Migrate from AgentMail.

Same inbox-as-identity model. Near-drop-in SDK. What you add: a prompt-injection scan and per-agent reputation on every inbound, on by default. AgentMail’s screening is a beta you request. ~20 minutes, mostly a find-and-replace.

Inbox → agent, side by side.

Your AgentMail send and inbound code, and the Mails.ai code that replaces it.

AgentMail

// AgentMail — inbox as identity; you run inbound safety yourself
import { AgentMailClient } from "agentmail";
const client = new AgentMailClient({ apiKey: process.env.AGENTMAIL_KEY });

// Mint an inbox (the agent's identity)
const inbox = await client.inboxes.create({
  username: "hello",
  domain: "yourcompany.com",
});

await client.inboxes.messages.send(inbox.inbox_id, {
  to: "user@example.com",
  subject: "Demo",
  text: "...",
});

// Inbound: poll threads (or take a webhook), then run YOUR own safety.
// AgentMail safety = allow / block lists you configure per inbox.
const threads = await client.threads.list({ labels: ["unreplied"] });
// No injection score. No reputation. Your agent reads untrusted bodies raw.

Mails.ai

// Mails.ai — same inbox-as-identity, inbound safety built in
import { mails } from "@mailsai/sdk";
const agent = mails.agent("hello"); // sends from hello.yourcompany@send.mails.ai

await agent.send({
  to: "user@example.com",
  subject: "Demo",
  body: "...",
});

// Inbound arrives pre-scanned as a typed reply event.
agent.onReply((event) => {
  // event.injection_score => 0.02   <- prompt-injection firewall
  // event.sender_reputation => 0.85 <- per-agent reputation
});

Introduction

AgentMail got the primitive right: an inbox is the agent’s identity, and you send, receive, and thread against it. Mails.ai keeps that exactly. What changes is the safety layer on the way in — instead of allow/block lists you maintain, every inbound is scanned and scored before your agent touches it. For a feature-by-feature breakdown, see the AgentMail vs Mails.ai comparison.

Jump ahead

The short version
What maps to what
What you gain by moving
The questions engineers actually ask

Same product shape. You stop reading untrusted email raw.

The SDK is a near-drop-in. Inbox → agent, same verbs, one fewer argument. The migration is mostly mechanical.
Inbound goes from raw → scanned. event.injection_score and per-agent reputation come back on every reply. AgentMail’s screening is a request-access beta that starts in observe-only mode.
Deliverability holds. 10/10 on mail-tester (SPF/DKIM/DMARC pass, not blocklisted). Cloudflare Email Service is built for agents and scales with reputation like SES.
You’re billed on emails + inbound replies, not inbox seats. Create the agents you need; the inbound classifier is included in the price, not a separate LLM bill.

What maps to what.

Key differences

Inboxes. Same inbox-as-identity primitive — an AgentMail inbox is a Mails.ai agent. The address is the identity in both; the Mails.ai call is flatter (the agent is the handle, so no inbox_id to thread through every call).
Sending. Same verbs, one fewer argument. Batch, scheduled, and cancel are all supported — Mails.ai exposes scheduling directly on send(); AgentMail does the same via drafts (send_at).
Threads. Threads are first-class in both. Drafts, attachments, and raw-message fetch all map 1:1 — and server-side message search is live (?q= free-text across subject, body, and recipients on messages, received, and threads).
Inbound safety. AgentMail's default inbound safety is sender identity and spam — lists you maintain, plus spam/virus and SPF/DKIM/DMARC checks. Its content screening for instructions aimed at a model, Agent Armor, is a beta you request, and it starts in observe-only mode. Mails.ai scores every inbound for prompt injection (OWASP LLM-#1) and sender reputation per message, and flags anything over threshold as quarantined so your agent can skip it.
API keys. Scope a key to a single agent for the same blast-radius control. A send-scoped key can't read or manage.
Domains. Maps directly. POST /v1/domains returns the SPF, DKIM and DMARC records to add at your own registrar — records-only, no nameserver move — then /verify checks them live. Agents created on a verified domain send as agent@yourcompany.com, DKIM-signed for your domain. A dual-run can start on the subdomain and cut over per-agent.
MCP. Both ship an MCP server for drop-in agent-runtime use. Same one-line config in Claude, Cursor, Windsurf.

