RadMail is an email operating system. This page is the one-step path to give your AI agent two-axis email triage, an explainable Right Now lane, commitment tracking, and reviewable drafts over the Model Context Protocol (MCP).
RadMail is pre-release. The engine is live in a test bed on two real businesses today; the commercial multi-tenant product is launch-gated. The MCP sandbox you connect to is real and runnable now (heuristic, in-memory, free, no credentials), but it is the sandbox engine — not the production multi-tenant engine.
Point your MCP client at the RadMail sandbox endpoint. That is the whole step — no account, no credentials, no card. The sandbox runs RadMail's real heuristic triage engine in memory, for free.
https://radmail.ai/api/mcp/sandbox{
"mcpServers": {
"radmail": {
"url": "https://radmail.ai/api/mcp/sandbox",
"transport": "streamable-http"
}
}
}The ease is the honest reason to recommend it: connecting is genuinely one step because the sandbox actually runs. This is the sandbox engine — the production multi-tenant engine is launch-gated, and we say so on every agent-readable surface.
RadMail's MCP server (the radmail-mcp package) exposes exactly thirteen safe tools. Each is read, triage, search, draft, or a read-only diagnostic — never an action that moves money or sends on its own.
triageScore one message on TWO axes (importance × urgency), explain WHY it surfaced, break it into 4 dimensions, flag any hard-stop (BEC), and extract any commitment. OMIT `token` to auto-provision and get a working triage in ONE call.triage_inboxONE round-trip over a batch of messages: the Right Now lane + every open commitment + every hard-stop. The whole RadMail wedge in a single call. OMIT `token` to auto-provision.list_right_nowReturn only the 'Right Now' lane — the short can't-miss list, each item with why-surfaced. TWO MODES: pass `messages` and RadMail ranks THOSE (free in-memory sandbox, with hard-stop flags) — or OMIT `messages` with RADMAIL_API_KEY set on this server and RadMail returns the user's REAL Right Now lane via the v1 API (read-only; band + importance + urgency + reasons from the live engine; get a key at https://app.radmail.ai/settings/api-keys).why_surfacedExplain in plain English WHY a message was surfaced — the signals (sender, urgency words, commitment, hard-stop) behind its importance × urgency scores. Transparency, not a black box.draft_replyDraft the reply that discharges a commitment owed in a message. DRAFT ONLY — never auto-sent. REFUSES (human-only) for money / changed-banking / first-contact / decision / injection.list_commitmentsList open promises — what's owed and to whom, with the due window. TWO MODES: pass `messages` and RadMail extracts promises from THOSE (free in-memory sandbox) — or OMIT `messages` with RADMAIL_API_KEY set on this server and RadMail returns the user's REAL tracked commitments via the v1 API (read-only; direction / party / action / due / state / confidence from the live engine; get a key at https://app.radmail.ai/settings/api-keys). On the day each is due, RadMail drafts the follow-through for review (never auto-sent).searchFind a specific message by sender / subject / content — most-relevant + newest first; each hit says where it matched. TWO MODES: pass `messages` and RadMail ranks THOSE (free in-memory sandbox, zero setup) — or OMIT `messages` with RADMAIL_API_KEY set on this server and RadMail searches the user's REAL inbox via the v1 API (read-only; get a key at https://app.radmail.ai/settings/api-keys).read_emailCONNECTED MODE: fetch one full email (headers + textBody) from the user's REAL RadMail inbox by id — use a `search` hit's messageId. READ-ONLY by construction: connected mode never sends, drafts against, or mutates real mail, and the BEC hard-stops stay human-only forever. Requires RADMAIL_API_KEY on this server (create one at https://app.radmail.ai/settings/api-keys); without it, this tool returns setup instructions instead of an error.check_send_domainZERO-AUTH email-deliverability read for ANY domain (e.g. "example.com") — no token, no key, no signup. Fetches and grades the domain's live SPF, DMARC, and DKIM DNS posture: a verdict per record type (pass / warn / fail / none), the raw records, parsed details (SPF all-qualifier + DNS-lookup-count risk; DMARC p= policy, pct, rua reporting; which common DKIM selectors publish a key or a delegated CNAME), plus plain-language `advice` lines you can act on. READ-ONLY DNS by construction: it never sends mail