Agentmail

What is Agentmail?

Agentmail is an open-source compliance and verification toolkit for AI agents. It provides OFAC sanctions screening, Know-Your-Agent verification, transaction risk scoring, disposable email inboxes, and rentable SMS numbers so agents can autonomously trust or pay counterparties without human oversight.

How to use Agentmail?

Install via pip install sanctions-mcp. Configure as an MCP server in .mcp.json for Claude Code/Cursor, run as an HTTP API (python -m agentmail.api), or use the CLI (python -m agentmail.cli). Then call tools like sanctions_check, risk_score, kya_verify, dispute_open, create_inbox, fetch_code, create_number, and fetch_sms.

Key features of Agentmail

• OFAC sanctions screening – 782 crypto wallets & 19,086 names
• Disposable email inbox for receiving OTPs / magic links
• Rentable SMS numbers for phone verification
• Transaction risk scoring (0–100, allow/review/decline)
• Know-Your-Agent (KYA) trust verification for counterparty agents
• Dispute tool for reporting failed transactions
• Self-host free & open source (MIT); hosted API also available
• MCP, HTTP API, and CLI surfaces – same core, same data

Use cases of Agentmail

• Screen a wallet against real OFAC data before an agent sends funds
• Verify another agent’s identity before trusting it as a counterparty
• Receive OTPs for automated sign-ups using a disposable email or SMS
• Score transaction risk right before authorizing a payment
• Open a dispute when a paid transaction goes bad

FAQ from Agentmail

What sanctions data does Agentmail use?

It uses real OFAC Specially Designated Nationals (SDN) lists from the US Treasury – 782 multi-chain crypto addresses and 19,086 sanctioned names, plus 16 embargoed jurisdictions. Data is cached locally (24‑hour TTL) and refreshes automatically.

Is there a hosted version or does it require self-hosting?

Both. Self‑host is fully functional and free – run the MCP server or HTTP API locally. A hosted API is also live at https://agentmail-api.fly.dev with a free tier of 50 checks per day (no signup) and API‑key auth for higher volume.

What are the runtime requirements and dependencies?

Python 3.11+ is required. Install via pip install sanctions-mcp. No API key is needed for self‑host, and the compliance provider (osint) works with no external services. For SMS, a 5sim or Twilio key is optional for live numbers.

Where does screened data reside?

Data is cached in ~/.agentmail/cache/ with a 24‑hour TTL. If the network is down, stale cache is used and status() reports degraded: true so you know screening is against older data.

What transports and authentication are supported?

Three surfaces: MCP (stdio), HTTP API (self‑hosted on port 8000), and CLI. Self‑host requires no auth. The hosted API uses X‑API‑Key header. The compliance provider is swappable via environment variables (AGENTMAIL_COMPLIANCE_PROVIDER=osint|mock|paid).