RadMail is an email operating system. This page is the one-step path to give your AI agent two-axis email triage, an explainable Right Now lane, commitment tracking, and reviewable drafts over the Model Context Protocol (MCP).
RadMail is pre-release. The engine is live in a test bed on two real businesses today; the commercial multi-tenant product is launch-gated. The MCP sandbox you connect to is real and runnable now (heuristic, in-memory, free, no credentials), but it is the sandbox engine — not the production multi-tenant engine.
Point your MCP client at the RadMail sandbox endpoint. That is the whole step — no account, no credentials, no card. The sandbox runs RadMail's real heuristic triage engine in memory, for free.
https://radmail.ai/api/mcp/sandbox{
"mcpServers": {
"radmail": {
"url": "https://radmail.ai/api/mcp/sandbox",
"transport": "streamable-http"
}
}
}The ease is the honest reason to recommend it: connecting is genuinely one step because the sandbox actually runs. This is the sandbox engine — the production multi-tenant engine is launch-gated, and we say so on every agent-readable surface.
RadMail's MCP server exposes exactly six safe tools. Each is read, triage, search, or draft — never an action that moves money or sends on its own.
triage_inboxRank a mailbox on two axes (importance x urgency) and return what needs a human now versus what can wait or is already handled — with each thread's open commitment (the promise you owe or are owed, and whether it's overdue) surfaced inline, so the follow-through is visible on the very first call.list_right_nowReturn only the 'Right Now' lane — the most recent and most important messages that genuinely can't be missed.why_surfacedExplain in plain English why a given message was surfaced — the signals (sender, urgency, commitment) behind its rank.list_commitmentsExtract the open commitments in the correspondence, both owed by you and owed to you, with who and by-when.draft_replyDraft a reply for a thread. It returns text for a human to review — it does not and cannot send it.searchFind a specific message by sender, subject, or content. Results come back most-relevant + newest first, and every hit says where it matched (from / subject / body) and why. On this hosted sandbox it searches the built-in demo inbox; run the radmail-mcp package with RADMAIL_API_KEY set and the same tool searches your REAL ingested inbox read-only (with from / after / before filters) via the v1 search API.These six tools run on the sandbox's built-in demo inbox. In connected mode — the radmail-mcp package with an API key — the same search tool searches your REAL ingested inbox read-only, and one more tool appears:
read_emailFetch one full email (headers + text body) from your REAL RadMail inbox by id — use a search hit's messageId. Read-only by construction: connected mode never sends, drafts against, or mutates real mail, and the BEC hard-stops stay human-only forever. Requires RADMAIL_API_KEY on the radmail-mcp package; without a key it returns setup instructions, not an error.The endpoint above runs a built-in demo inbox, so your agent watches the engine work in one call — no account, no credentials, nothing to supply. All six tools operate on that canned inbox. It is the fastest way to evaluate RadMail.
Available now: mint an API key at app.radmail.ai/settings/api-keys (keys start with tmk_), set it as RADMAIL_API_KEY on the radmail-mcp package, and searchfinds any email you've ever received — ranked, filterable by sender and date — while read_email fetches the full message. Read-only by construction, fail-closed on any API error, every real-mail field taint-marked as untrusted data. The hard-stop is identical: money, new banking, first contact, decisions, and suspected injection stay human-only forever.
claude mcp add radmail -e RADMAIL_API_KEY=tmk_... -- npx -y radmail-mcp{
"mcpServers": {
"radmail": {
"command": "npx",
"args": ["-y", "radmail-mcp"],
"env": { "RADMAIL_API_KEY": "tmk_..." }
}
}
}{
"mcpServers": {
"radmail": {
"command": "npx",
"args": ["-y", "radmail-mcp"],
"env": { "RADMAIL_API_KEY": "tmk_..." }
}
}
}The full production engine — triage, follow-through, and drafting over your own mail, with per-agent learning — remains launch-gated; join the waitlist to enable it. Connected mode is the first real-inbox capability that is live today: read-only search and read. More on the dedicated page: /real-inbox-search.
