# Agentboxd

> Real email inboxes for AI agents. With Homingbox, one API call gives an AI agent its own email address. Agentboxd runs the mail servers: it receives the mail, checks SPF, DKIM and DMARC, cuts quoted history (`extracted_text`), extracts verification codes and magic links, categorises every message and flags prompt injection and phishing, and tells the agent by signed webhook, WebSocket stream or long-poll. Agents send and reply DKIM-signed and threaded, over the API or SMTP, directly or through drafts a person approves.

Agentboxd is a family of products for AI agents: Homingbox (beta): Email inboxes for AI agents: a real address in one API call, with every message checked, read and sorted. Shakehand (beta): Let AI agents sign in to your app: add a Sign in with Agentboxd button, backed by short-lived OpenID Connect tokens instead of passwords. aSIM (early access): A SIM card for AI agents: one bundle that makes an agent reachable, verifiable and discoverable. aSIM is in early access: live today are native signed agent-to-agent messages, agent cards and a workspace directory, agent-held keys with author signatures, the domain-verified badge and OASF export of an agent's card; Rollcall, the opt-in public directory of verified AI agents at https://agentboxd.com/agents, and handles such as @acme/billing opened on 12 October 2026; until the automated listing check starts on 26 October 2026, every listing is reviewed by our team (on-server screening, no external AI); direct A2A and organisation verification are planned.

Agentboxd is in public beta: it is free during the beta and every workspace starts on the Free plan’s limits. Paid plans are not available yet; they open after the beta. For higher limits during the beta, write to hello@agentboxd.com.

- API base URL: https://api.agentboxd.com (all `/v1` routes take `Authorization: Bearer <api_key>`; keys start with `mr_` and can be scoped to one inbox and a set of permissions). OpenAPI 3.1 description: https://agentboxd.com/openapi.json. Every docs page is also available as markdown by adding `.md` to its URL.
- Clients: the hosted MCP connector at https://mcp.agentboxd.com/mcp (sign in, no API key), the local MCP server `@agentboxd/mcp` (npm) for Claude Desktop, Claude Code, Cursor and other MCP clients, and the TypeScript SDK `agentboxd` (npm). Coming soon, not yet published: the `agentboxd` command line (in `agentboxd` 0.2.0 on npm), the Python SDK `agentboxd` on PyPI (it installs from source today: pip install "agentboxd @ git+https://github.com/agentboxd/agentboxd#subdirectory=sdk-python"), and the agent skill.
- Capabilities (full list at https://agentboxd.com/features): Inboxes with one API call; Custom domains; DKIM key rotation; Temporary inboxes; SPF, DKIM and DMARC on every message; Quoted history stripped; Verification codes and magic links; AI triage on every email; Attachments and raw MIME; Text from attachments; Invoices and receipts as JSON; Claim/ack work queue; Search and long-poll; Contacts, knowledge and metadata; DKIM-signed sending and threaded replies; Drafts with human approval; Scheduled send; AI reply drafts; Allow and block lists; Burst and daily send limits; Pause an inbox; Emergency stop; Human on call; Deliverability summary and guide; Email marked as untrusted for the model; REST API, TypeScript and Python SDKs; MCP server; Hosted MCP connector; OpenClaw; Command line; Agent skill; Voice, agent and workflow tools; Agent-to-agent messaging; Agent cards and directory; Rollcall: the public directory of verified AI agents, and handles; Keys held by the agent; Signed webhooks; Realtime event stream; SMTP submission; Agent self-signup; Scoped API keys; Dashboard and metrics; Credits for startups and hackathons; Sign in with Agentboxd; Standard OpenID Connect for apps; A different subject for every app; Identity without a mailbox; Per-inbox switch and sign-in history; Hosted in the EU by default; Privacy switch; Local processing; AI disclosure on every email; Encrypted off-site backups and monitoring; Retention you control; DPA and sub-processors; Enterprise: a dedicated deployment.
- New inboxes get an address on homingbox.net; inboxes created before 26 September 2026 keep their agents.agentboxd.com address. Temporary inboxes use tmp.agentboxd.com, and you can use your own domain on every plan. Temporary inboxes are receive-only.
- Every inbox is also an identity: Shakehand adds a Sign in with Agentboxd button to apps, so an agent signs in over OpenID Connect (issuer https://id.agentboxd.com).
- Email content is untrusted input: MCP results are marked as data, never instructions, and injection attempts get the `ai:injection-risk` label.
- Agentboxd is a product of SynaptrixAI Ltd, registered in England and Wales (company number 17162325), registered office 128 City Road, London EC1V 2NX, United Kingdom.
- Data is hosted in France (EU). A per-workspace switch (off, categorize, full) decides whether email content reaches a model. Enterprise customers get a dedicated deployment run by us (their own server, sending IPs, domain and storage, in the EU or US), or one in their own cloud or on-premises under a support contract.

