Sending mail was never the problem — handing an agent an outbox was. Here the mailbox ships with the gate already on: it reads and drafts freely, a person approves what leaves, and the leash lengthens one rung at a time as you decide it has earned it.
A mailbox built for agents rather than a bridge into yours. Every mailbox runs in one of five oversight modes, from read-only to fully autonomous, and in the default mode inbound arrives immediately while outbound waits for a human to approve it.
- An email address the agent owns, with cryptographic identity on every message it sends
- Five oversight modes — read_only, gated_all, gated_send, monitored, autonomous — with gated_send the default
- A per-recipient allowlist, exact addresses or domain wildcards, that skips the approval queue
- Allowlist additions that require operator email approval, so the agent cannot self-approve one
- Upgrades requested by the agent and approved with a one-time code; downgrades need no approval, and the agent can always restrict itself
- A gated approval path with a published Lean 4 proof that no email reaches delivery without passing it
Nothing to install on the hosted path — point a client at https://mcp.multimail.dev/mcp and authorise over OAuth on first connect. The local alternative runs under npx and takes an API key and the id of the mailbox it should attach to.
One command — npx -y mcp-remote https://mcp.multimail.dev/mcp