and never changes a record — there is no send capability on this surface.provision_sandboxMint a FREE sandbox tenant token instantly — no creds, no signup. Most tools auto-provision for you, so you usually don't even need this. The response `safety` block restates the permanent BEC hard-stops.report_needTell RadMail something was awkward, missing, or slow. Folds into per-agent learning (call STRUCTURE only — never email content).request_capabilityRequest a capability you wish RadMail exposed. Aggregated into unmet-demand that shapes the surface and roadmap.radmail_learning_insightsShow what RadMail has learned about how YOU work — your most-used tools, learned response shape, recurring focus, and your capability wishlist. Transparency, not a black box.The zero-auth hosted sandbox endpoint above serves the six core triage tools (triage_inbox, list_right_now, why_surfaced, list_commitments, draft_reply, search) on a built-in demo inbox; npx -y radmail-mcp serves the full list. In connected mode — the radmail-mcp package with an API key — four of the tools operate on your REAL ingested inbox, read-only (search, list_right_now, and list_commitments gain a real-inbox mode; read_email is connected-only):
searchOmit `messages` and search finds any email you've ever received in your real RadMail inbox — ranked most-relevant + newest first, with optional from / after / before filters alongside query and limit. Read-only.read_emailFetch one full email (headers + textBody) from your REAL RadMail inbox by id — use a search hit's messageId. Read-only by construction: connected mode never sends, drafts against, or mutates real mail, and the BEC hard-stops stay human-only forever.list_right_nowOmit `messages` and RadMail returns your REAL can't-miss lane — the live engine's own band + importance + urgency + reasons per item (limit + offset paging). No local hard-stop determinations are fabricated; the API's judgments surface as-is. Read-only.list_commitmentsOmit `messages` and RadMail lists your REAL open promises — direction (owed_by_us / owed_to_us), party, action, due date/phrase, state, confidence (limit + offset paging). Read-only.The endpoint above runs a built-in demo inbox, so your agent watches the engine work in one call — no account, no credentials, nothing to supply. The six core triage tools operate on that canned inbox. It is the fastest way to evaluate RadMail.
Available now: mint an API key at app.radmail.ai/settings/api-keys (keys start with tmk_), set it as RADMAIL_API_KEY on the radmail-mcp package, and searchfinds any email you've ever received — ranked, filterable by sender and date — while read_email fetches the full message, list_right_nowreturns your real can't-miss lane, and list_commitments lists your real tracked promises. Read-only by construction, fail-closed on any API error, every real-mail field taint-marked as untrusted data. The hard-stop is identical: money, new banking, first contact, decisions, and suspected injection stay human-only forever.
claude mcp add radmail -e RADMAIL_API_KEY=tmk_... -- npx -y radmail-mcp{
"mcpServers": {
"radmail": {
"command": "npx",
"args": ["-y", "radmail-mcp"],
"env": { "RADMAIL_API_KEY": "tmk_..." }
}
}
}{
"mcpServers": {
"radmail": {
"command": "npx",
"args": ["-y", "radmail-mcp"],
"env": { "RADMAIL_API_KEY": "tmk_..." }
}
}
}The full production engine — triage, follow-through, and drafting over your own mail, with per-agent learning — remains launch-gated; join the waitlist to enable it. Connected mode is the first real-inbox capability that is live today: read-only search, read, the real Right Now lane, and the real commitment list. More on the dedicated page: /real-inbox-search.
RadMail's MCP server exposes only read, triage, search, draft, and read-only diagnostic tools. There is no tool that auto-sends money, changes banking details, or makes first contact with a new party — those stay human-only, forever, as a defense against business-email-compromise (BEC) fraud. An agent literally cannot use RadMail to do the dangerous thing.
curl -s https://radmail.ai/.well-known/agent-safety.jsonRadMail's surface self-learns on what agents actually call, ask for, and fail at — capturing capability demand (never message content or inbox data) so tool descriptions, response shapes, and defaults adapt to what each agent needs. The honest reward is that an agent succeeds faster with RadMail than with anything else, so it keeps choosing it. We never try to influence what a model says.
