Mails.ai
Mails.ai gives each AI agent its own real email address through a single API call. Every inbound reply arrives as a typed event carrying a prompt-injection score and sender reputation. Transactional sending only, cold outreach is refused.
What is Mails.ai?
Mails.ai is programmatic email infrastructure built specifically for AI agents, designed around the inbox as its central primitive rather than bolting reply handling onto a send-first transactional product. Each agent you create receives a real, working address, either on a free workspace subdomain that needs no DNS setup at all, or on your own domain on paid plans, verified through DNS records and DKIM-signed per domain.
Three operations sit at the centre, send, receive and reply, exposed through a REST API, TypeScript and Python SDKs, and an MCP server. What distinguishes the product is the shape of what comes back. Every inbound message arrives as a typed reply.event carrying an id, the agent it belongs to, sender, subject, body and, always included at the base price, an injection_score and a sender_reputation value. Your code never parses raw MIME. A six-category prompt-injection scanner runs on every inbound message and flags the event as quarantined above 0.95, so an agent can refuse to act on a poisoned message before it reaches your own logic. Intent, entities and urgency are extracted too, but only if you opt in agent by agent.
The second distinguishing choice is that the acceptable-use rule is enforced inside the send call. A cold-outreach attempt is refused with a 422 cold_email_prohibited response and a confidence score, rather than merely being forbidden in the terms. Delivery runs on a managed AWS SES layer with a documented multi-vendor failover runbook and a roughly four-hour DNS swap path. A per-sender job sweeps complaint and bounce rates every fifteen minutes and auto-pauses any sender crossing 0.3% complaints, below the 0.5% threshold at which the upstream provider would step in.
Distribution is MCP-native: the MCP server is published on npm, runs client-side and needs no server of your own. Pricing is fully self-serve across four tiers with no enterprise gate and no sales team to call. The publisher describes itself as pre-launch, with the API live and self-serve today and a Phase 1 milestone announced for the third quarter of 2026.
What it does
- Give an AI agent its own real email address in a single API call
- Send transactional email directly from the agent's code
- Receive every reply as a structured, typed event instead of raw MIME
- Score each inbound message for prompt injection before the agent acts on it
- Query sender reputation agent by agent
- Extract intent, entities and urgency to route replies without a second LLM call
- Plug email into an agent IDE through the MCP server
When to use Mails.ai / When not to
A quick filter to help you decide if Mails.ai is the right fit.
When to use Mails.ai
- Developers building AI agents that must send and read email programmatically
- Teams running support agents that reply to inbound conversation threads
- Engineers shipping inbox-automation agents at volume, in the range of a thousand sends and several thousand parses a day
- Product teams sending transactional notifications such as confirmations, password resets, two-factor codes and alerts
- Solo builders and small teams who want to skip enterprise sales calls and avoid writing their own MIME parsing layer
When not to use Mails.ai
- Anyone doing cold outreach or prospecting, which is refused at the API call itself and prohibited without exception
- Marketing teams wanting campaigns, segmented broadcasts, newsletters or a visual template editor, none of which exist here
- Businesses working from purchased, scraped or rented recipient lists
- Buyers who need SOC 2, HIPAA or ISO 27001 in place today, or who require SSO, SAML and a procurement process
- Senders in the categorically banned content classes, including gambling, pharmaceuticals, adult services, multi-level marketing and payday loans
How to use Mails.ai
A typical end-to-end flow, from setup to results.
