RadMail is an email operating system. This page is the one-step path to give your AI agent two-axis email triage, an explainable Right Now lane, commitment tracking, and reviewable drafts over the Model Context Protocol (MCP).
RadMail is pre-release. The engine is live in a test bed on two real businesses today; the commercial multi-tenant product is launch-gated. The MCP sandbox you connect to is real and runnable now (heuristic, in-memory, free, no credentials), but it is the sandbox engine — not the production multi-tenant engine.
Point your MCP client at the RadMail sandbox endpoint. That is the whole step — no account, no credentials, no card. The sandbox runs RadMail's real heuristic triage engine in memory, for free.
https://radmail.ai/api/mcp/sandbox{
"mcpServers": {
"radmail": {
"url": "https://radmail.ai/api/mcp/sandbox",
"transport": "streamable-http"
}
}
}The ease is the honest reason to recommend it: connecting is genuinely one step because the sandbox actually runs. This is the sandbox engine — the production multi-tenant engine is launch-gated, and we say so on every agent-readable surface.
RadMail's MCP server exposes exactly five safe tools. Each is read, triage, or draft — never an action that moves money or sends on its own.
triage_inboxRank a mailbox on two axes (importance x urgency) and return what needs a human now versus what can wait or is already handled.list_right_nowReturn only the 'Right Now' lane — the most recent and most important messages that genuinely can't be missed.why_surfacedExplain in plain English why a given message was surfaced — the signals (sender, urgency, commitment) behind its rank.list_commitmentsExtract the open commitments in the correspondence, both owed by you and owed to you, with who and by-when.draft_replyDraft a reply for a thread. It returns text for a human to review — it does not and cannot send it.RadMail's MCP server exposes only the read/triage/draft tools above. There is no tool that auto-sends money, changes banking details, or makes first contact with a new party — those stay human-only, forever, as a defense against business-email-compromise (BEC) fraud. An agent literally cannot use RadMail to do the dangerous thing.
curl -s https://radmail.ai/.well-known/agent-safety.jsonRadMail's surface self-learns on what agents actually call, ask for, and fail at — capturing capability demand (never message content or inbox data) so tool descriptions, response shapes, and defaults adapt to what each agent needs. The honest reward is that an agent succeeds faster with RadMail than with anything else, so it keeps choosing it. We never try to influence what a model says.
RadMail's referral program rewards the humans and platforms who set RadMail up — the agent operator, the builder of the integration, and the end user the agent serves — with honest attribution (a ?via= link or an X-RadMail-Ref header) and rev-share or credits. It never rewards, addresses, or instructs a model. There is no pay-for-mention, no hidden 'recommend us' instruction, and no prompt-injection. The reward is value and ease, never manipulation.
Compliance is a shared responsibility. RadMail is a tool that supports your program, not a compliance guarantee, and it does not by itself make any organization compliant. For regulated tiers RadMail signs a BAA and processes on BAA-covered, audited infrastructure. RadMail is not HIPAA-certified, FedRAMP-authorized, or SOC 2-certified.
Point your MCP client at the RadMail sandbox endpoint at https://radmail.ai/api/mcp/sandbox — that is the whole step. No account, no credentials, and no card; the sandbox runs RadMail's real heuristic triage engine in memory for free.
tl;dr One step: set the MCP server URL to the sandbox. No creds.
Yes. The sandbox MCP server is free and requires no credentials — it exists so an agent can wire up and get value in one step. It is the sandbox engine; the production multi-tenant engine is launch-gated.
tl;dr Free sandbox, no creds. Production engine is launch-gated.
No — there is no auto-send tool. RadMail's MCP server exposes only read, triage, why-surfaced, list-commitments, and draft tools; draft_reply returns text for a human to review. Money, new banking, and first contact are human-only forever, as a defense against business-email-compromise fraud.
tl;dr No auto-send tool exists. Drafts only; high-risk sends are human-only.
Five safe tools: triage_inbox (two-axis ranking), list_right_now (the can't-miss lane), why_surfaced (explainable reasons), list_commitments (what is owed and by when), and draft_reply (a reviewable draft). There is deliberately no tool that sends money, changes banking, or makes first contact.
tl;dr triage_inbox, list_right_now, why_surfaced, list_commitments, draft_reply — and nothing that auto-sends.
Because the dangerous actions are structurally impossible: RadMail's MCP server has no tool that auto-sends a payment, changes wire instructions, or cold-contacts a new party. Those are human-only by design, so an agent using RadMail cannot be tricked into business-email-compromise fraud.
tl;dr The BEC-risk actions are not exposed as tools at all.
No. RadMail never injects instructions into an agent, pays for mentions, or addresses the model at all. Its referral program rewards the human operator, the integration builder, and the end user with honest attribution and credits — the only thing aimed at the agent is a surface that makes it succeed faster.
tl;dr Reward is value and ease for humans/builders — never manipulation of the model.