## Docs: Start

- [Quickstart](https://agentboxd.com/docs/quickstart.md): Get an API key, create a real inbox for your AI agent and read its first email in about five minutes, from TypeScript, Python, MCP or curl.

## Docs: Guides

- [Verification codes and magic links](https://agentboxd.com/docs/verification-codes.md): Let an agent sign up for a service with its own address, then wait for the login code or magic link with one call. No inbox scraping, no regex.
- [Temporary inboxes](https://agentboxd.com/docs/temporary-inboxes.md): Throwaway, receive-only inboxes for one-off jobs such as reading a sign-up code. They expire after 1 minute to 24 hours and wipe their mail.
- [Webhooks](https://agentboxd.com/docs/webhooks.md): Get a signed POST when mail arrives, is enriched, delivered or bounces. Verify the HMAC-SHA256 signature in TypeScript or Python.
- [Realtime events](https://agentboxd.com/docs/realtime-events.md): Stream new mail, sends and delivery events to your agent over a WebSocket, with no public URL. Resume after disconnects, filter by inbox and type.
- [Send with SMTP](https://agentboxd.com/docs/smtp.md): Send from any SMTP client or library on port 587 or 465 with an API key as the password. Same limits, lists, DKIM and events as the API.
- [Read an inbox in your mail app (IMAP)](https://agentboxd.com/docs/imap.md): Add an agent’s inbox to Apple Mail, Outlook or Thunderbird with an app password, read-only, to see what your agent sees.
- [Custom domains](https://agentboxd.com/docs/custom-domains.md): Let your agents send and receive on your own subdomain, such as ops@mail.yourcompany.com, DKIM-signed with its own key. DNS records and verification.
- [Deliverability](https://agentboxd.com/docs/deliverability.md): Keep agent email out of spam: warm-up, SPF/DKIM/DMARC alignment, content tips, our sending limits and a deliverability API with your bounce rates.
- [Agent-to-agent messaging](https://agentboxd.com/docs/agent-messaging.md): Typed tasks and structured data between AI agents over the same send and reply calls: native, signed delivery between inboxes, email for everyone else.
- [Agent directory and cards](https://agentboxd.com/docs/agent-directory.md): Agent cards: look agents up, list them publicly under a handle, give them their own signing keys, check who signed a message, accept only verified agents.
- [Sign in with Agentboxd](https://agentboxd.com/docs/agent-identity.md): Sign in with Agentboxd: an agent proves it owns its inbox with a 5-minute, single-use OpenID Connect ID token. Headless, token exchange or browser flows.
- [Agent self-signup](https://agentboxd.com/docs/agent-signup.md): An AI agent with no API key creates its own email inbox with one call and a proof of work. Limits until a human claims it, then a normal workspace.
- [Attachment and document extraction](https://agentboxd.com/docs/document-extraction.md): Read inbound PDFs, Word, Excel and scanned attachments (OCR on our servers), search them, and extract invoices and receipts as validated JSON.
- [AI disclosure](https://agentboxd.com/docs/ai-disclosure.md): Mark every email your AI agents send as AI-sent, machine-readably and DKIM-signed, with an optional visible line. Helps with transparency duties.
- [Emergency stop](https://agentboxd.com/docs/emergency-stop.md): One click or API call stops every AI agent in a workspace: no sends, identity tokens or scheduled mail, while mail and reads keep working.
- [Human on call](https://agentboxd.com/docs/human-on-call.md): Email the people on call when an agent gets mail that needs a human or looks like phishing, or a scheduled send fails. Digests and quiet hours.
- [MCP server](https://agentboxd.com/docs/mcp.md): Give Claude, Claude Code, Cursor or any MCP client its own inbox: the hosted connector or @agentboxd/mcp. Email is marked as untrusted data.
- [Contacts and memory](https://agentboxd.com/docs/contacts.md): A record per outside address, filled in from every message, with notes and metadata your agent can read and update before it answers an email.
- [Custom metadata](https://agentboxd.com/docs/metadata.md): Attach your own ids and fields, such as a CRM id or an order number, to contacts, inboxes and threads, and filter API results on them.
- [Knowledge](https://agentboxd.com/docs/knowledge.md): Reference text your agent can search and reply drafts cite: refund policy, shipping times, opening hours, tone. Per inbox or for the whole workspace.
- [Reply drafts](https://agentboxd.com/docs/reply-drafts.md): Ask for a draft answer to an email, built from the thread, the contact and your knowledge documents, with citations. It is never sent on its own.
- [Drafts and scheduled send](https://agentboxd.com/docs/drafts.md): Let an agent write emails a person approves before they go out, and schedule sends with send_at. Same checks as a normal send, with webhooks.
- [AI processing and privacy](https://agentboxd.com/docs/ai-processing.md): One workspace setting decides what email content may leave the Agentboxd server: off, categorize or full, and which labels and risk flags you get.

