Guides
Agent email guides for inboxes, MCP and approvals
Every guide here is written against the code that is deployed: real error codes, real limits, real request shapes. 80 published, newest first.
api 37 permissions 31 reliability 30 mcp 21 setup 21 approvals 19 events 17 security 17 inboxes 16 controls 10 foundations 10 webhooks 10 deliverability 7 testing 7 idempotency 6 research 6
Email for Agents · Sep 30, 2026 · 11 min
Does ChatGPT Have an Email Address?
No. ChatGPT has no address of its own, but it can act inside your Gmail or Outlook. What OpenAI documents today, and what owning an inbox takes.
Comparisons · Sep 30, 2026 · 10 min
Can You Use Temp Mail for an AI Agent?
Can I use a temp mail for my AI agent? Rarely. Signups block disposable domains, public inboxes leak codes, and expired addresses kill account recovery.
Inboxes · Sep 30, 2026 · 11 min
Thread ID vs Message-ID in an Agent Inbox
Agent email thread ID vs message ID vs the Message-ID header: which to store, which a counterparty can forge, and what reply_to_message_id accepts.
Integrations · Sep 29, 2026 · 10 min
n8n AI Agent Gmail Node: Invalid Email Address
Why the n8n AI agent Gmail node throws an invalid email address error: it only checks for an @. The model outputs that trip it, and the ones that slip past.
Inboxes · Sep 29, 2026 · 12 min
DMARC Policy for an Autonomous Email Sender
DMARC for AI agent senders: why a fresh agent subdomain should start at p=reject, when that flips, and what sp, np and alignment actually cover.
Developers · Sep 29, 2026 · 10 min
What message.submission_unknown Actually Means
The send was attempted and nobody knows if it went out. What message.submission_unknown means, the silent path to it, and why resending is the wrong move.
Comparisons · Sep 29, 2026 · 14 min
Gmail Blocked My Bot From Sending Email: 4 Causes
Gmail blocked my bot from sending email: four different Google enforcement paths, the exact error strings for each, and which ones configuration can fix.
Comparisons · Sep 29, 2026 · 12 min
Gmail MCP Refresh Tokens Expiring Every 7 Days
Why a Gmail MCP refresh token expires every 7 days, what Google requires to stop it, and the other causes that break the same connection on a different clock.
Inboxes · Sep 29, 2026 · 12 min
Why Your Agent's Email Lands in Spam
Why does my AI agent email go to spam? The three agent-specific causes, what the platform reports back, and the part no sender can see.
Developers · Sep 28, 2026 · 12 min
Agent Email Bounced 550 5.7.1: What It Means
Agent email bounced 550 5.7.1? Which variant you hit, why it is rarely your DNS on a shared domain, and why the agent must stop, not reword and resend.
Developers · Sep 28, 2026 · 12 min
Retry, Backoff and Error Handling for Agent Email
Agent email error handling that sorts every error by whether a retry can help: a decision table, what backs off, and what goes to a human.
Developers · Sep 28, 2026 · 12 min
Validating an Address Before Your Agent Sends
How to validate an email address before your agent sends: the syntax and DNS checks that are safe to run, and why probing the mailbox is not.
Inboxes · Sep 28, 2026 · 12 min
Cc, Bcc and Reply-All Rules for Agents
The recipient rules an agent should follow on reply-all: who goes in To, what to keep in Cc, why Bcc never carries forward, and what each extra name costs.
Controls · Sep 28, 2026 · 11 min
AI Agent Hallucinated an Email Address? Fix the Source
An AI agent's hallucinated email address either bounces or reaches a stranger. Take recipients from records, not model output, and gate the rest.
Developers · Sep 28, 2026 · 11 min
Handling PDF Attachments in an Agent Inbox
How to handle PDF attachments in an AI agent's email: upload in three calls, pass only att_ IDs to the model, and read inbound files in code, not in context.
Controls · Sep 27, 2026 · 11 min
Restrict Which Domains Your Agent Can Email
Restrict which domains your agent can email with an allowlist it cannot argue with: the policy call, how recipients match, and what a denied send returns.
Controls · Sep 27, 2026 · 11 min
Monitor Every Email Your Agent Sends
How to monitor what emails my agent sent: four alerts built only from events that actually fire, and why two obvious ones would stay green forever.
Controls · Sep 27, 2026 · 11 min
How to Revoke an Agent's Email Access Instantly
How to revoke an agent's email access: five kill switches ranked by blast radius, the exact calls, and what happens to mail already queued or held.
Controls · Sep 27, 2026 · 13 min
Stopping an Infinite Agent Auto-Reply Loop
Four stopping rules that end an agent email loop with an auto responder: a thread reply budget, auto-reply signals, a sender window, and an approval gate.
