What it is
AgentMail is an email service built for AI agents: each agent gets its own inbox rather than access to yours. Its MCP server is hosted at https://mcp.agentmail.to/mcp, listed in the official MCP registry as to.agentmail/agentmail, and according to the docs exposes 47 tools plus two that only OAuth sessions get. They cover inboxes, threads, messages (send, reply, forward), drafts with scheduled sending, attachments, a calendar per inbox, allow and block lists, and AgentID tools that create accounts for the agent at other services.
Claude, Claude Code and ChatGPT connect with OAuth; clients without MCP OAuth, such as Cursor and Windsurf, send an API key in an x-api-key header. Small npm and PyPI packages, both named agentmail-mcp, bridge stdio-only clients to the hosted server and can filter the tool list. The repository holds the hosted server and those bridges and is MIT licensed.
The MCP server is included on every plan, including the free one.
Install
https://mcp.agentmail.to/mcpOur review
AgentMail has the right idea and the fullest MCP surface for it. An agent gets its own address instead of a token for your Gmail, and the hosted server exposes 47 tools covering threads, drafts, scheduled sends, attachments with extracted PDF and DOCX text, allow and block lists and a calendar per inbox. Setup in Claude Code is a single claude mcp add command followed by a browser sign-in.
The trade is that send_message sends real mail to real people, and every inbound message is text a stranger wrote that the agent will read. AgentMail's defences are partial. Allow lists restrict who an inbox sends to or hears from, API keys can be cut down to a whitelist of permissions, and Agent Armor, a free Labs feature, scans inbound mail for prompt injection. Armor starts in Monitor mode, which labels messages but delivers them anyway, and the docs call a 'clear' verdict advisory. Hold mode is the setting that actually keeps flagged mail away from the agent.
AgentID is the newest and most consequential addition: the agent can create accounts at services in AgentMail's app marketplace, using its inbox as the identity. That suits autonomous agents and raises a governance question for everyone else. The tool count has grown from 39 to 47 since our last check, and the hosted endpoint sends all of them; only the stdio bridges filter with --tools. Two open issues matter in production: send_message has no idempotency key, so a retried call can send twice, and OAuth token refresh can fail silently and leave the tools signed out.
Commercially it is cheap to start and priced by volume. Free gives 3 inboxes, 3,000 emails a month and 100 a day, with a 'Sent via AgentMail' footer and no custom domains. Developer at $20 a month lifts that to 10 inboxes and 10,000 emails, but the SOC 2 Type II report only comes with Startup at $200, and SAML SSO and EU hosting are Enterprise features. The repository has 69 stars because almost nothing runs locally; the bridges forward to the hosted server, so the mail and the logic both sit with AgentMail.
Where it earns its place
A two-person SaaS startup handling support on its own domain
Have an agent draft replies to customer email for a person to approve
The agent reads new threads and calls create_draft rather than send_message; a person reviews and sends. Developer at $20 a month covers 10,000 emails; 500 replies a day is 15,000 a month, so five $2 add-ons of 1,000 emails bring it to about $30.
An AI engineer building a browser agent that signs up for SaaS trials
Give the agent an address that can receive verification codes
create_inbox per run, then list_messages or MCP Events to catch the code. Organisations an agent signs up by itself are limited to 1 inbox and 10 emails a day to the attached human until verified. Treat inbound mail as untrusted and run Agent Armor in Hold mode.
A security lead at a 200-person company reviewing agent email
Decide whether agent mail can run through a third-party vendor
Startup at $200 a month includes the SOC 2 Type II report (first audit completed in 2025, 2026 audit under way with A-LIGN); SAML SSO, EU hosting and BYO cloud need Enterprise. Messages are kept for as long as you use the service unless AgentMail enables its optional 24-hour expiry.