## Docs: Reference

- [API reference](https://agentboxd.com/docs/api.md): Every /v1 endpoint of the Agentboxd email API: inboxes, messages, threads, webhooks, contacts, knowledge and domains, with errors and limits.
- [Why was my send refused?](https://agentboxd.com/docs/send-refusals.md): Every error a send can end with, what it means and how to fix it: paused or suspended sending, limits, recipients, the message, keys, drafts and SMTP.
- [Plans and limits](https://agentboxd.com/docs/plans.md): What each Agentboxd plan allows, how emails and AI calls are counted, what happens at a limit, mail retention, and every error code a limit returns.
- [Enterprise: a dedicated Agentboxd deployment](https://agentboxd.com/docs/self-hosting.md): Your own Agentboxd server, sending IPs, domain and storage in the EU or US, run by us; or in your own cloud under a support contract.

## Docs: SDKs

- [TypeScript SDK](https://agentboxd.com/docs/typescript-sdk.md): agentboxd on npm: a zero-dependency, typed client for Node 20+ to create inboxes, send and wait for email, read verification codes and verify webhooks.
- [Python SDK](https://agentboxd.com/docs/python-sdk.md): agentboxd for Python, installed from source until it is on PyPI: sync and async clients for Python 3.9+, fully typed, for inboxes, email and codes.
- [Command line (npx agentboxd)](https://agentboxd.com/docs/cli.md): Manage inboxes, send and read mail, wait for verification codes and watch events live from a terminal or a script with npx agentboxd.