Controls · Sep 27, 2026 · 10 min
Export an Agent's Email History, Then Deactivate
Export agent email history as NDJSON, verify the checksums, then deactivate the project, knowing the deletion job erases no stored mail.
Email for Agents · Sep 27, 2026 · 11 min
Two AI Agents Emailing Each Other: A Design Guide
Two AI agents emailing each other rarely stop on their own: why courtesy keeps the thread alive, how threading works, when to hand off, how to test it.
Inboxes · Sep 26, 2026 · 10 min
How Many Tokens an Email Thread Really Costs
How many tokens does an email thread use? We built a 10-message thread and counted: 4% was new text. Here is the retrieval pattern that fixes it.
Inboxes · Sep 26, 2026 · 11 min
Stripping Quoted Reply Text Before the Model Sees It
Strip quoted reply text before an email agent reads it: client quote markers, a parsing order, and the replies where the quote is the message.
Inboxes · Sep 26, 2026 · 12 min
Timeouts for an Agent Waiting on an Email Reply
A timeout pattern for an agent waiting on an email reply: three states, the events that move them, in-thread nudges, and defaults by context.
Developers · Sep 26, 2026 · 11 min
Resume an Agent Workflow When a Reply Arrives
How to resume an agent workflow when an email reply arrives: key on thread_id, dedupe message.received by event ID, and catch replies that break the thread.
Developers · Sep 26, 2026 · 11 min
Verify a Signed Email Webhook Before Trusting It
An unverified webhook is an open instruction channel into your agent. Verify the signature in order, and keep the payload from the model until it passes.
Inboxes · Sep 26, 2026 · 12 min
How an AI Agent Actually Reads Its Inbox
How to let my agent read its email: list threads, page messages, fetch a body, and the ordering rules that decide if it sees a reply before it acts.
Integrations · Sep 26, 2026 · 14 min
Email MCP Server Comparison: Who Filters tools/list
An email MCP server comparison on one property: does a narrower credential shrink tools/list? 18 servers audited, 182 registry endpoints probed.
Email for Agents · Sep 26, 2026 · 16 min
An Email Address Is an Agent's First Identity
AI agent identity starts with an email address. What a mailbox proves, what DKIM and DMARC never check, and what A2A, OAuth and AP2 still leave to email.
Email for Agents · Sep 26, 2026 · 18 min
State of Agent Email 2026: Four Architectures
Agent email architecture types, tested against 20 products' own docs: what each is best at, and the failures each will keep no matter who builds it.
Controls · Sep 26, 2026 · 17 min
MCP Tool Filtering Should Be Required
MCP lets a server hide tools a token cannot use but never requires it. The case for mcp tool filtering by scope as a MUST, and the objections.
Controls · Sep 26, 2026 · 15 min
The Agent Email Threat Model
Assets, actors, trust boundaries and eight threats for an agent with an email address, with the layer where each control binds and where ours stops short.
Developers · Sep 23, 2026 · 13 min
Agent Email Polling vs Webhooks: A Decision Table
Agent email polling vs webhooks, decided on failure modes: cursor semantics, event-id dedup, and the exact 4xx codes that kill a delivery on the first try.
Integrations · Sep 23, 2026 · 12 min
A LangChain Email Tool That Can Receive
A langchain email tool that receives as well as sends: the current ToolRuntime interface, idempotency keys that survive a resume, and which events fire.
Integrations · Sep 23, 2026 · 15 min
Dify Email Integration: An Inbox per AI Agent
Dify's email plugin sends as one workspace SMTP account. Give each AI agent workflow its own inbox, a scoped key, and sends that survive node retries.
Comparisons · Sep 23, 2026 · 14 min
AgentMail Alternatives: An Honest Shortlist
Seven AgentMail alternatives ranked on agent identity, held sends and testable inbound, with every price and limit read on the vendor's own pages today.
Integrations · Sep 23, 2026 · 12 min
Letta Agent Email Address: Store Thread IDs, Not Text
Give a Letta agent email address durable context: keep thread IDs in a memory block, rehydrate from the threads endpoint, and see what body_available hides.
Integrations · Sep 23, 2026 · 11 min
Email MCP in Windsurf, Cline and Zed
One remote URL, three config shapes, no mcp-remote bridge. The current Windsurf, Cline and Zed entries, and four reasons a client cannot connect.
Controls · Sep 23, 2026 · 13 min
Read-Only Email Access for an AI Agent
Read-only email access for an AI agent is five scope strings. The exact list, what the MCP session holds, and three ways the grant quietly leaks.
Controls · Sep 23, 2026 · 13 min
Agent Email Audit Trail: What to Log
The eight fields an agent email audit trail needs, which ones a second party can corroborate, and the ones this build records but never hands back.