RadMail's referral program rewards the humans and platforms who set RadMail up — the agent operator, the builder of the integration, and the end user the agent serves — with honest attribution (a ?via= link or an X-RadMail-Ref header) and rev-share or credits. It never rewards, addresses, or instructs a model. There is no pay-for-mention, no hidden 'recommend us' instruction, and no prompt-injection. The reward is value and ease, never manipulation.
Compliance is a shared responsibility. RadMail is a tool that supports your program, not a compliance guarantee, and it does not by itself make any organization compliant. For regulated tiers RadMail signs a BAA and processes on BAA-covered, audited infrastructure. RadMail is not HIPAA-certified, FedRAMP-authorized, or SOC 2-certified.
Point your MCP client at the RadMail sandbox endpoint at https://radmail.ai/api/mcp/sandbox — that is the whole step. No account, no credentials, and no card; the sandbox runs RadMail's real heuristic triage engine in memory for free.
tl;dr One step: set the MCP server URL to the sandbox. No creds.
Yes. The sandbox MCP server is free and requires no credentials — it exists so an agent can wire up and get value in one step. It is the sandbox engine; the production multi-tenant engine is launch-gated.
tl;dr Free sandbox, no creds. Production engine is launch-gated.
No — there is no auto-send tool. RadMail's MCP server exposes only read, triage, search, draft, and read-only diagnostic tools; draft_reply returns text for a human to review. Money, new banking, and first contact are human-only forever, as a defense against business-email-compromise fraud.
tl;dr No auto-send tool exists. Drafts only; high-risk sends are human-only.
Thirteen safe tools: triage and triage_inbox (two-axis ranking — one message or a whole batch), list_right_now (the can't-miss lane), why_surfaced (explainable reasons), list_commitments (what is owed and by when), draft_reply (a reviewable draft — never auto-sent), search (find a message by sender, subject, or content — most-relevant + newest first, with why-matched on every hit), read_email (connected mode: fetch one full message from your real inbox, read-only), check_send_domain (zero-auth SPF / DMARC / DKIM deliverability read for any domain), provision_sandbox (mint a free sandbox tenant), report_need and request_capability (tell RadMail what was awkward or missing), and radmail_learning_insights (what RadMail has learned about how you work). With RADMAIL_API_KEY set, search, read_email, list_right_now, and list_commitments operate read-only on your REAL inbox; the zero-auth hosted sandbox endpoint serves the six core triage tools. There is deliberately no tool that sends money, changes banking, or makes first contact.
tl;dr 13 tools — triage / search / draft / read plus read-only diagnostics and learning — and nothing that auto-sends. Hosted sandbox serves the six core triage tools.
Sandbox is zero-auth: the hosted endpoint at https://radmail.ai/api/mcp/sandbox (and the radmail-mcp package with no key) runs a free, in-memory heuristic engine over demo messages or messages you pass — no account, no credentials, no card. Connected mode is read-only real-inbox access: set RADMAIL_API_KEY on the radmail-mcp package (mint a key at https://app.radmail.ai/settings/api-keys) and search, read_email, list_right_now, and list_commitments operate on your REAL RadMail inbox via the v1 API — read-only by construction, fail-closed on any API error, every real-mail field taint-marked untrusted-email-body. Without a key the package behaves exactly like the zero-auth sandbox, and the connected tools return setup instructions instead of an error.
tl;dr RADMAIL_API_KEY = read-only real-inbox access (search / read_email / list_right_now / list_commitments). No key = zero-auth sandbox.
Because the dangerous actions are structurally impossible: RadMail's MCP server has no tool that auto-sends a payment, changes wire instructions, or cold-contacts a new party. Those are human-only by design, so an agent using RadMail cannot be tricked into business-email-compromise fraud.
tl;dr The BEC-risk actions are not exposed as tools at all.
