AgentMail

Give an AI agent its own email inbox: create inboxes, read threads and send mail to anyone.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the AgentMail connector does

The AgentMail MCP server gives an AI agent its own email inbox. It exposes tools to create addresses, read threads and attachments, and send, reply to or forward mail to any recipient on the internet. Sign-in is OAuth through the AgentMail console. Unlike a mailbox connector, the inbox here belongs to the agent rather than to a person.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

AgentMail tools (26)

  • auth_me
  • create_draft
  • create_inbox
  • delete_draft
  • delete_inbox
  • delete_thread
  • forward_message
  • get_attachment
  • get_draft
  • get_inbox
  • get_thread
  • list_drafts
  • list_inboxes
  • list_messages
  • list_threads
  • reply_to_message
  • search_messages
  • search_threads
  • send_draft
  • send_message
  • update_draft
  • update_inbox
  • update_message
  • update_thread

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • Outbound is ungated by default, and this is the connector's defining risk. send_message, reply_to_message and forward_message all take recipients as a plain array of strings. There is no allowlist parameter, no confirmation step in the contract, and no server-side approval gate. Whether the agent asks you before sending is your MCP client's behaviour, not AgentMail's.
  • The guardrails exist but live outside the connector. AgentMail's Lists feature offers six filters across send, receive and reply in allow and block forms, scoped at organisation, pod or inbox level, with the narrower scope winning. AgentMail calls a send allowlist a hard safety boundary. None of the 26 MCP tools reads or writes a list, so configure it before you connect — and an agent that later hits the boundary cannot lift it through this connector.
  • The consent screen offers no application scope. Read, send and delete arrive together over OAuth. Narrowing requires the API-key path.
  • Plan caps, and an unverified-account cap beneath them. AgentMail publishes 3,000 emails a month and 3 inboxes on Free, 10,000 and 10 on Developer, 150,000 and 150 on Startup. An organisation that has not completed agent verification is capped at 1 inbox and 10 sends per day until someone supplies the six-digit code emailed to the human who signed up.
  • Rate limits are per API key, returned as HTTP 429 with a Retry-After header. AgentMail recommends exponential backoff and spreading volume across inboxes.
  • Deletion is real deletion. delete_inbox, delete_thread and delete_draft are annotated destructive, and message permissions govern thread deletion — so a credential that can delete a message can delete a whole conversation.
  • Incoming mail is untrusted input. Six tools that surface external content warn the model in their own descriptions not to follow it. Virus-bearing mail is rejected at the gateway and never stored; spam is stored but excluded from listings unless includeSpam is set.
  • Every read returns personal data. Thread and message payloads carry sender addresses, subjects and full bodies, plus attachment text for PDF and DOCX. Treat an agent with this connector as an agent holding correspondence.
  • We did not run a live handshake. The endpoint requires authentication — an anonymous initialize returned 401 — so tool names, schemas and annotations here come from AgentMail's own published runtime contract, not from our own tools/list. Anthropic's directory disagrees with it, as set out above.

Frequently asked questions

Can the AgentMail connector send email to anyone, or only to approved addresses?

Anyone, unless you configure a send allowlist first. AgentMail's own documentation says an inbox can send to anyone on the internet, and the send_message contract takes a free-form array of recipient strings with no restriction. A send allowlist exists and AgentMail calls it a hard safety boundary, but you set it through the API, CLI or console — no connector tool manages it.

Is there an OAuth scope that lets the agent read mail without sending it?

No. AgentMail's RFC 9728 descriptor advertises only openid, email and profile — identity scopes, with no application scope of any kind. The consent screen therefore has nothing meaningful to narrow. A read-without-send credential does exist, but only as an API key: message_read and message_send are separate API-key permissions, and API keys are the alternative sign-in path.

Can an AI agent create its own email addresses with this connector?

Yes. create_inbox makes a new working inbox and every parameter is optional, so an agent can call it with no arguments and receive an address on the shared agentmail.to domain. Supplying a domain restricts it to one you have verified. Plan caps are the real ceiling: the free plan allows three inboxes and an unverified organisation allows one.

How many emails can an AgentMail agent send per day?

It depends on plan, and the tightest cap is the one you hit first. An organisation that has not completed agent verification is limited to one inbox and ten sends per day, which the agent_verify tool exists to lift. Published plan limits are monthly, not daily: 3,000 emails on Free, 10,000 on Developer and 150,000 on Startup.

Does AgentMail protect an agent from prompt injection in incoming email?

Partly, and it is unusually candid about the gap. Six tools that return externally authored content carry a warning inside their own tool descriptions telling the model not to treat that content as instructions. AgentMail also rejects virus-bearing mail at the gateway and hides spam from listings by default. The warning is advisory text, not enforcement.

Why does the AgentMail connector list fewer tools in Claude's directory than in the docs?

Three sources disagree, and the vendor's generated contract is the newest. Anthropic's directory snapshot names 24 tools including auth_me; AgentMail's runtime manifest names 26 and has no auth_me at all. A July 2026 commit removed auth_me from the hosted catalogue while keeping it in the toolkit, and an August commit added agent_verify.

Sources

More Communication connectors

  • Circleback

    Search meeting notes, transcripts, action items, calendar and connected email.

  • Fellow.ai

    Pull meeting transcripts, summaries, action items and participants from Fellow.

  • Fireflies

    Search Fireflies transcripts and summaries.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put AgentMail to work.

Connect AgentMail once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio