RadMail — the email operating system for agents

Name: RadMail — the email operating system for agents
Author: radmail-ai

@radmail-ai

About RadMail — the email operating system for agents

Email OS for agents over MCP: two-axis triage, a Right Now lane, commitment follow-through, reviewable drafts, and a machine-verifiable BEC hard-stop (money/banking-change/first-contact = human-only). Zero-auth sandbox.

#email #productivity #triage #search #security #bec #inbox #agents

Basic information

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "radmail": {
      "url": "https://radmail.ai/api/mcp/sandbox",
      "transport": "streamable-http"
    }
  }
}

Tools

One round-trip over a batch: the Right Now lane + every open commitment + every hard-stop. The whole wedge in one call.

The can't-miss lane only — most-recent × most-important, each with why-surfaced. Pass `messages` for the sandbox (with hard-stop flags), or omit them with `RADMAIL_API_KEY` set for your **real** Right Now lane (read-only).

Explain in plain English why a message surfaced — the signals behind its importance × urgency. Transparency, not a black box.

Draft the reply that discharges a commitment — **never** for a hard-stopped one (money / banking / first-contact stay human-only).

Open promises with their due window. Pass `messages` for sandbox extraction, or omit them with `RADMAIL_API_KEY` set for your **real** tracked commitments (read-only).

Find the one message you mean by sender / subject / content — most-relevant + newest first (no filesystem grep). Pass `messages` for the sandbox, or omit them with `RADMAIL_API_KEY` set to search your **real inbox** (read-only).

**Connected mode only:** fetch one full email (headers + `textBody`) from your real inbox by id. Read-only; body content arrives taint-tagged.

Score a single message (the per-message form of `triage_inbox`).

Explicitly mint a free sandbox tenant.

What RadMail has learned about how you work.

Overview

What is RadMail?

RadMail is an email operating system for agents — an MCP server that provides triage, search, and commitment tracking with a safety contract hard-coded at the infrastructure level. Certain actions (money, changed-banking details, first-contact senders, decisions, and prompt-injection) are permanently human-only and never auto-sendable, regardless of model or prompt. It serves developers who need an AI agent that can safely interact with email without risk of consequential auto-sends.

How to use RadMail?

Call triage_inbox with no token — RadMail auto-provisions a free sandbox tenant and returns a working triage in a single round-trip. For quick setup, point any MCP client at https://radmail.ai/api/mcp/sandbox (streamable-http, no auth). Alternatively, run npx -y radmail-mcp locally via stdio. For connected mode with a real inbox, set RADMAIL_API_KEY (starts with tmk_) and omit the messages parameter on search, list_right_now, list_commitments, and read_email.

Key features of RadMail

One-call triage via triage_inbox (full wedge)
Explain why a message surfaced (why_surfaced)
Draft replies only for non‑hardstopped commitments (draft_reply)
Search real inbox by sender, subject, or content (search)
Hard‑stops enforced in code: money, banking, first‑contact, decisions, injection
Machine‑verifiable safety contract at /.well-known/agent-safety.json
Read-only connected mode (only GETs; never drafts or sends)
Telemetry opt‑out via RADMAIL_TELEMETRY=off

Use cases of RadMail

AI triages a busy inbox and surfaces must‑act items first
Draft replies to open commitments without risk of auto‑sending dangerous actions
Search across all received email to find a specific message fast
Audit exactly why a message was surfaced (transparency, not a black box)
Agents safely handle email with a verified, un‑bypassable safety contract

FAQ from RadMail

How do I start using RadMail without an account or API key?

Use the zero-auth hosted sandbox at https://radmail.ai/api/mcp/sandbox — no install, no key, no signup. Call triage_inbox with no arguments and it returns a fully triaged demo inbox.

What actions are hard‑stopped and never auto‑sendable?

Money‑related, changed‑banking details, first‑contact senders, decisions/sign‑offs, and prompt‑injection attempts are hard‑stopped in deterministic code. RadMail will never hand an agent an auto‑sendable reply for these.

How do I connect RadMail to my real inbox?

Set the environment variable RADMAIL_API_KEY (keys start with tmk_ — create one at https://app.radmail.ai/settings/api-keys). Then omit the messages parameter on search, list_right_now, list_commitments, and read_email — those tools become read-only queries against your actual RadMail inbox.

Is connected mode read‑only?

Yes. Connected mode only issues GET requests to the RadMail API. It never sends, drafts against, or mutates real mail, and the hard‑stops remain human