Before you commit
- Setup
- Claude Desktop and Claude.ai: add a custom connector with https://mcp.agentmail.to/mcp and sign in. Claude Code: claude mcp add --transport http agentmail https://mcp.agentmail.to/mcp. Cursor and Windsurf send an API key in an x-api-key header; stdio-only clients use npx -y agentmail-mcp or uvx agentmail-mcp.
- Integrations
- 47 tools plus 2 OAuth-only: inboxes, threads, messages, drafts with scheduled send, attachments, calendar events and invitations, allow and block lists, AgentID app sign-up and accounts. Many are write tools; ChatGPT asks before running them, other clients rely on their own approval settings.
- Data and privacy
- Hosted only, so AgentMail stores and processes all mail. SOC 2 Type II with the report on Startup and above; separate US and EU environments, EU on Enterprise. Retention lasts as long as you use the service, with optional 24-hour expiry on request. API keys have full access within their scope unless given a permissions whitelist.
- Cost at scale
- Free: 3 inboxes, 3,000 emails a month, 100 a day. Developer $20: 10 inboxes, 10,000 a month, 1,000 a day, 100 per 5 minutes. Startup $200: 150 inboxes, 15,000 a day, 1,500 per 5 minutes. Add-ons cost $2 per inbox, $2 per 1,000 monthly emails and $5 per seat.
- Limits
- API rate limits are not published as numbers; over-limit calls get a 429 with Retry-After, usually 1 second. Open issues report no idempotency key on send_message and OAuth refreshes that silently sign the tools out.
What's good
- Dedicated agent inboxes instead of access to your own mail
- 47 tools: threads, drafts, scheduled send, calendar, allow lists
- OAuth for Claude and ChatGPT; scoped API keys for other clients
- Agent Armor prompt-injection scanning, free while in Labs
What's not
- Agents send real email, and send_message has no idempotency key
- Agent Armor only labels mail unless switched to Hold mode
- Hosted endpoint sends every tool; filtering needs the stdio bridge
- SOC 2 report from $200 a month; SSO and EU hosting Enterprise-only
Best for
Developers building agents that need to sign up for services, handle support mail or run email workflows from their own address.
Alternatives
AgentMail: common questions
- Is AgentMail worth it?
- Giving an agent its own inbox beats lending it yours, and AgentMail's hosted server covers the whole mailbox; the guardrails on what it sends are still yours to build. We rate it 4.1 out of 5.
- How much does AgentMail cost?
- Free: 3 inboxes, 3,000 emails a month (100 a day), 3 GB. Developer $20/month: 10 inboxes, 10,000 emails, 10 custom domains. Startup $200/month: 150 inboxes. Enterprise custom.
- What are the downsides of AgentMail?
- Agents send real email, and send_message has no idempotency key; agent Armor only labels mail unless switched to Hold mode; hosted endpoint sends every tool; filtering needs the stdio bridge; sOC 2 report from $200 a month; SSO and EU hosting Enterprise-only.
- Who is AgentMail best for?
- Developers building agents that need to sign up for services, handle support mail or run email workflows from their own address.
- How much does AgentMail cost for a team or in production?
- Free: 3 inboxes, 3,000 emails a month, 100 a day. Developer $20: 10 inboxes, 10,000 a month, 1,000 a day, 100 per 5 minutes. Startup $200: 150 inboxes, 15,000 a day, 1,500 per 5 minutes. Add-ons cost $2 per inbox, $2 per 1,000 monthly emails and $5 per seat.
- Is AgentMail safe for company data?
- Hosted only, so AgentMail stores and processes all mail. SOC 2 Type II with the report on Startup and above; separate US and EU environments, EU on Enterprise. Retention lasts as long as you use the service, with optional 24-hour expiry on request. API keys have full access within their scope unless given a permissions whitelist.
- What are the best AgentMail alternatives?
- The closest alternatives we have reviewed are Atomic Mail Agentic, Google Workspace MCP servers and Slack MCP Server.
Answers checked Oct 22, 2026.
Make AgentMail? Show this rating on your site