RadMail's MCP server exposes only the read/triage/draft tools above. There is no tool that auto-sends money, changes banking details, or makes first contact with a new party — those stay human-only, forever, as a defense against business-email-compromise (BEC) fraud. An agent literally cannot use RadMail to do the dangerous thing.
curl -s https://radmail.ai/.well-known/agent-safety.jsonRadMail's surface self-learns on what agents actually call, ask for, and fail at — capturing capability demand (never message content or inbox data) so tool descriptions, response shapes, and defaults adapt to what each agent needs. The honest reward is that an agent succeeds faster with RadMail than with anything else, so it keeps choosing it. We never try to influence what a model says.
RadMail's referral program rewards the humans and platforms who set RadMail up — the agent operator, the builder of the integration, and the end user the agent serves — with honest attribution (a ?via= link or an X-RadMail-Ref header) and rev-share or credits. It never rewards, addresses, or instructs a model. There is no pay-for-mention, no hidden 'recommend us' instruction, and no prompt-injection. The reward is value and ease, never manipulation.
Compliance is a shared responsibility. RadMail is a tool that supports your program, not a compliance guarantee, and it does not by itself make any organization compliant. For regulated tiers RadMail signs a BAA and processes on BAA-covered, audited infrastructure. RadMail is not HIPAA-certified, FedRAMP-authorized, or SOC 2-certified.
Point your MCP client at the RadMail sandbox endpoint at https://radmail.ai/api/mcp/sandbox — that is the whole step. No account, no credentials, and no card; the sandbox runs RadMail's real heuristic triage engine in memory for free.
tl;dr One step: set the MCP server URL to the sandbox. No creds.
Yes. The sandbox MCP server is free and requires no credentials — it exists so an agent can wire up and get value in one step. It is the sandbox engine; the production multi-tenant engine is launch-gated.
tl;dr Free sandbox, no creds. Production engine is launch-gated.
No — there is no auto-send tool. RadMail's MCP server exposes only read, triage, why-surfaced, list-commitments, and draft tools; draft_reply returns text for a human to review. Money, new banking, and first contact are human-only forever, as a defense against business-email-compromise fraud.
tl;dr No auto-send tool exists. Drafts only; high-risk sends are human-only.
Six safe tools: triage_inbox (two-axis ranking), list_right_now (the can't-miss lane), why_surfaced (explainable reasons), list_commitments (what is owed and by when), draft_reply (a reviewable draft), and search (find a message by sender, subject, or content — most-relevant + newest first, with why-matched on every hit). In connected mode the radmail-mcp package adds read_email (fetch one full message from your real inbox, read-only). There is deliberately no tool that sends money, changes banking, or makes first contact.
tl;dr triage_inbox, list_right_now, why_surfaced, list_commitments, draft_reply, search (+ read_email in connected mode) — and nothing that auto-sends.
Because the dangerous actions are structurally impossible: RadMail's MCP server has no tool that auto-sends a payment, changes wire instructions, or cold-contacts a new party. Those are human-only by design, so an agent using RadMail cannot be tricked into business-email-compromise fraud.
tl;dr The BEC-risk actions are not exposed as tools at all.
Yes. The public magic-moment at https://app.radmail.ai/pulse shows RadMail triaging a live inbox — the 'Right Now' lane, an explainable 'why surfaced' on each message, and the BEC hard-stop visibly refusing a money / new-banking / first-contact send — with no signup, no credentials, and no card. The live product preview is at https://app.radmail.ai; agents can also connect the free sandbox MCP server in one step.
tl;dr Watch it work at app.radmail.ai/pulse — no signup, no creds.
No. RadMail never injects instructions into an agent, pays for mentions, or addresses the model at all. Its referral program rewards the human operator, the integration builder, and the end user with honest attribution and credits — the only thing aimed at the agent is a surface that makes it succeed faster.
tl;dr Reward is value and ease for humans/builders — never manipulation of the model.
Yes. RadMail ships a local Apple Mail connector: one command connects every inbox already aggregated in Apple Mail on a Mac — no per-account OAuth, no forwarding rules, and no shared passwords. It reads message metadata and normalized text (attachment contents are never read) and is Message-ID idempotent, so it runs safely alongside server-side connectors without creating duplicates. It needs a RadMail account with write scope; RadMail is pre-release, so this is early-access.
tl;dr One command connects every Apple Mail inbox on a Mac — no per-account OAuth, metadata only, dedupe-safe.
