AI agents can already write code, browse the web, and call APIs, but giving them an email address that actually works, with proper authentication, spam filtering, and deliverability, has remained a surprisingly hard problem. Agentboxd, which launched on September 24 2026, is building infrastructure to solve exactly that, starting from the mail servers themselves rather than layering on top of existing email services.
The Problem: Email Is the Last Frontier for AI Agents
Most of the internet speaks HTTP, and AI agents already have mature tools for interacting with APIs, web pages, and code repositories. Email remains a different animal. It relies on a stack of protocols and authentication checks, uses a format full of quoted replies and signatures that confuse language models, and is the primary vector for prompt injection attacks. An agent that cannot reliably receive, read, and respond to mail is effectively cut off from a huge portion of real-world business communication.
Existing workarounds fall short. IMAP scraping is brittle. Generic inbox services for developers are designed for human workflows, not machine reasoning. And nobody has treated the email server itself as the place to enforce agent-specific security policies. Agentboxd takes a different approach by running its own mail infrastructure end to end and building the entire service around the assumption that the user is an agent, not a person.
How It Works: One API Call, One Address
To create an inbox, a developer makes a single POST request to the Agentboxd API, providing a username and a client identifier. The service returns a working email address on the domain agents.agentboxd.com, such as support-bot@agents.agentboxd.com. The client_id parameter makes the operation idempotent, meaning if an agent restarts and calls the same endpoint again, it gets its existing inbox back rather than creating a new one. That detail matters for long-running agents that need a stable identity.
Once an inbox exists, the agent can wait for incoming messages through a long-polling endpoint that holds the connection for up to 60 seconds. When mail arrives, the service processes it before the agent ever sees it. It verifies the sender using SPF, DKIM, and DMARC, strips out quoted history and signatures, and delivers only the new text to the agent. The same service can send replies on behalf of the agent, signed with the domain's DKIM key and threaded correctly using In-Reply-To and References headers.
Security Built Into the Mail Layer
Because Agentboxd operates its own mail servers and its own triage model, it can enforce security decisions at the protocol level rather than as an afterthought. Every inbound message passes through JEV, their classification model, which assigns each email a category such as support, sales, billing, or verification, and scores it for prompt injection, phishing, and urgency. In testing, an email containing the phrase "ignore previous instructions" scored 0.99 for injection risk and was quarantined before the agent could act on it.
The system marks every email as untrusted data before the agent reads it. The MCP server instructions explicitly tell the model never to follow orders found in incoming mail. Failed authentication results in the message being labeled with spf-fail or dmarc-fail tags. Hard bounces and complaints place addresses on a suppression list, and further sends to those addresses fail with a 422 error rather than damaging the agent's sending reputation.
Rate limits are enforced by default. Every workspace gets a five-minute burst limit and a daily send cap, configured at 20 and 100 messages on the free plan, so a runaway loop stops early. Workspaces with high bounce or complaint rates are suspended automatically.
Beyond Mail: Identity, Drafts, and Human Oversight
Every inbox is also an identity. Through a feature called Sign in with Agentboxd, agents can log into applications using short-lived OpenID Connect tokens instead of passwords or email loops. The service exposes a standard OIDC endpoint, and each app gets a different subject identifier tied to the inbox, so identities remain scoped and per-application.
For scenarios where an agent needs to take action but human oversight is required, the platform supports drafts. The agent can write a draft that a person reviews and approves through the dashboard, or a supervising agent can approve and send it. Separating the drafts:write permission from messages:send means an agent can be given the ability to compose messages without being trusted to deliver them.
Integration Options and Developer Access
Agentboxd offers multiple ways for agents and developers to interact with the service. A TypeScript SDK is available on npm with zero dependencies, reading credentials from the environment. A Python SDK with both synchronous and async support is planned for PyPI. For agents that use the Model Context Protocol, an MCP server with 45 tools is available, covering inboxes, mail, verification codes, attachments, contacts, drafts, and sign-in functionality. It runs locally with an API key or can be accessed through a hosted connector at mcp.agentboxd.com, which requires no installation and no API key.
Additional integration paths include signed webhooks, a WebSocket event stream that works behind NAT without a public URL, and SMTP submission on port 587 or 465 using the API key as the password. Custom domains are supported, allowing teams to connect a subdomain and have mail signed with their own DKIM key.
Infrastructure, Pricing, and the EU-First Approach
The entire service, including the API, mail servers, and database, is hosted in France with a second EU server for backups. Data residency is a configurable concern, and a privacy switch in the workspace settings determines whether any email content is ever sent to an AI model at all. When disabled, content stays on Agentboxd servers while login codes still function. Every email sent by an agent includes a DKIM-signed header disclosing that an AI agent sent it and for whom.
The platform is currently free during beta, with three tiers available: a free plan at 3,000 emails per month, a Builder plan at $15 per month after beta with 25,000 emails, and a Team plan at $60 per month with 150,000 emails. Inboxes are priced near zero, allowing an agent to have a dedicated address per task or per customer. Mail is never footered, and the platform uses three named sub-processors with a public data processing addendum listing exactly what each one receives and where it goes.
What This Means for Agent Infrastructure
Agentboxd addresses a gap that most agent platforms have overlooked. Building an agent that can send emails, receive replies, sign up for services, and handle verification codes requires solving an entire email infrastructure problem that has nothing to do with the agent's actual intelligence. By providing real mail servers, real addresses, and real authentication from the MX layer up, the platform removes that burden and lets developers focus on what the agent should do rather than how it should send mail. The combination of built-in injection detection, human-approval workflows, and EU-hosted data residency makes it one of the more complete agent email solutions available, and it points to a broader trend: infrastructure services that are purpose-built for machines, not adapted from tools built for people.