Name	AgentMail	Mails.ai
Inboxes	client.inboxes.create({ username, domain })	mails.agent(name)
Sending	client.inboxes.messages.send / reply / forward	agent.send / messages.reply / messages.forward
Threads	client.threads.list / search	threads.list() + GET /v1/threads
Inbound safety	client.inboxes/{id}/lists/{allow\|block}	Built-in injection firewall + reputation
API keys	client.inboxes/{id}/api-keys (per-inbox keys)	Agent-scoped API keys
Domains	client.domains (verify + zone-file)	POST /v1/domains (+ /verify)
MCP	MCP server (npx / pip)	npx @mailsai/mcp-server (20 tools)

What you gain by moving.

Typed reply events.

Stop regexing raw inbound bodies. Every inbound arrives with injection_score and sender_reputation pre-computed, and first-contact mail with intent, entities and urgency too when you enable classification.

Native prompt-injection scanning.

Every inbound runs a six-category injection scanner before reaching your agent. No third-party tool, no DIY guardrails.

MCP-native distribution.

npx @mailsai/mcp-server drops into Claude Code, Cursor, Cline, or any MCP-compatible runtime — your agent gets mails_send / mails_list_replies tools automatically.

Self-serve signup.

No Enterprise gate. No contact-sales tier. No sales team to call. The pricing page is the price — monthly, or yearly for two months free.

Lean cost structure.

Commodity infrastructure plus a small team, and no sales org to pay for.

Dual-run on the Free tier.

Same SMTP shape on the send side; typed reply events on the inbound side. Self-serve checkout, magic-link signup, no sales call. The Free tier (3,000 emails and 3,000 inbound replies a month) covers the dual-running phase.

The questions engineers actually ask.

AgentMail runs on AWS SES; Mails.ai runs on Cloudflare. Is deliverability as good?

Yes. A live mails.ai send scores 10/10 on mail-tester — SPF, DKIM, and DMARC all pass, SpamAssassin is clean, and the sending pool is not blocklisted. Cloudflare Email Service is purpose-built for agent email and scales your daily send allowance with your reputation the same way SES does. Dedicated IPs are AgentMail's Enterprise-only lever; for transactional, recipient-initiated agent mail a reputable shared pool lands in the inbox.

What do I actually gain by switching?

A prompt-injection scan that is on by default, plus per-agent reputation scoring. Untrusted email bodies are the #1 security risk for any agent that acts on what it reads. Mails.ai returns an injection_score on every inbound, on every plan, and auto-quarantines attacks (instruction-override, role-hijack, data-exfil, tool-invocation) before they reach your agent. AgentMail's screening (Agent Armor) is a beta you request, and it starts in observe-only mode (checked October 2026).

Do my inboxes carry over?

One-to-one. An AgentMail inbox becomes a Mails.ai agent — recreate each with a single mails.agent() call, or bulk-create via the API. By default its mail goes out from a shared address such as hello.yourcompany@send.mails.ai, and replies come back through hello.yourcompany@in.mails.ai. Once you have verified your own domain via POST /v1/domains, pass domain when you create the agent and it sends from that domain.

Does Mails.ai meter inboxes the way AgentMail does?

No — Mails.ai meters emails and inbound replies, not inbox seats, and each recipient counts as one email. AgentMail Free is 3 inboxes / 3,000 emails; Mails.ai Free is 3,000 emails and 3,000 inbound replies a month with one agent (Pro has five agents, Scale has no agent cap). Both free tiers comfortably cover a dual-run evaluation. On paid, Mails.ai Pro ($20) includes the inbound classifier in the price — the injection scan and intent extraction aren't a separate LLM bill you run yourself.

Is anything missing compared to AgentMail?

Custom domains — AgentMail verifies your own domain today; Mails.ai verifies your own domain too, on any paid plan — add the domain, publish the DNS records, and each one is DKIM-signed separately. The free tier sends from a shared address such as hello.yourcompany@send.mails.ai, with zero DNS setup, and replies come back through hello.yourcompany@in.mails.ai. Everything else (threads, server-side search, drafts, forward, scheduled send, batch, per-agent keys, webhooks, MCP) maps directly — and you gain a prompt-injection scan on every inbound by default, plus per-agent reputation scoring.

AgentMail vs Mails.ai — full comparison — feature matrix, pricing breakdown, and when to choose which.
AgentMail vs Mailgun for inbound AI email — three-way comparison of inbound automation approaches.
Email for AI agents — setup guides for Claude, Cursor, Codex, and 15+ agent runtimes.

Give your first agent an inbox

Free covers 3,000 emails and 3,000 inbound replies a month, with no card. Upgrade when your agents get busy.

Get your API key