- Sign up on the site with a magic link, no payment card required
- Collect your API key from the signup flow
- Install the SDK, for instance with npm install @mailsai/sdk, with pnpm, bun and npx also documented
- Create an agent in code, which provisions its address on your workspace subdomain
- Wait for your workspace to clear manual approval, because self-serve signup is not self-serve sending
- Send a message with the SDK send method, or by posting to the /v1/messages endpoint
- Handle replies with the SDK onReply reactor, or point an HMAC-signed webhook at your own endpoint
- For an agent IDE, drop the MCP server snippet into the runtime's configuration file so the mails tools register themselves
- On a paid plan, add your own sending domain and complete DNS and DKIM verification
- Enable opt-in classification per agent if you want intent, entities and urgency extracted for you
Pros & Cons
Pros
- Inbound mail is treated as a first-class primitive, delivered as typed events rather than raw MIME
- Injection scanning and sender reputation are included on every inbound at the base price, not sold as extras
- The usage rule is enforced at the API, and the refusal tells the agent exactly why it was refused
- Entirely self-serve, with no SSO or SAML gate, no procurement and no contact-sales tier
- A permanent free tier of 3,000 events a month, with no payment card required
- Unusually candid documentation, stating plainly the missing certifications, the absent features and the pre-launch status
- Sub-processors published with purpose, region and date added, and complaint auto-pause at 0.3% protecting the shared pool
Cons
- The publisher is pre-launch: current sending runs on the shared pool and the dedicated IP add-on is described as roadmap
- The metered tier is announced as coming soon and cannot be purchased today
- No SOC 2 today, no HIPAA, and ISO 27001 deferred
- No legal entity and no postal address are published, details being available on request only
- No designated DPO and no GDPR Article 27 EU representative, both pushed to a later phase
- Erasure and export are still handled manually through support, and long-term audit-log archival has not shipped
- The terms are a v0.1 pre-launch baseline, and every new workspace needs manual approval before it can send
Pricing & Plans
A permanent free plan is available, covering 3,000 events per month for a single agent with no payment card required. The lowest paid entry point is the Pro plan at USD 20.00 per month, followed by Scale at USD 99.00 per month. A dedicated IP add-on is offered at USD 50.00 per month per IP on Scale and above. A metered tier billed from USD 0.001 per event has been announced but is not yet available.
- 3
- 000 events per month
- 1 agent
- TypeScript SDK and REST
- MCP server
- magic-link signup with no card
- 50
- 000 sends and 50
- 000 inbound replies per month
- 5 agents
- HMAC-signed webhooks and SDK reactor
- injection scanning on every inbound
- email support
- 250
- 000 sends and 500
- 000 inbound replies per month
- unlimited agents on a shared quota and reputation
- per-agent allowlists and budgets
- dedicated IP add-on on request
- priority support
- USD 0.001 per send
- USD 0.002 per inbound and USD 0.003 per opt-in classification
- with no monthly minimum and combinable with the tiers above
- Dedicated IP add-on
- USD 50 per month per IP
- available on Scale and above
- or on Metered with verified domain DNS
Data, GDPR & hosting
A consolidated view of how Mails.ai handles your data.
GDPR overview
The GDPR is addressed concretely rather than in passing, although what is claimed is a GDPR-aligned baseline rather than any certification. Lawful bases are named article by article: contract performance under Art. 6(1)(b), legitimate interest under Art. 6(1)(f) and legal obligation under Art. 6(1)(c). Rights under Art. 15 to 22 are each set out, with a 30-day response, no fee for a first request in any 12-month period, and the right to complain to a supervisory authority. Art. 28 sub-processor disclosure is published in full and a DPA is available on request. Transfers out of the EEA and the UK rely on the Standard Contractual Clauses and the UK IDTA. Two gaps are stated openly: no DPO is designated and no Article 27 EU representative exists, both deferred to a later phase.
Who owns the data?
You keep all rights to the email content you send and receive. The publisher takes only a limited licence to process that content for the purpose of running the service, meaning sending, parsing, classifying and storing your messages against your workspace. Beyond that it grants itself anonymised aggregate use rights alone, such as per-call cost averages and classifier-accuracy statistics, and never over identifiable content. Message data is stored against a workspace_id and is not shared with other customers. The platform itself, its code, its classifiers and its brand, remains the publisher's property.
Reuse rights
Inside the service you may reuse your own message data freely and without asking permission, since you retain the rights to the content. A machine-readable export of messages, events, agents and audit-log rows is provided under the GDPR portability right, announced as self-serve from launch. What is bounded is the publisher's own reuse: processing is confined to delivering the service, and any wider use must be anonymised and aggregated, never identifiable. Inbound message bodies passed to the classification sub-processor are transient and are not retained beyond inference.