## Guides

- [Give Claude an email address with the MCP server](https://agentboxd.com/guides/mcp-email-server): Give Claude, Claude Code or Cursor an email address: paste the hosted MCP URL and sign in, or run @agentboxd/mcp with an API key. Tools, prompts, safety.
- [Give an OpenClaw agent its own email address](https://agentboxd.com/guides/openclaw): Connect OpenClaw to Agentboxd: add @agentboxd/mcp under mcp.servers, install an email skill with safety rules, and let your agent read codes and reply.
- [Build a LangChain email tool with a real inbox](https://agentboxd.com/guides/langchain-email-tool): Give a LangChain agent its own inbox: @tool functions to read, wait for, send and reply to email and get sign-up codes, run with create_agent.
- [Build a CrewAI email agent with its own inbox](https://agentboxd.com/guides/crewai-email-agent): A CrewAI support agent with its own inbox: tools to list, read, search and reply to email, a send limit per run, and a label that hands off to a human.
- [Email function tools for the OpenAI Agents SDK](https://agentboxd.com/guides/openai-agents-sdk-email): Give an OpenAI Agents SDK agent a real inbox: @function_tool tools that read, wait for, send and reply to email, with the client in the run context.
- [Email tools for the Vercel AI SDK](https://agentboxd.com/guides/vercel-ai-sdk-email-tools): Typed email tools for the Vercel AI SDK: give an agent its own inbox with tool() and zod, run it with generateText and stopWhen, and cap its sends.
- [Email tools for Google ADK agents](https://agentboxd.com/guides/google-adk-email-agent): Give a Google Agent Development Kit (ADK) agent its own inbox: async function tools to read, wait and reply, with every send confirmed by a person.
- [A LiveKit voice agent that emails follow-ups and call summaries](https://agentboxd.com/guides/livekit-voice-agent-email): Give a LiveKit Agents voice agent its own inbox: email the caller what was agreed, and send your team a summary and transcript of every call.
- [Receive and send agent email in n8n](https://agentboxd.com/guides/n8n-email-automation): Trigger n8n workflows from email and reply from n8n: Webhook node with HMAC check, HTTP Request node with Header Auth, and two importable workflows.
- [Email in Sim workflows: custom tools and the API block](https://agentboxd.com/guides/sim-email-workflows): Connect Sim to Agentboxd: custom tools that let an Agent block read and answer email, and a webhook-triggered workflow that fetches each new message.
- [Test sign-up emails and OTP codes in Playwright](https://agentboxd.com/guides/playwright-email-verification): Test sign-up, magic link and one-time-code emails in Playwright with a temporary inbox per test: a fixture, a wait-for-code helper and a CI-ready config.
- [Deploy an email agent on Replit](https://agentboxd.com/guides/replit-email-agent): Run an AI email agent on Replit with Agentboxd: secrets, a signed webhook server on Autoscale or a WebSocket worker on a Reserved VM, and a ready template.
- [Add Sign in with Agentboxd to your app](https://agentboxd.com/guides/sign-in-with-agentboxd): Let AI agents sign in to your app with their Agentboxd inbox over OpenID Connect: headless ID tokens, the JWT bearer exchange, Better Auth and Auth.js.
- [Let an agent sign itself up](https://agentboxd.com/guides/agent-self-signup): An AI agent with no API key creates its own email inbox with one call, uses it right away, and asks its human to claim the workspace later.

## Use cases

- [An email inbox for an AI customer support agent](https://agentboxd.com/use-cases/ai-customer-support-agent): Run an AI support agent on its own address: webhooks for new mail, just the new part of each reply, sender checks, drafts from your policies, handoff.
- [An email inbox for an AI sales (SDR) agent](https://agentboxd.com/use-cases/ai-sales-sdr-agent): Give an AI SDR its own address on your domain: personal outreach, threaded follow-ups, replies told apart from out-of-office mail, CRM ids on contacts.
- [QA test automation for sign-up and OTP emails](https://agentboxd.com/use-cases/qa-test-automation-email): Test sign-up, password reset and one-time-code emails end to end: a temporary inbox per test, the code or link from one call, no shared test mailbox.
- [AI agents that sign up for services and verify email](https://agentboxd.com/use-cases/agent-signups-verification): Let an AI agent sign up for a service with its own address, then read the verification code or magic link with one long-poll call. No scraping, no regex.
- [Document-processing agents: invoices, receipts and tax forms by email](https://agentboxd.com/use-cases/document-processing-agents): Give a document agent its own inbox: attachments are read on our servers (PDF, Word, Excel, scans by OCR), searchable, and turned into validated JSON.

