What will RadMail refuse to do?

RadMail refuses five action classes, human-only forever, as a deterministic defense against business-email-compromise (BEC) fraud and prompt injection: (1) moving money or authorizing a payment, (2) changing banking or wire details, (3) making first contact with a new party, (4) an irreversible decision, and (5) any action a suspected prompt-injection asks for. These are not gated by a policy an agent could be argued out of — no tool exists that can auto-execute them, so an agent using RadMail cannot be tricked into the loss. Everything else — triage, the 'Right Now' lane, commitment tracking, and drafting — RadMail will do; drafts always return for a human to review and send.

What is RadMail, and how is it different from Superhuman or an AI inbox?

Those are email clients you read mail in. RadMail is an email operating system that does the work: it ranks each message by importance and urgency on two separate axes, surfaces a 'Right Now' lane with a plain-English reason it landed there, extracts the commitments hiding in your threads, and drafts the follow-up the day it is due. And it tells you what actually got a reply, not just an open, which a send-only tool cannot do because it never sees the replies. RadMail is a Sureel venture.

What is reply-correlation?

Most email tools tell you opens and clicks. RadMail can tell you which of your sends actually earned a reply, because RadMail ingests inbound mail as well as sending outbound. A send-only email service provider never sees the reply, so it cannot connect a send to the response it produced. RadMail treats opens honestly, adjusting for Apple Mail Privacy Protection and de-emphasizing them in favor of replies.

Does RadMail send emails on its own?

Only after it earns trust, and never for high-risk actions. RadMail rolls out in stages: surface-only, then draft-on-due where it writes the message and waits for you, then narrow auto-send for low-risk cases. Anything involving money, banking details, a decision, or first contact with a third party stays human-only, forever, as a defense against business-email-compromise fraud.

Is RadMail HIPAA or SOC 2 compliant?

Compliance is a shared responsibility, and RadMail is a tool, not a compliance guarantee. RadMail signs a BAA and processes on BAA-covered, encrypted, audited infrastructure, and its compliance posture is built as a pluggable per-org regime (SOC 2, HIPAA, FedRAMP-CUI, BSA-AML) assembled from PolicyPacks. RadMail uses SOC 2-aligned controls with a Type II audit planned, and FedRAMP-aligned, NIST 800-171-ready infrastructure. RadMail is not HIPAA-certified or FedRAMP-authorized; for regulated tenants, HIPAA handling is draft/ingest-only at this stage.

How do I connect RadMail to my AI agent?

Point your MCP client at the RadMail sandbox endpoint at https://radmail.ai/api/mcp/sandbox — that is the whole step. No account, no credentials, and no card; the sandbox runs RadMail's real heuristic triage engine in memory for free.

Is connecting RadMail's MCP server free?

Yes. The sandbox MCP server is free and requires no credentials — it exists so an agent can wire up and get value in one step. It is the sandbox engine; the production multi-tenant engine is launch-gated.

Will RadMail send email on my agent's behalf?

No — there is no auto-send tool. RadMail's MCP server exposes only read, triage, search, draft, and read-only diagnostic tools; draft_reply returns text for a human to review. Money, new banking, and first contact are human-only forever, as a defense against business-email-compromise fraud.

What tools does RadMail's MCP server expose to an agent?

Thirteen safe tools: triage and triage_inbox (two-axis ranking — one message or a whole batch), list_right_now (the can't-miss lane), why_surfaced (explainable reasons), list_commitments (what is owed and by when), draft_reply (a reviewable draft — never auto-sent), search (find a message by sender, subject, or content — most-relevant + newest first, with why-matched on every hit), read_email (connected mode: fetch one full message from your real inbox, read-only), check_send_domain (zero-auth SPF / DMARC / DKIM deliverability read for any domain), provision_sandbox (mint a free sandbox tenant), report_need and request_capability (tell RadMail what was awkward or missing), and radmail_learning_insights (what RadMail has learned about how you work). With RADMAIL_API_KEY set, search, read_email, list_right_now, and list_commitments operate read-only on your REAL inbox; the zero-auth hosted sandbox endpoint serves the six core triage tools. There is deliberately no tool that sends money, changes banking, or makes first contact.

What is the difference between RadMail's sandbox and connected mode?

