MultiMail
About
Email for AI agents. Send and receive as markdown with human oversight.
Details
- Author
- multimail-dev
- Categories
- Communication, Automation, AI
Jump to
Setup
Install MultiMail in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/multimail-dev/mcp-server
Follow the installation instructions in the repository README, then restart your MCP client.
Your agent doesn't have email yet because nobody trusts it with email yet. MultiMail fixes that. A real email address with a trust ladder from read-only to fully autonomous, cryptographic identity on every message, and per-recipient sending controls.
{ "mcpServers": { "multimail": { "type": "url", "url": "https://mcp.multimail.dev/mcp" } } }
Remote server. No install. Authenticates via OAuth on first connect.
Works with Claude.ai, Claude Desktop, Claude Code, Cursor, Windsurf, Copilot (VS Code), ChatGPT Desktop, and any MCP client that supports remote servers.
{ "mcpServers": { "multimail": { "command": "npx", "args": ["-y", "@multimail/mcp-server"], "env": { "MULTIMAIL_API_KEY": "mm_live_...", "MULTIMAIL_MAILBOX_ID": "01KJ1NHN8J..." } } } }
Get a key atmultimail.dev. Or run without one to create an account interactively.
Every mailbox has an oversight mode. Start restrictive, graduate as the agent earns trust.
Agents request upgrades via the API. The operator approves with a one-time code. Downgrades need no approval. The agent can always restrict itself.
The gated approval flow isformally verified in Lean 4. No email reaches delivery without passing through operator approval, for every possible code path.
Ingated_sendmode, allowlisted recipients bypass the approval queue. Add exact addresses (vendor@example.com) or domain wildcards (@example.com). Every addition requires operator email approval. The agent cannot self-approve allowlist changes.
The practical middle ground: routine correspondence with known contacts goes immediately, new recipients still require oversight.
Every outbound email carries a signedX-MultiMail-Identityheader (ECDSA P-256). The payload includes operator name, oversight mode, capabilities, and verification status. Recipients verify against the public key atGET /.well-known/multimail-signing-key.
A separateX-MultiMail-Reputationheader links to privacy-preserving reputation data: bounce rates, complaint rates, account age. No raw addresses exposed.
Without verified identity, recipients cannot distinguish your agent from a spammer. With it, they can verify the operator, the oversight level, and the sending history before reading a word.
Agent DID relay (optional).If your agent has bound adid:keyto its MultiMail account, pass an optionalucanparameter tosend_email/reply_email. MultiMail relays your agent's self-signed UCAN verbatim in a separateX-Agent-Identityheader (did="…"; ucan="…") — it doesnotsign or vouch for it; recipient tooling verifies the delegation independently. Inert unless a DID is bound.
Agents can register themselves without a browser. The protocol uses verified-email identity assertion, following theauth.mdconvention inspired byWorkOS AuthKit:
POST /agent/auth -> claim_token + OTP sent to operator email POST /agent/auth/claim/complete -> API key + tenant_id + granted scopes
- GET /.well-known/oauth-protected-resource(resource metadata)
- GET /.well-known/oauth-authorization-server(authorization metadata withagent_authextension)
- GET /auth.md(human/agent-readable registration guide)
TheWWW-Authenticateheader on 401 responses points agents to these endpoints automatically. An agent that hits a 401 can follow the link, read the registration protocol, and onboard itself.
Every outbound email is scanned before delivery. Emails enterpending_scanstatus, then transition to delivery orpending_send_approval(in gated modes). Inbound emails go through the same pipeline. Phishing, malware, and prompt injection patterns are flagged before reaching the agent's inbox.
- Email bodies aremarkdownin, formatted HTML out. Inbound HTML arrives as clean markdown (15x fewer tokens than raw MIME).
- Threading is automatic. Reply to an email and headers are set correctly.
- Sends returnpending_scanwhile scanned. Gated mailboxes then transition topending_send_approvalfor human review. Do not retry.
- Every outbound email carries a cryptographically signedX-MultiMail-Identityheader.
- Reputation data viaX-MultiMail-Reputationheader: bounce rates, complaint rates, account age. Privacy-preserving, updated daily.
Find the most recent email from alice@example.com, summarize what she's asking, then draft a reply saying I'll review this week. Don't send until I approve.
Check my inbox and summarize the last 5 unread emails. For each: sender, subject, time, and whether it needs action today.
Review the pending approval queue. For each pending email: who it goes to, the subject, risk factors, and whether to approve or reject.
Show my current sending allowlist. Then add @acme.com so emails to Acme skip approval.
- REST API:https://api.multimail.dev(OpenAPI spec)
- CLI:npx -y @mvanhorn/printing-press install multimail(every API endpoint as a shell command)
- SDKs:Python,Vercel AI SDK,LangChain,LlamaIndex,CrewAI,AutoGen
npm install npm run dev # Run with tsx npm run build # Compile TypeScript npm start # Run compiled version
By using MultiMail you agree to theTerms of ServiceandAcceptable Use Policy.
Self-hosted email and SMS platform for AI agents — each agent gets a real email address, phone number, inbox, and API key.
Email infrastructure for AI agents — create mailboxes, send/receive emails, and auto-extract verification codes.
Credit-based email infrastructure for AI agents with inboxes, sending, memory, recovery, and MCP access.
Give AI agents their own local mailbox to read, send, and triage email.
Self-hosted email for AI agents: unlimited mailboxes on your own domain, with OTP extraction.
Sendmux serves AI-native startups, SaaS teams, automation agencies, and platform builders that need AI agents to send, receive, route, and react to email in production. Primary buyers and users include technical founders, founding engineers, backend engineers, platform engineers, AI automation consultants, support automation leads, ops teams, and growth teams using their own Gmail, Outlook, SMTP, or managed Amazon SES sending setup.
The MCP email server with human approval — AI drafts emails, you approve before they send. Works with Claude Code, Cursor, Windsurf, and any MCP client.
AI personal assistant for email Inbox Zero
Enables seamless integration with communication platform that allows you to reach your customers globally across any channel.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