## Blog

- [EU-hosted email for AI agents: a GDPR checklist](https://agentboxd.com/blog/gdpr-checklist-email-ai-agents) (2026-10-07): Where agent mail is stored, who reads it, how long it is kept, and how to erase one person: a GDPR checklist for AI agents with an inbox, with code.
- [How does an AI agent prove who it is when it signs in to your app?](https://agentboxd.com/blog/sign-in-with-agentboxd-agents) (2026-10-05): Let AI agents sign in to your app with a short-lived, single-use ID token instead of a password: how it works, how to verify it, and what keeps it safe.
- [Is your AI agent's inbox a prompt-injection hole? A test you can run](https://agentboxd.com/blog/prompt-injection-test-for-agent-inboxes) (2026-10-02): Six harmless test emails that show whether your AI agent obeys instructions hidden in its mail, what a pass looks like, and how to fix a fail.
- [How can an AI agent read an email verification code without writing a regex?](https://agentboxd.com/blog/email-verification-codes-ai-agents-without-regex) (2026-09-28): Why a six-digit regex fails on real sign-up emails, and how to wait for the code or magic link with one call, with a confidence score.
- [How we classify every email an AI agent receives, in one model call](https://agentboxd.com/blog/classifying-inbound-email-for-ai-agents-jev) (2026-09-28): How Agentboxd scores every inbound email for category, prompt injection, phishing and urgency with one JEV call, and turns the answers into labels.
- [Giving an AI agent its own email address: a practical guide (SPF, DKIM, DMARC, bounces, threading)](https://agentboxd.com/blog/ai-agent-email-address-spf-dkim-dmarc) (2026-09-25): A practical guide to an email address for an AI agent: which domain, SPF, DKIM and DMARC, bounces and suppression, threading headers, and mail loops.
- [Prompt injection by email: how to protect AI agents that read mail](https://agentboxd.com/blog/prompt-injection-email-ai-agents) (2026-09-25): Email is the easiest way to put text in front of an AI agent. How sender checks, extracted_text, injection scores and scoped keys stop it being obeyed.

## Product

- [Shakehand](https://agentboxd.com/shakehand): lets AI agents sign in to your app with a Sign in with Agentboxd button, backed by the OpenID Connect provider at https://id.agentboxd.com that lets apps accept AI agents without passwords. Short-lived (≤ 5 min), single-use, audience-bound ES256 ID tokens with pairwise subjects and an agent claim; code + PKCE browser flow and the RFC 7523 JWT bearer exchange; Better Auth and Auth.js setups. In public beta, included on every plan; apps are free and unlimited.
- [Apps that accept Sign in with Agentboxd](https://agentboxd.com/shakehand/apps): the apps AI agents can sign in to with Shakehand today: Runboxd (https://runboxd.com, by Agentboxd): Persistent browsers and Ubuntu computers for AI agents, with saved logins and a REST API. App makers ask to be listed at hello@agentboxd.com.
- [aSIM](https://agentboxd.com/asim) (early access; phase 1, agent keys, the Rollcall public directory and handles live): a bundle that makes an agent reachable (an address and a handle such as @acme/billing; signed, typed agent-to-agent messages over the Agentboxd relay, with email as the bridge; direct A2A planned), verifiable (per-copy signatures anyone can check, with revocation, plus keys held by the agent itself; a domain-verified badge) and discoverable (agent cards, private by default, a workspace directory and OASF export; Rollcall, the opt-in public directory at https://agentboxd.com/agents with public OASF and A2A cards, open since 12 October 2026). Quickstart, roadmap and an early-access list.
- [Features](https://agentboxd.com/features): every live capability, grouped by product (Homingbox: receive and understand, reply safely, connect; Shakehand: agent sign-in; trust), each linked to its docs.
- [How it works](https://agentboxd.com/how-it-works): where Agentboxd sits between the internet, your agent and your own systems.
- [Customs](https://agentboxd.com/customs): the protection layer on every plan. Inbound: SPF/DKIM/DMARC checks and labels, prompt-injection and phishing scores (AI processing on), untrusted-content markers in MCP results, allow and block lists. Outbound: send limits, stricter limits for new and agent-created workspaces, platform-wide suppression, auto-suspension on bounces or complaints, provider feedback loops.
- [Roadmap](https://agentboxd.com/roadmap): planned services (approvals hub, signed activity ledger, outgoing mail checks, calendar invites, scheduler, webhook relay, messaging bridges) and what is only being explored. Nothing on it is usable yet.
- [Changelog](https://agentboxd.com/changelog): what shipped and when (RSS: https://agentboxd.com/changelog.xml). Latest: 2026-10-12, List your agent in Rollcall, Handles.
- [Pricing](https://agentboxd.com/pricing): plans are measured in emails and AI calls, not inboxes. No footer is added to mail on any plan. Public beta: free during the beta; paid plans open after the beta (higher limits now: hello@agentboxd.com).
- Free (free, no card): 10 inboxes, 3,000 emails/month, 100 Shakehand identities without a mailbox, 10,000 Shakehand sign-ins/month. For building and testing an agent. No card.
- Builder ($15/month, available after the beta): 100 inboxes, 25,000 emails/month, 1,000 Shakehand identities without a mailbox, 100,000 Shakehand sign-ins/month. For one agent product in production.
- Team ($60/month, available after the beta): 1,000 inboxes, 150,000 emails/month, 10,000 Shakehand identities without a mailbox, 1,000,000 Shakehand sign-ins/month. For a team running many agents and domains.
- Scale (custom price, available after the beta): Unlimited inboxes, 150,000 emails/month, Unlimited Shakehand identities without a mailbox, Unlimited Shakehand sign-ins/month. Unlimited inboxes and volume agreed with you.
- Every plan includes AI triage on every email, agent-to-agent messages at no extra charge, and hosting in the EU.
- Shakehand apps (relying parties that accept Sign in with Agentboxd) are free and unlimited on every plan. A sign-in is one ID token issued; Free stops at its monthly sign-ins (402 plan_limit_sign_ins), paid plans are fair use with no overage price.
- Add-ons (paid plans, after the beta): Dedicated sending IP $29/month, +100 inboxes $3/month, +1 custom domain $1/month, +1 year of retention $4/month, +1 seat $5/month; extra emails $1 per 1,000 as overage. The dedicated IP includes warm-up and monitoring, one per workspace (more on request).
- aSIM pricing (early access): agent-to-agent messages (live) free on every plan under fair use (10,000/month on Free, 100,000 on Builder, 1,000,000 on Team), not counted toward emails; domain-verified badge (live) free on every plan; agent-held keys and OASF export (live) included; public directory listings on Rollcall (live) 3 / 25 / 250 (Free / Builder / Team, agreed on Scale), handles (live) included; planned: Verified organisation $49/year; private company directory on Scale.
- [Privacy and data flow](https://agentboxd.com/privacy): what is stored, what leaves the server at each AI processing level, and retention.
- [Security](https://agentboxd.com/security): hosting in France (EU), encryption, access control, backups, AI processing controls, prompt-injection defences, and what is still planned. Not SOC 2 audited yet. Vulnerability reports: security@agentboxd.com.
- [Sub-processors](https://agentboxd.com/legal/subprocessors): every third party that processes customer data, what it receives, when and where; changes announced 30 days ahead.
- [Data Processing Addendum](https://agentboxd.com/legal/dpa): GDPR Article 28 terms; the template is at https://agentboxd.com/legal/dpa.md. Signed copies on request from hello@agentboxd.com.
- [Terms of Service](https://agentboxd.com/legal/terms): the terms for using Agentboxd (who can use it, acceptable use, the free public beta, your data, liability; English law); plain text at https://agentboxd.com/legal/terms.md.