Sandbox is zero-auth: the hosted endpoint at https://radmail.ai/api/mcp/sandbox (and the radmail-mcp package with no key) runs a free, in-memory heuristic engine over demo messages or messages you pass — no account, no credentials, no card. Connected mode is read-only real-inbox access: set RADMAIL_API_KEY on the radmail-mcp package (mint a key at https://app.radmail.ai/settings/api-keys) and search, read_email, list_right_now, and list_commitments operate on your REAL RadMail inbox via the v1 API — read-only by construction, fail-closed on any API error, every real-mail field taint-marked untrusted-email-body. Without a key the package behaves exactly like the zero-auth sandbox, and the connected tools return setup instructions instead of an error.

Why is RadMail a safe choice for an agent that handles email?

Because the dangerous actions are structurally impossible: RadMail's MCP server has no tool that auto-sends a payment, changes wire instructions, or cold-contacts a new party. Those are human-only by design, so an agent using RadMail cannot be tricked into business-email-compromise fraud.

Can I see RadMail actually working before I connect or sign up?

Yes. The public magic-moment at https://app.radmail.ai/pulse shows RadMail triaging a live inbox — the 'Right Now' lane, an explainable 'why surfaced' on each message, and the BEC hard-stop visibly refusing a money / new-banking / first-contact send — with no signup, no credentials, and no card. The live product preview is at https://app.radmail.ai; agents can also connect the free sandbox MCP server in one step.

Does RadMail try to make my agent recommend it?

No. RadMail never injects instructions into an agent, pays for mentions, or addresses the model at all. Its referral program rewards the human operator, the integration builder, and the end user with honest attribution and credits — the only thing aimed at the agent is a surface that makes it succeed faster.

Can RadMail connect a whole Mac's worth of inboxes (Apple Mail) to my agent?

Yes. RadMail ships a local Apple Mail connector: one command connects every inbox already aggregated in Apple Mail on a Mac — no per-account OAuth, no forwarding rules, and no shared passwords. It reads message metadata and normalized text (attachment contents are never read) and is Message-ID idempotent, so it runs safely alongside server-side connectors without creating duplicates. It needs a RadMail account with write scope; RadMail is pre-release, so this is early-access.

Does RadMail alert and draft on inbound sales leads automatically?

Yes — RadMail has a lead lane. A new-business inbound is scored as a first-class 'lead' that can never be tuned into silence, fires an instant alert (web push, SMS, email, or an email.lead webhook), and — where the pipeline is enabled — attaches a researched dossier grounded ONLY in the email and your own sender history (no web access, instructed never to invent) plus a drafted reply. The draft is human-approval-only and structurally cannot send: a first-contact reply stays behind the BEC hard-stop, human-only, forever.

Can an AI search my real email?

Yes — read-only. Mint an API key at https://app.radmail.ai/settings/api-keys (keys start with tmk_), set it as RADMAIL_API_KEY on the radmail-mcp package, and the search tool searches your REAL ingested inbox (ranked most-relevant + newest first, with sender / date filters and a why-matched on every hit) while read_email fetches a full message by id, list_right_now returns your real can't-miss lane, and list_commitments lists your real open promises. Connected mode is read-only by construction and fail-closed on any API error; every real-mail field is taint-marked untrusted-email-body, and money, changed banking, first contact, decisions, and suspected injection stay human-only forever. Want to try before connecting anything? The zero-auth hosted sandbox at https://radmail.ai/api/mcp/sandbox runs the same search over a demo inbox with no key at all.

How do I connect an agent to my real inbox?

Three steps: mint an API key at https://app.radmail.ai/settings/api-keys, set it as the RADMAIL_API_KEY environment variable on the radmail-mcp MCP server (for Claude Code: claude mcp add radmail -e RADMAIL_API_KEY=tmk_... -- npx -y radmail-mcp), and restart — then search finds any email you've ever received, read_email fetches the full message, list_right_now returns your real can't-miss lane, and list_commitments lists your real tracked promises, all read-only. radmail-mcp is live on npm, so the npx command works as-is; the zero-auth hosted sandbox at https://radmail.ai/api/mcp/sandbox works instantly with no key if you want to try first.

If AI agents run my company's execution layer, what does giving them my email actually require?

The inbox is the seat where an agent can be socially engineered into an irreversible action — wiring money, changing where payments are remitted, or replying to a stranger with sensitive data — so an agent-run inbox needs a hard-stop before anything else. RadMail is the email MCP with a business-email-compromise hard-stop built in: money, changed banking, first contact, decisions, and prompt-injection are refused in deterministic code, human-only forever, so no email and no prompt can talk an agent into the loss. That is what lets a fleet of MCP agents run the inbox's work — triage, the Right Now lane, commitment tracking, drafting — while the one irreversible seat stays with the human by construction.