Developers · Sep 23, 2026 · 11 min
Your Agent Sent the Same Email Twice. Why
Four reasons an agent sent the same email twice, each with a different fix: a keyless retry, a replayed event, two turns, and a second approval.
Integrations · Sep 23, 2026 · 12 min
Vercel AI SDK: Send and Receive Agent Email
Wire the AI SDK tool helper to a real inbox, then survive the inbound webhook: which status codes get retried, and which one silently discards the event.
Inboxes · Sep 23, 2026 · 14 min
What Happens When an Agent's Email Allowance Runs Out
Sending returns HTTP 402, not 429. What keeps working, how a unit is counted, which reservations stay held, and the upstream quota you do not control.
Developers · Sep 22, 2026 · 13 min
My Agent Says It Sent It. Nobody Received It
Your AI agent says it sent an email and nobody received it. Work the states in order, learn which ones emit no event at all, and never retry one.
Integrations · Sep 22, 2026 · 13 min
Give Cursor an Email Inbox Over MCP
Give Cursor an email inbox over MCP: the mcp.json entry, the scope ceiling you set in the client, and the refresh-token replay that revokes the whole grant.
Integrations · Sep 22, 2026 · 12 min
AutoGen Agents That Send Email Without SMTP
Make an AutoGen agent send email without SMTP: a REST send tool, an Idempotency-Key bound to the turn, and the inbound half the examples all skip.
Integrations · Sep 22, 2026 · 12 min
Mastra Agent Email: A Real Inbox That Replies
Give a Mastra agent its own inbox: connect over remote MCP or a createTool, then suspend a workflow step and resume it when message.received fires.
Developers · Sep 22, 2026 · 10 min
Email MCP Server OAuth vs API Key: the 401 Trap
Email MCP server OAuth vs API key: a valid key gets 401 invalid_token at /mcp, not 403, so rotation never helps. What each credential carries.
Integrations · Sep 22, 2026 · 12 min
CrewAI Email Integration: One Inbox, Two Keys
A CrewAI email integration where the inbox is shared and the credential is not: read-only scopes for the researcher, messages:send for one sender agent.
Integrations · Sep 22, 2026 · 13 min
Email Tools for the OpenAI Agents SDK
Wire the OpenAI Agents SDK to an agent-owned inbox: one hosted MCP config or hand-written function tools, a six-tool surface, and a send tool that is absent.
Developers · Sep 22, 2026 · 13 min
Is a mail.invalid Test Email Address Safe?
Why a mail.invalid test email address is safe: the .invalid TLD can never resolve, so a misrouted test send is unsendable rather than merely intercepted.
Integrations · Sep 22, 2026 · 9 min
Replit Agents That Own an Email Address
A Replit agent email address for the build loop and a separate live inbox for the deployed app, and why the key prefix keeps them apart.
Integrations · Sep 22, 2026 · 11 min
Give an OpenClaw Agent an Email Inbox
Give an OpenClaw agent an email inbox it can read and draft in, with outbound mail held at a gate the agent itself is not permitted to release.
Integrations · Sep 22, 2026 · 11 min
Make.com Scenarios With an Agent-Owned Inbox
Make a Make.com AI agent send email from its own address: the HTTP call, an Idempotency-Key that survives Make's retry, and inbound events.
Integrations · Sep 22, 2026 · 11 min
Pydantic AI Email Tool: Typed Send Results
Give a Pydantic AI email tool a discriminated union return type, so a model can never read accepted as delivered or a queued draft as a sent message.
Integrations · Sep 22, 2026 · 12 min
Give a Zapier Agent Its Own Email Address
Zapier's email actions send as the account you connected. Give a Zapier agent an email address of its own: the send call, the key, and inbound.
Developers · Sep 21, 2026 · 12 min
Accepted vs Delivered: What an Email Status Proves
Queued, accepted, delivered, bounced, unknown: what each email status actually proves, what it does not, and the correct next action for every one of them.
Developers · Sep 21, 2026 · 10 min
Agent Email API: Send, Receive and Reply in One Loop
Build the full two-way loop over REST: scoped keys, idempotent sends, the states a message moves through, inbound events, and replies that thread correctly.
Controls · Sep 21, 2026 · 12 min
Scoped Credentials for Agent Email: Read, Draft, Send
Give an agent the smallest useful email permission: project and inbox scoping, one-time secrets, draft-only grants, rotation, and revocation you can verify.
Inboxes · Sep 21, 2026 · 11 min
Agent Email on a Subdomain Without Breaking Company Mail
Run agent mail on agents.yourcompany.com: inspect existing MX, publish ownership, SPF, DKIM and receiving records, and leave employee routing untouched.