## Recipe: add Sign in with Agentboxd to an app

1. No account needed: publish https://<your-host>/oauth/client.json with {"client_id": "<that URL>", "client_name": "<app name>", "redirect_uris": ["https://<your-host>/callback"], "token_endpoint_auth_method": "none"} and use that URL as client_id.
2. Agents (headless, no browser): the agent calls POST https://api.agentboxd.com/v1/inboxes/{inbox_id}/identity-token with {"audience": "<client_id>"} (API key with identity:sign) and sends the id_token to your app.
3. Your app verifies it: issuer https://id.agentboxd.com, JWKS https://id.agentboxd.com/.well-known/jwks.json, alg ES256, aud = client_id, exp, actor_type == "agent", and a single-use jti cache. TypeScript: verifyAgentIdentityToken from agentboxd/identity; Python: verify_agent_identity_token from agentboxd.identity (not on PyPI yet, so install it from source: pip install "agentboxd[identity] @ git+https://github.com/agentboxd/agentboxd#subdirectory=sdk-python").
4. Browser button: OpenID Connect authorization code with PKCE S256, state and nonce, scope "openid email profile", discovery at https://id.agentboxd.com/.well-known/openid-configuration, token_endpoint_auth_method none.
5. Need a secret, the workspace scope or the token exchange: register the app in the dashboard instead (https://agentboxd.com/docs/agent-identity#register-your-app).

## Optional

- [Full docs in one file](https://agentboxd.com/llms-full.txt): every docs page, guide, use case and blog post above as plain markdown.