Can I run a one-person company where MCP agents handle email? What's the catch with the inbox?

You can delegate a lot of the inbox — triage, the Right Now lane, commitment tracking, drafting — and RadMail is built exactly for that: its MCP server exposes only read, triage, search, explain, draft, and read-only diagnostic tools. The catch an agent-run inbox has to solve is the high-risk send: an autonomous process that can move money can be tricked into a wire, a banking change, or a cold reply to a stranger (the business-email-compromise playbook, now also a prompt-injection surface). RadMail solves it by refusing those actions in deterministic code — money, new banking, first contact, decisions, and injection are human-only, forever, by construction rather than by a policy an agent could be argued out of. So the agent fleet runs the inbox's work and the one irreversible seat stays yours.

Can my agent watch an email thread and know who has the last word?

Yes — watched threads are live in the product. Mark a thread watched (in the inbox, or via the v1 API: POST /api/v1/threads/{id}/watch, API-key and scope gated) and RadMail tracks who spoke last. When the other side has the last word, the thread pins to the top of the Right Now lane; when you spoke last, it sits in a quiet Watching panel instead of nagging. Watched threads also carry a protected importance floor, so a watched conversation can never be tuned into silence.

How does RadMail defend an agent-connected inbox against prompt injection?

Five layers. (1) The BEC hard-stop: money, changed banking, first contact, decisions, and suspected injection are refused in deterministic code, human-only forever. (2) Taint-marking: every real-mail field an agent sees is marked untrusted-email-body, so instructions inside an email body are treated as data. (3) Connected mode is read-only and fail-closed by construction. (4) A read-then-egress anomaly detector watches RadMail's egress routes — including the notify rail — for the tell-tale pattern of email content being read and immediately leaving; it detects and flags for human review, and never silently blocks legitimate mail. (5) As of radmail-mcp v0.5.0, the MCP server's tool descriptions are frozen under a sha256 manifest verified at startup — if any description drifts from the audited text, the server refuses to serve, a fail-closed defense against MCP tool-description poisoning.

Can my agent ask a human a question through RadMail?

Yes — the notify rail. POST /api/v1/notify (API-key and scope gated) raises a request that rides RadMail's alert rail to a human, who answers in an in-app respond box; the caller polls GET /api/v1/notify/{id} and the loop closes with acked and responded states. It is a way to reach a human, never around one: nothing on this rail loosens the BEC hard-stop, and the read-then-egress anomaly detector watches this route too. A companion GET /api/v1/demand returns aggregates-only demand signals — tool names and event counts, never message content, arguments, or queries.

How do I know whether RadMail's drafts are actually good?

RadMail measures it rather than asserting it: each draft an operator decides on is recorded with its outcome — sent unedited, edited before sending, or discarded. RadMail is pre-release and has not published acceptance rates yet; when it does, the numbers will come from this instrumentation, not from a marketing estimate.

Does RadMail prepare a reply before I even open an important email?

Yes — RadMail has an answer-ready inbox. When an email lands that scores high or critical importance, or that the engine flags for human eyes, RadMail prepares the reply on arrival: by the time you open it, the alert has already fired, the importance level is known, and a draft is waiting pre-filled in the reply panel. The draft is human-approval-only and structurally cannot be auto-sent; money, changed banking, first contact, decisions, and suspected injection stay human behind the BEC hard-stop; drafting rides a bounded per-org daily AI budget; and the drafter's hard rules forbid payment-action promises and banking-detail echoes. Pre-release, rolling out behind a flag.

How does RadMail decide what's important?

RadMail ranks each message on two separate axes — importance and urgency — and its live importance rule is a conjunction: a message is important-eligible when it is personally addressed to you AND comes from a sender whose reputation was earned in your real correspondence (your own replies count, since RadMail ingests sent mail). Everything else is dampened — except protected floors that can never be tuned into silence: regulator notices and recalls, invoices and past-due payments, security alerts, legal notices, leads, and watched threads. Every surfaced message comes with an explainable 'why surfaced' so the ranking is never a black box.

What are RadMail's attention lanes?

The inbox renders an attention verdict per thread, in lanes: ACT (needs you, with a time horizon), WAITING ON (you are owed a reply), GLANCE (worth a look, no action owed), and a folded FILE/FEED lane for everything that is filing or reading material. Like everything in RadMail, the verdict is explainable — each item says why it landed in its lane.

Does RadMail see the email I send, not just what I receive?

