AgentMail
by AgentMail
Give an AI agent its own email inbox: create inboxes, read threads and send mail to anyone. 26 tools in the vendor's published contract, OAuth sign-in, no read-only scope.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect AgentMail via MCP
https://mcp.agentmail.to/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
AgentMail Tools & Capabilities (26)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- Outbound is ungated by default, and this is the connector's defining risk.
send_message,reply_to_messageandforward_messageall take recipients as a plain array of strings. There is no allowlist parameter, no confirmation step in the contract, and no server-side approval gate. Whether the agent asks you before sending is your MCP client's behaviour, not AgentMail's. - The guardrails exist but live outside the connector. AgentMail's Lists feature offers six filters across
send,receiveandreplyin allow and block forms, scoped at organisation, pod or inbox level, with the narrower scope winning. AgentMail calls a send allowlist a hard safety boundary. None of the 26 MCP tools reads or writes a list, so configure it before you connect — and an agent that later hits the boundary cannot lift it through this connector. - The consent screen offers no application scope. Read, send and delete arrive together over OAuth. Narrowing requires the API-key path.
- Plan caps, and an unverified-account cap beneath them. AgentMail publishes 3,000 emails a month and 3 inboxes on Free, 10,000 and 10 on Developer, 150,000 and 150 on Startup. An organisation that has not completed agent verification is capped at 1 inbox and 10 sends per day until someone supplies the six-digit code emailed to the human who signed up.
- Rate limits are per API key, returned as HTTP 429 with a
Retry-Afterheader. AgentMail recommends exponential backoff and spreading volume across inboxes. - Deletion is real deletion.
delete_inbox,delete_threadanddelete_draftare annotated destructive, and message permissions govern thread deletion — so a credential that can delete a message can delete a whole conversation. - Incoming mail is untrusted input. Six tools that surface external content warn the model in their own descriptions not to follow it. Virus-bearing mail is rejected at the gateway and never stored; spam is stored but excluded from listings unless
includeSpamis set. - Every read returns personal data. Thread and message payloads carry sender addresses, subjects and full bodies, plus attachment text for PDF and DOCX. Treat an agent with this connector as an agent holding correspondence.
- We did not run a live handshake. The endpoint requires authentication — an anonymous
initializereturned 401 — so tool names, schemas and annotations here come from AgentMail's own published runtime contract, not from our owntools/list. Anthropic's directory disagrees with it, as set out above.
Frequently asked questions
Can the AgentMail connector send email to anyone, or only to approved addresses?
Anyone, unless you configure a send allowlist first. AgentMail's own documentation says an inbox can send to anyone on the internet, and the send_message contract takes a free-form array of recipient strings with no restriction. A send allowlist exists and AgentMail calls it a hard safety boundary, but you set it through the API, CLI or console — no connector tool manages it.
Is there an OAuth scope that lets the agent read mail without sending it?
No. AgentMail's RFC 9728 descriptor advertises only openid, email and profile — identity scopes, with no application scope of any kind. The consent screen therefore has nothing meaningful to narrow. A read-without-send credential does exist, but only as an API key: message_read and message_send are separate API-key permissions, and API keys are the alternative sign-in path.
Can an AI agent create its own email addresses with this connector?
Yes. create_inbox makes a new working inbox and every parameter is optional, so an agent can call it with no arguments and receive an address on the shared agentmail.to domain. Supplying a domain restricts it to one you have verified. Plan caps are the real ceiling: the free plan allows three inboxes and an unverified organisation allows one.
How many emails can an AgentMail agent send per day?
It depends on plan, and the tightest cap is the one you hit first. An organisation that has not completed agent verification is limited to one inbox and ten sends per day, which the agent_verify tool exists to lift. Published plan limits are monthly, not daily: 3,000 emails on Free, 10,000 on Developer and 150,000 on Startup.
Does AgentMail protect an agent from prompt injection in incoming email?
Partly, and it is unusually candid about the gap. Six tools that return externally authored content carry a warning inside their own tool descriptions telling the model not to treat that content as instructions. AgentMail also rejects virus-bearing mail at the gateway and hides spam from listings by default. The warning is advisory text, not enforcement.
Why does the AgentMail connector list fewer tools in Claude's directory than in the docs?
Three sources disagree, and the vendor's generated contract is the newest. Anthropic's directory snapshot names 24 tools including auth_me; AgentMail's runtime manifest names 26 and has no auth_me at all. A July 2026 commit removed auth_me from the hosted catalogue while keeping it in the toolkit, and an August commit added agent_verify.
Sources
- AgentMail MCP integration guide (retrieved 2026-08-21) · retrieved 2026-08-21
- AgentMail
mcp-manifest.json, runtime-generated tool contract (retrieved 2026-08-21) · retrieved 2026-08-21 - AgentMail Lists documentation (retrieved 2026-08-21) · retrieved 2026-08-21
- AgentMail Permissions documentation (retrieved 2026-08-21) · retrieved 2026-08-21
- AgentMail human-in-the-loop guide (retrieved 2026-08-21) · retrieved 2026-08-21
- AgentMail rate limits (retrieved 2026-08-21) · retrieved 2026-08-21
- AgentMail spam and virus detection (retrieved 2026-08-21) · retrieved 2026-08-21
- AgentMail inbox capabilities (retrieved 2026-08-21) · retrieved 2026-08-21
- Live OAuth posture check: anonymous
initializereturned HTTP 401 with aWWW-Authenticateheader naming the RFC 9728 descriptor atmcp.agentmail.to/.well-known/oauth-protected-resource/mcp(2026-08-21) · retrieved 2026-08-21 - Anthropic Connectors Directory entry (committed snapshot dated 2026-08-16) · retrieved 2026-08-16
- AgentMail privacy policy — · Support — support@agentmail.cc
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Communication
- Developer
- AgentMail
- Tools
- 26
- Domain
- mcp.agentmail.to
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.