Data retention & training
Hosting summary
Hosting is United States centric. The primary database is Neon, a managed Postgres service in the United States, encrypted at rest at the infrastructure layer. Compute, storage and email send and receive run on AWS in the United States, with AWS-managed KMS encryption for the message content held by SES. Model inference for classification and injection scanning is performed by Anthropic in the United States, and the inbound body sent for that purpose is transient, not stored beyond inference. Three vendors sit at the edge rather than in a single country: Vercel for frontend hosting and CDN, Cloudflare for DNS, edge protection and DDoS mitigation, handling request metadata but no message content, and Stripe for billing, described as global with a United States primary. The privacy policy characterises the sub-processor estate as global and US-primary. Transfers from the EEA and the UK rely on the Standard Contractual Clauses and the UK IDTA, with an SCC-aligned addendum supplied on request. TLS 1.3 protects every public surface. No EU data-residency option is offered.
Things to keep in mind
Risks and trade-offs to weigh before adopting Mails.ai.
- Sending is not immediate: every workspace is manually reviewed before it may send its first message
- A legitimate message can still be refused, or routed to a lower-reputation pool, if the classifier reads cold-outreach signals in it
- Auto-suspension fires at a 0.3% complaint rate or a 5% bounce rate, without prior notice when the situation is urgent
- Rotating API keys to dodge those thresholds is explicitly grounds for termination
- Audit-log retention is bounded by database size rather than by policy, since long-term archival has not shipped
- No published legal entity or postal address, English governing law and liability capped at the greater of twelve months of fees or USD 100
- On the free tier a hard cap at 3,000 events stops sending outright, and termination for a policy breach carries no refund of unused subscription time
Setup & Integrations
Technical difficulty
Developer-level, and unambiguously so: integration means writing code or editing an MCP configuration file, so this is not a tool for non-technical users. The publisher claims a working agent in roughly six lines, and each documented integration is timed at four minutes for the MCP servers and five to six minutes for the SDKs. The workspace subdomain requires no DNS work at all. Two things lengthen the path: using your own sending domain means adding DNS records and passing DKIM verification, and every new workspace must clear manual approval before its first send.
Deployment
Integrations
Behind Mails.ai
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Mails.ai.
Frequently asked questions
What does Mails.ai actually do?
Can I use it for cold email or marketing campaigns?
Is there a free plan?
How much do the paid plans cost?
Which agent runtimes does it work with?
How does it handle prompt injection?
Is it certified, and can I get a DPA?
Can I send straight after signing up?
Should you pick Mails.ai?
Mails.ai is a deliberately narrow product, and that narrowness is its strength. It is not an emailing platform with an API bolted on: it is infrastructure for agents that need to read their mail as much as send it, and the design follows from that. Typed reply events, an injection score and a sender reputation value on every inbound, and an acceptable-use rule enforced inside the send call rather than in the fine print, together make a coherent answer to a problem that send-first providers were never shaped for.
The documentation deserves a word of its own. The publisher states what it does not have, which is rare enough to note: no SOC 2, no HIPAA, ISO 27001 deferred, no designated DPO, no Article 27 representative, no customer logos and an admitted pre-launch status. That candour is a genuine signal of seriousness, but it does not cancel what it discloses.
The counterweights are real. Several advertised pieces are announced rather than delivered, the metered tier among them. No legal entity or postal address is published, liability is capped at the greater of twelve months of fees or USD 100, and English law governs. Erasure and export still pass through a human, and audit-log retention is bounded by database size rather than by policy.
For a technical team building a transactional agent, willing to accept the maturity of a young product and reassured by the free tier's low cost of trial, it is a well-argued choice. For anyone whose need is marketing, prospecting or an immediate compliance certification, the answer is a clear no, and the publisher says so first.
- Choosing a selection results in a full page refresh.
- Opens in a new window.