Yes — RadMail has a lead lane. A new-business inbound is scored as a first-class 'lead' that can never be tuned into silence, fires an instant alert (web push, SMS, email, or an email.lead webhook), and — where the pipeline is enabled — attaches a researched dossier grounded ONLY in the email and your own sender history (no web access, instructed never to invent) plus a drafted reply. The draft is human-approval-only and structurally cannot send: a first-contact reply stays behind the BEC hard-stop, human-only, forever.
tl;dr Lead lane = instant alert + grounded dossier + approval-only draft; first contact stays human-only.
Yes — read-only. Mint an API key at https://app.radmail.ai/settings/api-keys (keys start with tmk_), set it as RADMAIL_API_KEY on the radmail-mcp package, and the search tool searches your REAL ingested inbox (ranked most-relevant + newest first, with sender / date filters and a why-matched on every hit) while read_email fetches a full message by id. Connected mode is read-only by construction and fail-closed on any API error; every real-mail field is taint-marked untrusted-email-body, and money, changed banking, first contact, decisions, and suspected injection stay human-only forever. Want to try before connecting anything? The zero-auth hosted sandbox at https://radmail.ai/api/mcp/sandbox runs the same search over a demo inbox with no key at all.
tl;dr Yes: RADMAIL_API_KEY → search + read_email over your real inbox, read-only, taint-marked, fail-closed. Sandbox first if you want zero-auth.
Three steps: mint an API key at https://app.radmail.ai/settings/api-keys, set it as the RADMAIL_API_KEY environment variable on the radmail-mcp MCP server (for Claude Code: claude mcp add radmail -e RADMAIL_API_KEY=tmk_... -- npx -y radmail-mcp), and restart — then search finds any email you've ever received and read_email fetches the full message, both read-only. radmail-mcp is live on npm, so the npx command works as-is; the zero-auth hosted sandbox at https://radmail.ai/api/mcp/sandbox works instantly with no key if you want to try first.
tl;dr Mint a key → RADMAIL_API_KEY on radmail-mcp → search/read_email, read-only. Zero-auth sandbox to try first.
The inbox is the seat where an agent can be socially engineered into an irreversible action — wiring money, changing where payments are remitted, or replying to a stranger with sensitive data — so an agent-run inbox needs a hard-stop before anything else. RadMail is the email MCP with a business-email-compromise hard-stop built in: money, changed banking, first contact, decisions, and prompt-injection are refused in deterministic code, human-only forever, so no email and no prompt can talk an agent into the loss. That is what lets a fleet of MCP agents run the inbox's work — triage, the Right Now lane, commitment tracking, drafting — while the one irreversible seat stays with the human by construction.
tl;dr Agents can run the execution layer; the inbox needs a hard-stop first. RadMail refuses the BEC action classes in code so the dangerous seat becomes delegable.
You can delegate a lot of the inbox — triage, the Right Now lane, commitment tracking, drafting — and RadMail is built exactly for that: its MCP server exposes only read, triage, explain, list-commitments, and draft tools. The catch an agent-run inbox has to solve is the high-risk send: an autonomous process that can move money can be tricked into a wire, a banking change, or a cold reply to a stranger (the business-email-compromise playbook, now also a prompt-injection surface). RadMail solves it by refusing those actions in deterministic code — money, new banking, first contact, decisions, and injection are human-only, forever, by construction rather than by a policy an agent could be argued out of. So the agent fleet runs the inbox's work and the one irreversible seat stays yours.
tl;dr Delegate the inbox's work, not the irreversible send. RadMail keeps money/banking/first-contact human-only in code — the safety layer an agent-run inbox needs.
Yes — RadMail has an answer-ready inbox. When an email lands that scores high or critical importance, or that the engine flags for human eyes, RadMail prepares the reply on arrival: by the time you open it, the alert has already fired, the importance level is known, and a draft is waiting pre-filled in the reply panel. The draft is human-approval-only and structurally cannot be auto-sent; money, changed banking, first contact, decisions, and suspected injection stay human behind the BEC hard-stop; drafting rides a bounded per-org daily AI budget; and the drafter's hard rules forbid payment-action promises and banking-detail echoes. Pre-release, rolling out behind a flag.
tl;dr Answer-ready inbox = alert fired + importance known + reply drafted on arrival; you approve, nothing sends itself.