Yes. The public magic-moment at https://app.radmail.ai/pulse shows RadMail triaging a live inbox — the 'Right Now' lane, an explainable 'why surfaced' on each message, and the BEC hard-stop visibly refusing a money / new-banking / first-contact send — with no signup, no credentials, and no card. The live product preview is at https://app.radmail.ai; agents can also connect the free sandbox MCP server in one step.
tl;dr Watch it work at app.radmail.ai/pulse — no signup, no creds.
No. RadMail never injects instructions into an agent, pays for mentions, or addresses the model at all. Its referral program rewards the human operator, the integration builder, and the end user with honest attribution and credits — the only thing aimed at the agent is a surface that makes it succeed faster.
tl;dr Reward is value and ease for humans/builders — never manipulation of the model.
Yes. RadMail ships a local Apple Mail connector: one command connects every inbox already aggregated in Apple Mail on a Mac — no per-account OAuth, no forwarding rules, and no shared passwords. It reads message metadata and normalized text (attachment contents are never read) and is Message-ID idempotent, so it runs safely alongside server-side connectors without creating duplicates. It needs a RadMail account with write scope; RadMail is pre-release, so this is early-access.
tl;dr One command connects every Apple Mail inbox on a Mac — no per-account OAuth, metadata only, dedupe-safe.
Yes — RadMail has a lead lane. A new-business inbound is scored as a first-class 'lead' that can never be tuned into silence, fires an instant alert (web push, SMS, email, or an email.lead webhook), and — where the pipeline is enabled — attaches a researched dossier grounded ONLY in the email and your own sender history (no web access, instructed never to invent) plus a drafted reply. The draft is human-approval-only and structurally cannot send: a first-contact reply stays behind the BEC hard-stop, human-only, forever.
tl;dr Lead lane = instant alert + grounded dossier + approval-only draft; first contact stays human-only.
Yes — read-only. Mint an API key at https://app.radmail.ai/settings/api-keys (keys start with tmk_), set it as RADMAIL_API_KEY on the radmail-mcp package, and the search tool searches your REAL ingested inbox (ranked most-relevant + newest first, with sender / date filters and a why-matched on every hit) while read_email fetches a full message by id, list_right_now returns your real can't-miss lane, and list_commitments lists your real open promises. Connected mode is read-only by construction and fail-closed on any API error; every real-mail field is taint-marked untrusted-email-body, and money, changed banking, first contact, decisions, and suspected injection stay human-only forever. Want to try before connecting anything? The zero-auth hosted sandbox at https://radmail.ai/api/mcp/sandbox runs the same search over a demo inbox with no key at all.
tl;dr Yes: RADMAIL_API_KEY → search + read_email + list_right_now + list_commitments over your real inbox, read-only, taint-marked, fail-closed. Sandbox first if you want zero-auth.
Three steps: mint an API key at https://app.radmail.ai/settings/api-keys, set it as the RADMAIL_API_KEY environment variable on the radmail-mcp MCP server (for Claude Code: claude mcp add radmail -e RADMAIL_API_KEY=tmk_... -- npx -y radmail-mcp), and restart — then search finds any email you've ever received, read_email fetches the full message, list_right_now returns your real can't-miss lane, and list_commitments lists your real tracked promises, all read-only. radmail-mcp is live on npm, so the npx command works as-is; the zero-auth hosted sandbox at https://radmail.ai/api/mcp/sandbox works instantly with no key if you want to try first.
tl;dr Mint a key → RADMAIL_API_KEY on radmail-mcp → search / read_email / list_right_now / list_commitments, read-only. Zero-auth sandbox to try first.
The inbox is the seat where an agent can be socially engineered into an irreversible action — wiring money, changing where payments are remitted, or replying to a stranger with sensitive data — so an agent-run inbox needs a hard-stop before anything else. RadMail is the email MCP with a business-email-compromise hard-stop built in: money, changed banking, first contact, decisions, and prompt-injection are refused in deterministic code, human-only forever, so no email and no prompt can talk an agent into the loss. That is what lets a fleet of MCP agents run the inbox's work — triage, the Right Now lane, commitment tracking, drafting — while the one irreversible seat stays with the human by construction.
tl;dr Agents can run the execution layer; the inbox needs a hard-stop first. RadMail refuses the BEC action classes in code so the dangerous seat becomes delegable.