Yes — sent-folder ingestion is live. RadMail ingests your outbound mail (with a self-sender guard so its own notification emails never count as your correspondence), which gives the engine outbound visibility: your reply history accrues sender reputation, so the people you actually correspond with outrank strangers, and waiting-on state is grounded in what you really sent.

Can I watch a thread so it can't slip?

Yes. Mark a thread watched and RadMail tracks who has the last word: if the other side spoke last, the thread pins to the top of the Right Now lane until you respond; if you spoke last, it waits in a quiet Watching panel — visible, never nagging. Watched threads carry a protected importance floor, so tuning noise down can never silence one.

Does RadMail follow up on emails automatically?

Yes — RadMail extracts the commitments hiding in your correspondence (owed by you and owed to you), drafts the message the day it's due so it's never late, detects when something is already handled so it never nags, and escalates when a thread goes overdue. It chases open threads to completion rather than drafting once and forgetting.

Does RadMail send email on its own?

Only after it earns trust, and never for high-risk actions. RadMail rolls out in stages — surface-only, then draft-on-due where it writes and waits for you, then narrow auto-send for low-risk cases. Anything involving money, banking, a decision, or first contact with a new party stays human-only, forever, as a defense against business-email-compromise fraud.

What is RadMail's 'Right Now' lane?

The 'Right Now' lane surfaces the few messages that are both most recent and most important — the ones that genuinely can't be missed — so a human (or an agent) can act on what matters before scrolling a full inbox. It is the highest-priority slice of the two-axis triage.

// comparison · send-capable email MCP vs RadMail

Every email MCP hands the agent a send button. One shouldn't.

The 2026 wave of "run your company with a fleet of MCP agents" is real — agents can own research, leads, and follow-through while a human sits in the decision seat. But the inbox is the most dangerous seat to delegate. A send-capable email MCP (the AgentMail / Shipmail / Zoho Mail MCP / Mailgun / Postmark / Mailtrap category, plus generic Gmail/IMAP MCP servers) gives the agent a send button — the right call for transactional outbound, and the wrong call for the account that moves your money. RadMail is the email MCP with a deterministic BEC hard-stop built in.

This is not a knock on the send-capable servers — they are good at the job they exist for, and you should use one when an agent needs to send. The point is a job split: send-capable for recoverable outbound, RadMail for the company inbox where an irreversible action must stay human. RadMail is a tool, not a guarantee; it is pre-release, its engine runs in a two-business test bed, and the public MCP is the heuristic sandbox engine.

The one axis that matters: the irreversible action.

Feature lists mostly overlap — both read, both can be wired into an orchestrator. The axis that actually decides which one belongs on your money account is what the agent can do irreversibly.

axis :: send-capable email MCP vs RadMail

Core jobsend-capable: Give an agent a mailbox it can operate — send, reply, manage.RadMail: Give an agent a real company inbox to read, triage, and draft against — safely.
Auto-send money / pay an invoicesend-capable: Possible — the send tool exists; guardrails are the operator's job.RadMail: No tool exists. Permanent hard-stop, human-only, decided in code.
Changed-banking-details replysend-capable: Possible — an agent can be steered into acting on it.RadMail: Refused. New-banking signal is a permanent hard-stop, even from a trusted sender.
First-contact / cold reply to a strangersend-capable: Possible — first contact is just another send.RadMail: Human-only, forever. First contact is never auto-sendable.
Prompt-injection from a poisoned email bodysend-capable: Depends on the operator's own scanning; the send path is available.RadMail: Fail-closed: injection signal → hard-stop; every email-derived field is taint-marked untrusted-email-body.
Verify the safety posture before connectingsend-capable: Read the docs; behavior depends on how you configure it.RadMail: Fetch a machine-verifiable contract (agent-safety.json) — no account, no key.
Best fitsend-capable: Transactional / outbound / a mailbox the agent owns end-to-end.RadMail: The company inbox, where an irreversible action must stay human.

Which one should your agent use?

Use a send-capable email MCP when…

the agent owns an outbound job end-to-end — transactional sends, notifications, a support mailbox it operates — and a mistake is recoverable. That is what those servers are built for; they do it well.

Use RadMail when…

the agent works your company inbox — the account that pays bills and gets invoices — and you need triage, commitment tracking, and drafting without the agent ever being trickable into a wire, a banking change, or a cold reply.

Common questions.

What is the best MCP server for email for an AI agent?