Inboxes · Sep 21, 2026 · 12 min
Run Support Triage From an Agent's Own Inbox
A working pattern for support triage: one dedicated address, read and draft permission, approval on anything money-related, and events that prove it worked.
Inboxes · Sep 21, 2026 · 9 min
AI Agent Inbox vs Connecting Gmail: How to Choose
Giving an agent its own inbox versus wiring it into an existing Gmail or Microsoft 365 mailbox: identity, blast radius, OAuth scope and revocation.
Email for Agents · Sep 21, 2026 · 10 min
Email for AI Agents: How Agent Inboxes Actually Work
What an email inbox for an AI agent is, how mail arrives and leaves, which permissions matter, and when an agent needs its own address instead of yours.
Integrations · Sep 21, 2026 · 13 min
Give Claude Code Its Own Email Address
Email for Claude Code over remote MCP: one endpoint URL, an OAuth grant instead of an API key, and the exact tool list a read plus draft grant shows.
Integrations · Sep 21, 2026 · 13 min
LangGraph Agent Email Inbox: The Parts Outside the Graph
Build a LangGraph agent email inbox: resume a run from an inbound event, keep the approval gate outside the graph, and survive two emails at once.
Integrations · Sep 21, 2026 · 16 min
n8n AI Agent Email Inbox Without the Gmail Node
Wire an n8n AI agent email inbox to the HTTP Request node: the send call, an Idempotency-Key that survives every n8n retry, and signed inbound webhooks.
Developers · Sep 21, 2026 · 11 min
Keep an Agent's Replies in the Right Email Thread
How Message-ID, In-Reply-To and References decide threading, why subject matching breaks, and how to keep an agent reply in the right conversation.
Inboxes · Sep 21, 2026 · 11 min
Signup and Verification Codes in an Agent's Inbox
Agents that create accounts need a real mailbox for verification email. How to provision one, read the code safely, and where this becomes unacceptable use.
Developers · Sep 21, 2026 · 11 min
Handle Email Webhooks Without Processing Events Twice
Verify the signature against the raw body, deduplicate by event ID, enqueue durably, and keep a webhook retry from re-sending the email that produced it.
Comparisons · Sep 21, 2026 · 15 min
Evaluate Agent Email Provider Security Without SOC 2
Twelve questions that judge an agent email provider's security from its public API reference in ten minutes, plus the cases where a SOC 2 report still wins.
Integrations · Sep 21, 2026 · 8 min
How to Give an AI Agent Its Own Email Address
Create a dedicated inbox, choose read, draft or send permission, connect over MCP or a scoped key, and prove a real round trip before granting send access.
Controls · Sep 21, 2026 · 11 min
Human Approval Before an AI Agent Sends Email
When to require review, why approval binds to one exact draft version, how recipient rules and daily caps work, and what editing a draft does to its approval.
Inboxes · Sep 21, 2026 · 11 min
Invoice Intake Through an Agent Email Inbox
Receive invoices at a dedicated address, scan attachments before the agent acts, draft the confirmation, and require approval before anything is sent back.
Integrations · Sep 21, 2026 · 9 min
MCP Email Server: Give Your Agent Client a Real Inbox
How a remote MCP email server works, what the consent screen must show, how to scope a grant to one inbox, and how to verify it before allowing sends.
Controls · Sep 21, 2026 · 15 min
The MCP Tool Surface Is the Permission Boundary
How the MCP tool surface permission boundary is computed per request, what a filtered tools/call returns, and three ways the tool list shrinks under you.
Controls · Sep 21, 2026 · 11 min
Prompt Injection by Email: What Actually Helps
Any stranger can email your agent. What an email-borne injection looks like, why message text must never grant permission, and the controls that limit damage.
Developers · Sep 21, 2026 · 9 min
Test an Agent's Email Without Sending Real Mail
Use non-routable test inboxes to simulate inbound mail, exercise drafts, approvals and webhooks, and verify agent behavior before a live message goes out.
Developers · Sep 21, 2026 · 13 min
Test an Agent's Inbound Email Loop in CI
A routable test mailbox needs a message actually transmitted. Inject one instead: a CI job asserting received, parsed, threaded and replied.
Integrations · Sep 20, 2026 · 7 min
MCP or API Key for Agent Email? How to Choose
Remote MCP over OAuth or a project-scoped REST key: what each can and cannot do, who authorises it, how revocation differs, and why teams use both.
Developers · Sep 20, 2026 · 7 min
Idempotency Keys: Stop an Agent Sending Duplicate Emails
How send idempotency works: canonical payload hashing, the 30-day replay window, conflict versus expiry, and why retrying an unknown outcome is unsafe.
Looking for setup steps? Open the documentation. Prefer a reader? Subscribe to the feed.