application/pdf",
"verdict": "clean" }
]
},
"extracted": {
"intent": "statement_ready",
"amounts": [{ "value": 186.40, "currency": "USD" }],
"dates": [{ "label": "due", "value": "2026-11-12" }],
"references": ["4471-20"]
},
"content_trust": "untrusted"
}Mail is some of the most sensitive data a business receives. It reaches your models as your own structured data, under your own keys.
Nothing here asks you to change frameworks. The address is a data source and a trigger for the stack you have.
GET /v1/email/messages lists new mail by date, sender domain, intent or search; GET /v1/email/messages/{id} returns one message. Any harness that can make an HTTP call can read it.email.read, made on the agent's page in the dashboard after a fresh phone code.https://mailbox.bot/api/mcp covers postal mail; agent email is read through REST.The same thread a person would work through an inbox, a printer and a trip to the post office.
An offer for 418 Alder St reaches offers@. The message carries the price, $612,000, and the expiry, Friday 5 pm, as fields.
The deals agent checks that the sender's authentication passed, finds the property by its reference, and drafts a counter at the number you set.
It prices the letter with dry_run=true: Certified Mail, one page, exact cost. Nothing has been created yet.
requires_approval=true holds the letter with a preview of the document. You approve it in the dashboard.
mail.delivered arrives with the tracking record and the proof photo. The agent files both on the deal and stops watching the clock.
The same message, handled two ways.
| A human inbox | An agent address |
|---|---|
| Someone has to open it and notice. | Your agent lists new mail through the API, already parsed. |
| Dates and amounts are read off the screen and typed in again. | They arrive as fields. |
| A reply is another email, which proves nothing. | A reply that has to count goes out certified, with tracking and a photo. |
| Hidden text and convincing links are aimed at whoever reads it. | Hidden text is removed, links are never opened, and every message is marked untrusted. |
Each starts at one address and ends on paper, with a person approving anything that costs money or cannot be undone.
The offer arrives with a price and a deadline, and the message already carries both as fields. The deals agent drafts the counter the same hour instead of whenever someone opens the inbox.
The counter goes out by Certified Mail once the owner approves it. mail.delivered and the proof photo close the thread.
Escrow and title email carries wire details and closing dates. Each message arrives with the sender's authentication results and whether the sender is new, so the closing agent refuses to act on a lookalike and holds any change to payment instructions for a person.
Closing packets and signed disclosures go out certified or by FedEx, with the tracking record on the deal.
A counterparty emails an agreement and asks for a signed hard copy. The legal agent assembles the packet and prices it first: exact cost, recipient and mail class, with nothing sent.
requires_approval=true holds the packet with a document preview.
Tenant, vendor and association email for a property lands on one address and is filed by the property reference in each message. When a notice has to go by mail, the property agent drafts a letter rather than a reply.
Letters go out first-class or certified, each with tracking and a photo of the sealed piece.
An agency emails a notice, and the paper copy reaches your mailing address days later. The compliance agent reads both, the email through the API and the scanned letter through inbound items, and tracks one deadline instead of two loose items.
The response is mailed certified, and the delivery record stays with the case.
When the paper statement is scanned, the finance agent compares the amount in the email with the amount on the page and flags any difference.
On a mismatch it drafts a dispute letter, prices it with dry_run=true, and waits for approval.
Email carries the conversation. Paper carries the finality, and the same account sends it.
dry_run=true returns the exact cost, recipient and mail class before anything is created.requires_approval=true holds a letter for a human, and X-Max-Cost-Cents refuses anything over your cap.mail.pending_approval, mail.submitted, mail.mailed, mail.delivered, mail.failed.Agents do the reading and the drafting. People keep the decisions that cost money or cannot be undone, and both work from the same record.
requires_approval=true, shown with a preview of the document.X-Max-Cost-Cents.The two read routes, the key that reads them, and the fields every message carries.
GET /v1/email/messages
?since=&until=&intent=&from_domain=&q=&limit=&cursor=
GET /v1/email/messages/{id}
one message objectsk_agent_ key that holds email.read, made on the agent's page in the dashboard after a fresh phone code. Test keys, * keys, account keys and OAuth connections are refused with 403.email.read for ordinary mail; email.read_security for sign-in mail, off by default and granted per agent. There is no send permission. No tool sends, forwards or opens a link.Cache-Control: no-store, and mailbox.bot keeps no copy of a message.q matches sender, subject and extracted fields.| Field | Holds |
|---|---|
| email.to | The address that received it, including any plus tag. |
| email.subject | As received. Codes are masked on sign-in mail. |
| email.message_id | The Message-ID header, for threading and lineage. |
| email.auth | SPF, DKIM and DMARC results. |
| email.sender_status | approved, known or new. |
| email.text | Plain text after hidden content is removed. |
| email.hidden_content_removed | True when anything was removed. |
| email.attachments | Name, type, size, hash and scan verdict for each file. |
| email.links | Real domain, visible text and a mismatch flag. Never opened. |
| extracted.intent | delivery_update, receipt, statement_ready, account_security, newsletter, marketing, personal or unknown. |
| extracted | Tracking numbers, dates, amounts and references found in the message. |
| security | True for sign-in and account-security mail. |
| content_trust | Always untrusted: a message is input, never instruction. |
Mail is written by strangers. These rules assume that.