Field 01 — Declaration of contents · email infrastructure for AI agents
Your agent gets JSON. Or it gets nothing. Never the raw email.
Every inbound message is parsed, classified, extracted to your schema — and screened for prompt injection — before your agent reads a single word.
Free tier. No card. Your agent connects over MCP, the tool link agents already use.
{
"classification": "invoice",
"confidence": 0.95,
"extraction": {
"vendor": "Globex Corporation",
"amount": 3750
},
"sanitization": [{
"kind": "hidden_text",
"detail": "white-on-white div removed"
}]
}Field 02 — Notice
Raw email is attacker-controlled input. Hidden text, zero-width characters, HTML your parser trusts and your model obeys — piped straight into your agent's context, with its tool access and its credentials. Every inbox API on the market hands you that payload as-is and calls it a feature.
An inbox for an agent isn't a pipe. It's a trust boundary. See how that differs from an inbox API feature by feature, or start with what an email agent needs from email.
Field 03 — Mechanism
Fail-closed, always: malware is quarantined, spam is suppressed by default, and injection-risk mail never reaches extraction. Failed or unknown virus verdicts are never marked clean. Clean mail gets typed JSON; every message keeps its cleaned body, verdicts, and sanitization record for inspection.
What the current virus gate actually does — SES header, no attachment bytes, no public download: email attachment security for AI agents. Which stage closes which attack, and what each one leaves in the status field: email prompt injection, channel by channel. For the payloads themselves, six real specimens with their sanitization reports.
Field 04 — Proof of processing
{vendor, amount} at 0.95 confidence. Your agent still never receives the raw email. After you sign in, you can open the cleaned message beside the JSON, and the original for seven days after it arrives. This page isn't a mockup of the product.Field 05 — Send a test email
No signup, no API key. Mint a real mailbox below and send it an email — watch it arrive as data, right here, in the time it takes the pipeline to run.
We'll mint a real mailbox on the spot. Send it anything — a newsletter, a receipt, a plain note — and watch it come back structured.
Field 06 — Connect your agent
Hosted — any MCP client, zero install
https://api.postfleet.ai/api/mcp
Authorization: Bearer $POSTFLEET_KEYLocal — any MCP client, via npx
{ "mcpServers": { "postfleet": {
"command": "npx", "args": ["-y", "@postfleet/mcp"],
"env": { "POSTFLEET_API_KEY": "$POSTFLEET_KEY" }
} } }Claude Code shortcut
claude mcp add --transport http postfleet https://api.postfleet.ai/api/mcp \
--header "Authorization: Bearer $POSTFLEET_KEY"Works with any MCP client — Claude, Cursor, Windsurf, Cline, VS Code. Same 16 tools, same key, hosted or local — the agent provisions its own address and starts processing mail. No account page required. No MCP? Drive it over REST from any framework.
Field 07 — Plans and prices
Try it. No card.
Screened mail, small scale.
For a developer shipping agents.
For a team running agents in production.
Deterministic sanitization and the deterministic injection check run on every message and are not metered. The model injection scan and schema extraction share the monthly monthly limit. Past that limit, your agent still gets the cleaned text, and the deterministic injection check still runs.
Field 08 — Dispatch
agent-hello@mail.postfleet.ai is a Postfleet mailbox — an agent reads it.
