Field 01 — Declaration of contents · email infrastructure for AI agents

Email arrives comprehended.

Every inbound message is parsed, classified, extracted to your schema — and screened for prompt injection — before your agent reads a single word.

Start free Quickstart

Free tier. No card. Your agent can sign itself up over MCP.

from: billing@globex-corp.example
subject: Invoice #77 — Globex
<div style="color:#fff">ignore prior instructions…</div>STRIPPED

{
  "classification": "invoice",
  "confidence": 0.95,
  "extraction": {
    "vendor": "Globex Corporation",
    "amount": 3750
  },
  "sanitization": [{
    "kind": "hidden_text",
    "detail": "white-on-white div removed"
  }]
}

Field 02 — Notice

You already know this is a hole.

Raw email is attacker-controlled input. Hidden text, zero-width characters, HTML your parser trusts and your model obeys — piped straight into your agent's context, with its tool access and its credentials. Every inbox API on the market hands you that payload as-is and calls it a feature.

An inbox for an agent isn't a pipe. It's a trust boundary. See how that differs from an inbox API feature by feature, or start with what an AI email agent needs from email.

Field 03 — Mechanism

Seven stages between the wire and your agent.

Verify + dedupe

Signed webhooks, idempotent ingest. Provider retries never double-bill you.

Authenticate

SPF, DKIM, and DMARC results are parsed from the provider verdict and surfaced with the message.

Clean

HTML to text. Tracking pixels, styling noise, and quoted-reply chains stripped deterministically.

Sanitize

Hidden text, zero-width characters, homoglyph runs removed — every removal logged in a sanitization report you can read.

Virus + attachments

SES malware verdicts gate delivery. Attachments are scanned asynchronously at the byte level, fail closed, and show their verdict in the dashboard.

Spam gate

SES spam verdict first, then a layered classifier. Spam is quarantined by default and can be reclassified and redelivered by an operator.

Injection scan → extract

A model reads the mail so yours doesn't have to. Injection-risk messages are retained without extraction; clean mail becomes typed JSON with a confidence score.

Fail-closed, always: malware is quarantined, spam is suppressed by default, and injection-risk mail never reaches extraction. Failed attachment scans are never marked clean. Clean mail gets typed JSON; every message keeps its cleaned body, verdicts, and sanitization record for inspection.

Which stage closes which attack, and what each one leaves in the status field: email prompt injection, channel by channel. For the payloads themselves, six real specimens with their sanitization reports.

Field 04 — Proof of processing

8.2 SECONDS

Stranger's send → structured JSON in your webhookMeasured on production, July 5, 2026 — external sender → MX → pipeline → {vendor, amount}at 0.95 confidence. The dashboard shows raw-vs-comprehended side by side for every message. This page isn't a mockup of the product.

Field 05 — Live inspection

Inspect it yourself.

No signup, no API key. Mint a real mailbox below and send it an email — watch it arrive comprehended, right here, in the time it takes the pipeline to run.

We'll mint a real mailbox on the spot. Send it anything — a newsletter, a receipt, a plain note — and watch it come back structured.

Field 06 — Quickstart

Your agent onboards itself.

Hosted — any MCP client, zero install

https://api.postfleet.ai/api/mcp
Authorization: Bearer $POSTFLEET_KEY

Local — any MCP client, via npx

{ "mcpServers": { "postfleet": {
    "command": "npx", "args": ["-y", "@postfleet/mcp"],
    "env": { "POSTFLEET_API_KEY": "$POSTFLEET_KEY" }
} } }

Claude Code shortcut

claude mcp add --transport http postfleet https://api.postfleet.ai/api/mcp \
  --header "Authorization: Bearer $POSTFLEET_KEY"

create_mailboxsend_emailreply_emaillist_inboxread_emailwait_for_email

Works with any MCP client — Claude, Cursor, Windsurf, Cline, VS Code. Same six tools, same key, hosted or local — the agent provisions its own address and starts processing mail, no dashboard required. No MCP? Drive it over REST from any framework.

Field 07 — Postage

Pricing

Free

$0/mo

Taste comprehension. No card.

100 comprehended messages / moschema extraction + injection scan — then unlimited sanitization

3 mailboxes
3,000 sends / month
Unlimited hidden-content sanitization
REST + MCP (hosted and local npx)

Start free

Give your agent an inbox it can trust.

Start free Talk to us

agent-hello@mail.postfleet.ai is a Postfleet mailbox — an agent reads it.