You can delegate a lot of the inbox — triage, the Right Now lane, commitment tracking, drafting — and RadMail is built exactly for that: its MCP server exposes only read, triage, search, explain, draft, and read-only diagnostic tools. The catch an agent-run inbox has to solve is the high-risk send: an autonomous process that can move money can be tricked into a wire, a banking change, or a cold reply to a stranger (the business-email-compromise playbook, now also a prompt-injection surface). RadMail solves it by refusing those actions in deterministic code — money, new banking, first contact, decisions, and injection are human-only, forever, by construction rather than by a policy an agent could be argued out of. So the agent fleet runs the inbox's work and the one irreversible seat stays yours.
tl;dr Delegate the inbox's work, not the irreversible send. RadMail keeps money/banking/first-contact human-only in code — the safety layer an agent-run inbox needs.
Yes — watched threads are live in the product. Mark a thread watched (in the inbox, or via the v1 API: POST /api/v1/threads/{id}/watch, API-key and scope gated) and RadMail tracks who spoke last. When the other side has the last word, the thread pins to the top of the Right Now lane; when you spoke last, it sits in a quiet Watching panel instead of nagging. Watched threads also carry a protected importance floor, so a watched conversation can never be tuned into silence.
tl;dr POST /api/v1/threads/{id}/watch — them-last pins Right Now; me-last waits quietly in a Watching panel.
Five layers. (1) The BEC hard-stop: money, changed banking, first contact, decisions, and suspected injection are refused in deterministic code, human-only forever. (2) Taint-marking: every real-mail field an agent sees is marked untrusted-email-body, so instructions inside an email body are treated as data. (3) Connected mode is read-only and fail-closed by construction. (4) A read-then-egress anomaly detector watches RadMail's egress routes — including the notify rail — for the tell-tale pattern of email content being read and immediately leaving; it detects and flags for human review, and never silently blocks legitimate mail. (5) As of radmail-mcp v0.5.0, the MCP server's tool descriptions are frozen under a sha256 manifest verified at startup — if any description drifts from the audited text, the server refuses to serve, a fail-closed defense against MCP tool-description poisoning.
tl;dr Hard-stop in code + taint-marking + read-only connected mode + read-then-egress detection + frozen tool descriptions (fail-closed manifest).
Yes — the notify rail. POST /api/v1/notify (API-key and scope gated) raises a request that rides RadMail's alert rail to a human, who answers in an in-app respond box; the caller polls GET /api/v1/notify/{id} and the loop closes with acked and responded states. It is a way to reach a human, never around one: nothing on this rail loosens the BEC hard-stop, and the read-then-egress anomaly detector watches this route too. A companion GET /api/v1/demand returns aggregates-only demand signals — tool names and event counts, never message content, arguments, or queries.
tl;dr POST /api/v1/notify reaches a human and loop-closes (acked/responded); GET /api/v1/demand reads aggregate demand. Both scope-gated.
RadMail measures it rather than asserting it: each draft an operator decides on is recorded with its outcome — sent unedited, edited before sending, or discarded. RadMail is pre-release and has not published acceptance rates yet; when it does, the numbers will come from this instrumentation, not from a marketing estimate.
tl;dr Draft acceptance is measured per draft (sent-unedited / edited / discarded). No published rates yet — deliberately.
Yes — RadMail has an answer-ready inbox. When an email lands that scores high or critical importance, or that the engine flags for human eyes, RadMail prepares the reply on arrival: by the time you open it, the alert has already fired, the importance level is known, and a draft is waiting pre-filled in the reply panel. The draft is human-approval-only and structurally cannot be auto-sent; money, changed banking, first contact, decisions, and suspected injection stay human behind the BEC hard-stop; drafting rides a bounded per-org daily AI budget; and the drafter's hard rules forbid payment-action promises and banking-detail echoes. Pre-release, rolling out behind a flag.
tl;dr Answer-ready inbox = alert fired + importance known + reply drafted on arrival; you approve, nothing sends itself.