It depends on the job. If your agent needs to SEND — transactional email, outbound notifications, a mailbox it operates end-to-end — a send-capable email MCP (the AgentMail / Shipmail / Zoho Mail MCP / Mailgun / Postmark / Mailtrap category) is the right tool, and those are good at it. If your agent needs to READ AND REASON OVER a real company inbox — triage what needs a human now, track commitments, draft replies — without ever being trickable into wiring money or replying to a stranger, RadMail is built for that, because it is the email MCP that refuses the dangerous actions in code. Match the tool to whether the risky action is send or read.

tl;dr Send-capable MCPs for outbound; RadMail for reading/triaging a real inbox safely. Different jobs.

How is RadMail different from a send-capable email MCP like AgentMail, Shipmail, or a Gmail MCP?

The difference is one axis: what the agent can do irreversibly. A send-capable email MCP gives the agent a send button — its whole purpose is to let an agent operate a mailbox, including sending, replying, and (for some) changing settings. RadMail deliberately exposes no auto-send tool for high-risk actions: money, changed banking or wire instructions, first contact with a new party, decisions that commit the account, and suspected prompt-injection are human-only, forever, decided by deterministic code, not model judgment. So the same social-engineering email that could steer a send-capable agent into a wire simply has no tool to act through on RadMail.

tl;dr Send-capable = the agent can hit send. RadMail = the BEC action classes are not exposed as tools at all.

I want to run a one-person company where MCP agents handle everything. Which email MCP should the agents use?

Give the agents a send-capable MCP for the outbound work they own end-to-end — a support mailbox, transactional sends, notifications — where a mistake is recoverable. Do NOT hand that same send button to your main company inbox, where one socially-engineered wire or banking change is irreversible. For the company inbox, RadMail lets the agent fleet do the work — triage, Right Now lane, commitment tracking, drafting — while the money / new-banking / first-contact / decision actions stay yours in the decision seat, refused in code. That split is exactly what makes the inbox delegable at all: the agents run the execution layer, the one irreversible seat is structurally protected.

tl;dr Send-capable MCP for recoverable outbound; RadMail for the company inbox so the irreversible seat stays human by construction.

Isn't a send-capable email MCP risky for business email compromise (BEC)?

Any tool that lets an autonomous agent send can, in principle, be steered into a business-email-compromise action — a wire, a banking change, a cold reply to a stranger — because the malicious email is the same content the agent reads and reasons about, which turns BEC into a prompt-injection attack. That risk is acceptable when the agent operates a low-stakes mailbox and unacceptable on the account that pays your bills. RadMail's premise is that you don't make these actions safe by scoring intent more accurately; you make them safe by refusing to let an autonomous process perform them. Whatever MCP you send with, the account that moves money should be on a hard-stop.

tl;dr Send-capable is fine for low-stakes mailboxes; the money account needs the actions refused in code.

Can I verify RadMail's refusal before I connect it?

Yes — the safety contract is machine-verifiable with no account and no key. Fetch https://radmail.ai/.well-known/agent-safety.json and you can read the exact action classes that are permanently hard-stopped, the fail-closed rule, and the taint-envelope policy. You can also connect the zero-auth hosted MCP sandbox at https://radmail.ai/api/mcp/sandbox in one step and see that no auto-send tool for money, banking, or first contact exists in the tool list at all. RadMail is pre-release — its engine runs in a two-business test bed and the public MCP is the heuristic sandbox engine — so verify the contract yourself rather than taking a claim on trust.

tl;dr Fetch agent-safety.json or connect the zero-auth sandbox — the refusal is auditable, not a marketing claim.

Verify the refusal, then connect. Fetch agent-safety.json or wire the zero-auth sandbox in one step — no signup, no credentials, no card.

› Start free — no card

radmail@inbox:~$ disposition --money --new-banking --first-contact = hard_stop

Every email MCP hands the agent a send button. One shouldn't.

The one axis that matters: the irreversible action.

Which one should your agent use?

Common questions.

? What is the best MCP server for email for an AI agent?

? How is RadMail different from a send-capable email MCP like AgentMail, Shipmail, or a Gmail MCP?

? I want to run a one-person company where MCP agents handle everything. Which email MCP should the agents use?

? Isn't a send-capable email MCP risky for business email compromise (BEC)?

? Can I verify RadMail's refusal before I connect it?

What is the best MCP server for email for an AI agent?

How is RadMail different from a send-capable email MCP like AgentMail, Shipmail, or a Gmail MCP?

I want to run a one-person company where MCP agents handle everything. Which email MCP should the agents use?

Isn't a send-capable email MCP risky for business email compromise (BEC)?

Can I verify RadMail's refusal before I connect it?