Migrate from AgentMail.
Same inbox-as-identity model. Near-drop-in SDK. What you add: a built-in prompt-injection firewall and per-agent reputation on every inbound — the one thing AgentMail leaves to you. ~20 minutes, mostly a find-and-replace.
Same product shape. You stop reading untrusted email raw.
AgentMail got the primitive right: an inbox is the agent’s identity, and you send, receive, and thread against it. Mails.ai keeps that exactly. What changes is the safety layer on the way in — instead of allow/block lists you maintain, every inbound is scanned and scored before your agent touches it.
- The SDK is a near-drop-in. Inbox → agent, same verbs, one fewer argument. The migration is mostly mechanical.
- Inbound goes from raw → scanned.
event.injection_scoreand per-agent reputation come back on every reply. AgentMail gives you allow/block lists. - Deliverability holds. 10/10 on mail-tester (SPF/DKIM/DMARC pass, not blocklisted). Cloudflare Email Service is built for agents and scales with reputation like SES.
- You’re billed on sends + parses, not inbox seats. Create the agents you need; the inbound classifier is included in the price, not a separate LLM bill.
Inbox → agent, side by side.
// AgentMail — inbox as identity; you run inbound safety yourself
import { AgentMailClient } from "agentmail";
const client = new AgentMailClient({ apiKey: process.env.AGENTMAIL_KEY });
// Mint an inbox (the agent's identity)
const inbox = await client.inboxes.create({
username: "sarah",
domain: "yourcompany.com",
});
await client.inboxes.messages.send(inbox.inbox_id, {
to: "user@example.com",
subject: "Demo",
text: "...",
});
// Inbound: poll threads (or take a webhook), then run YOUR own safety.
// AgentMail safety = allow / block lists you configure per inbox.
const threads = await client.threads.list({ labels: ["unreplied"] });
// No injection score. No reputation. Your agent reads untrusted bodies raw.// Mails.ai — same inbox-as-identity, inbound safety built in
import { mails } from "@mailsai/sdk";
const agent = mails.agent("sarah"); // sarah@yourcompany.mails.ai
await agent.send({
to: "user@example.com",
subject: "Demo",
body: "...",
});
// Inbound arrives pre-scanned as a typed reply event.
agent.onReply((event) => {
// event.intent => "schedule_demo"
// event.entities => { date, time }
// event.injection_score => 0.02 <- prompt-injection firewall
// event.sender_reputation => 0.91 <- per-agent reputation
});What maps to what.
| AgentMail | Mails.ai | Notes |
|---|---|---|
| client.inboxes.create({ username, domain }) | mails.agent(name) | Same inbox-as-identity primitive — an AgentMail inbox is a Mails.ai agent. The address is the identity in both; the Mails.ai call is flatter (the agent is the handle, so no inbox_id to thread through every call). |
| client.inboxes.messages.send / reply / forward | agent.send / agent.reply / agent.forward | Same verbs, one fewer argument. Batch, scheduled, and cancel are all supported — Mails.ai exposes scheduling directly on send(); AgentMail does the same via drafts (send_at). |
| client.threads.list / search | agent.threads() + GET /v1/threads | Threads are first-class in both. Drafts, attachments, and raw-message fetch all map 1:1 — and server-side message search is live (?q= free-text across subject, body, and recipients on messages, received, and threads). |
| client.inboxes/{id}/lists/{allow|block} | Built-in injection firewall + reputation | THE upgrade. AgentMail inbound safety is allow/block lists you maintain by hand. Mails.ai scans every inbound for prompt injection (OWASP LLM-#1) and scores sender reputation automatically, per message — auto-quarantining anything over threshold before your agent ever sees it. |
| client.inboxes/{id}/api-keys (per-inbox keys) | Agent-scoped API keys | Scope a key to a single agent for the same blast-radius control. A send-scoped key can't read or manage. |
| client.domains (verify + zone-file) | Custom domains — Phase 2 | The one surface that doesn't map yet. Today every agent sends from your workspace subdomain (@yourcompany.mails.ai) — zero DNS setup. BYO custom-domain verification (DKIM/SPF/DMARC) ships in Phase 2, so a dual-run today runs on the subdomain, not your existing domain. |
| MCP server (npx / pip) | npx @mailsai/mcp-server (20 tools) | Both ship an MCP server for drop-in agent-runtime use. Same one-line config in Claude, Cursor, Windsurf. |
The questions engineers actually ask.
AgentMail runs on AWS SES; Mails.ai runs on Cloudflare. Is deliverability as good?
Yes. A live mails.ai send scores 10/10 on mail-tester — SPF, DKIM, and DMARC all pass, SpamAssassin is clean, and the sending pool is not blocklisted. Cloudflare Email Service is purpose-built for agent email and scales your daily send allowance with your reputation the same way SES does. Dedicated IPs are AgentMail's Enterprise-only lever; for transactional, recipient-initiated agent mail a reputable shared pool lands in the inbox.
What do I actually gain by switching?
A real inbound prompt-injection firewall and per-agent reputation scoring. AgentMail's inbound safety is allow/block lists — your agent still reads untrusted email bodies unscanned, which is the #1 security risk for any agent that acts on what it reads. Mails.ai returns an injection_score on every inbound and auto-quarantines attacks (instruction-override, role-hijack, data-exfil, tool-invocation) before they reach your agent. It's the one thing the category leader doesn't do.
Do my inboxes carry over?
One-to-one. An AgentMail inbox becomes a Mails.ai agent — recreate each with a single mails.agent() call, or bulk-create via the API. Today agents send from your workspace subdomain (@yourcompany.mails.ai); addresses on your own custom domain need domain verification, which ships in Phase 2.
Does Mails.ai meter inboxes the way AgentMail does?
No — Mails.ai meters sends and inbound parses, not inbox seats, so you're not counting agents. AgentMail Free is 3 inboxes / 3,000 emails; Mails.ai Free is 3,000 events/mo with the agents you need. Both free tiers comfortably cover a dual-run evaluation. On paid, Mails.ai Pro ($20) includes the inbound classifier in the price — the injection scan and intent extraction aren't a separate LLM bill you run yourself.
Is anything missing compared to AgentMail?
Custom domains — AgentMail verifies your own domain today; on Mails.ai that ships in Phase 2, and until then every agent sends from your workspace subdomain (@yourcompany.mails.ai). If your workflow requires sending from your own warmed-up domain right now, wait for Phase 2 before subscribing. Everything else (threads, server-side search, drafts, forward, scheduled send, batch, per-agent keys, webhooks, MCP) maps directly — and you gain the built-in prompt-injection firewall and per-agent reputation scoring, which AgentMail doesn't offer.
Built for agents.
Self-serve in minutes.
Public API opens Q3 2026. Drop ~6 lines into your agent and ship.
$ npm install @mailsai/sdk