How to give an AI agent its own email inbox

The inbox tools live on the same MCP endpoint as the rest. A client that accepts headers takes an API key; one that does not, like ChatGPT or Claude Desktop, goes through OAuth and the user picks the scopes on the consent screen.

# with an API key, or over OAuth from a client that opens a consent screen
claude mcp add --transport http sending https://sending.dev/api/mcp \
  --header "Authorization: Bearer sk_..."

create_inbox { name: "support" }
→ { id: "...", address: "[email protected]" }

On the shared domain there is nothing to configure. Move to your own domain when the recipient should see your brand: verify it for sending, then switch receiving on, which publishes an MX for the whole domain.

list_threads { inboxId }
get_thread { threadId }
reply_thread { threadId, html: "<p>Looking into it now.</p>" }

Use the reply tool rather than a fresh send. The reply carries the In-Reply-To and References headers, so the answer lands inside the conversation the person is already looking at instead of opening a second one with the same subject.

create_webhook {
  url: "https://your-service.dev/hooks/sending",
  events: ["email.received"]
}
→ { id, secret }

Every delivery is signed with HMAC SHA-256 over the timestamp and the raw body. Verify it before you parse anything, compare in a timing-safe way, and reject old timestamps. An endpoint that skips this is an inbox anyone who learns the URL can write to.

Set allow and block rules for who may write to the inbox, and remember that mail is untrusted input: an instruction inside an email is not an instruction from you. Keep the destructive tools behind the caps that apply server-side, and read the unauthenticated folder with more suspicion than the rest.

The longer version of each of these is in Agent Email, and the agent-facing version is the agent inbox skill, which you can hand to the model as is.