How agents should think about email.
Architecture, patterns, and deliverability from the team building email infrastructure for AI agents.
Structured reply events — why your agent should never read raw email
Most email APIs hand your agent a string body. Mails.ai parses every inbound into a structured reply event — injection score and sender reputation on every event, opt-in classification for intent, entities, and urgency — so your code reads against a structured object, not raw bytes.
Prompt injection in inbound email is a real RCE class. Here's how mails.ai scans for it.
Prompt injection in agent runtimes is a tracked vulnerability class — Microsoft Security Response Center publishes AI-security advisories, OWASP catalogues it as LLM01. The vulnerability is structural: any agent that reads raw inbound text is exposed. Mails.ai runs a six-category scanner on every inbound before the structured reply event reaches your code, and flags high-confidence attacks (`quarantined`) so your agent skips them.
Per-event metered pricing: why monthly tiers force over-commit
Resend wants $20/month whether your agent sends 0 or 50,000 emails. Postmark wants $50. Agent traffic is bursty by nature — quiet days and incident spikes — so monthly tiers structurally force over-commit. Per-event metered pricing aligns cost to what you actually use, and incumbents cannot match without rebuilding their economics.
MCP-native email — `from mails import agent` becomes the default agent comms primitive
MCP collapsed N runtimes × M SDKs into one server that every runtime can use. Mails.ai shipped MCP-native from day one — drop a JSON snippet into your runtime config and your agent gets send, on_reply, list_threads, and get_reputation tools automatically.
Behavioral pool routing — how spam can't economically live on Clean infrastructure
Most platforms fight spam through moderation. Mails.ai fights it through architecture. Behavioral IP pools — Clean and Mixed at launch, an explicit Outbound pool on the roadmap — routed by behavior, not settings. Cold-pattern sends land on separate IPs. Transactional agents never share reputation with a spammer who signed up yesterday.
Built for agents.
Self-serve at every volume.
Public API opens Q3 2026. Drop ~6 lines into your agent and ship.
$ npm install @mailsai/sdk