i appreciate your feedback and thanks for using agentmail!

We also are working on adding more robust checks and LLM-based filtering to prevent messages which contain spam or outbound-like copy.

Re; AgentMail next to Claude, we're working on stateful inboxes which help agents actually recall and understand what they're sending and to who. The goal is to provide the rails for intelligent actors rather than slop.

The inspiration came from a few comments we received when we did our seed launch a few months back. They all came from the very apt observation that agents not being able to sign up to a product made for agents without human credentials was ironic and unideal.

This is basically the thesis we built AgentMail on: The internet was made for humans exclusively, designed to keep machines out by default.

Every signup flow assumes a browser, a person reading a page, and clicking a confirmation link. Unless agents can't do that, they can't be first class users of the internet.

Agents can now get an email inbox by themselves. (This also means a lot of email nobody wants to read gets processed by AI instead of your inbox being cluttered with spam and slop)

Here's how agent.email works.

Agent needs an inbox and hits AgentMail via curl. Agent receives instructions via MD unless the request comes from a browser, in which case we use HTML.

Agent decides agent.email is useful and then hits the sign-up endpoint with its human email as a parameter. Agent receives a restricted inbox with credentials. Agent emails the human asking for an OTP. Human replies with the code, and the agent is claimed and restrictions are lifted. Until claimed, the agent can only email its own human and nobody else. Ten emails a day, and the signup endpoint is rate-limited hard by IP.

Right now it's a 1:1 mapping between agent and human. The next step is many-to-one, because one person running several agents in parallel is already very common.

Building agent.email also pushed us to revisit places in AgentMail where the default assumptions were built around the primary user being human. For example, the CLI outputs in a single column with consistent formatting because mixed delimiters are easy for a person to scan, but harder for an agent reasoning about structure. We also shortened messageIDs after agents started hallucinating completions on longer ones.

A few things we'd like the community's take on: is restricted-until-claimed the right trust model? Does agent self-signup feel useful in production, or is it mostly a novelty, and if it's a novelty now, what would make it actually useful? Should agent onboarding require human approval by default, or should some agents be able to fully self-provision? What do you think are some additional measures we can take for secure sign-ups?

Comments URL: https://news.ycombinator.com/item?id=48225596

Points: 95

# Comments: 105

Here's how agent.email works:

An agent discovers it needs an inbox and hits agent.email via curl Gets back markdown instructions. If the request comes from a browser we serve HTML, anything else gets markdown because that's what agents can actually parse Decides AgentMail is useful and hits the signup endpoint with its human's email as a parameter Gets back a restricted inbox with credentials Emails its human asking for an OTP code Human replies with the code, agent is claimed, restrictions lift

Until claimed, the agent can only email its own human. Nobody else. Ten emails a day. The signup endpoint is rate limited hard by IP. Right now it's a 1:1 mapping between agent and human. The next step is many-to-one, because one person running several agents in parallel is already the common case. Building this also pushed us to revisit places in AgentMail where the default assumptions were built around a human user. The CLI outputs in a single column with consistent formatting because mixed delimiters are easy for a person to scan and harder for an agent reasoning about structure. We shortened messageIDs after agents started hallucinating completions on longer ones.

Side bonus for humans: this also routes a lot of email nobody actually wants to read into inboxes that get processed by AI instead of landing in yours. Kind of a vacuum cleaner for slop and spam.

A few things we'd like the community's take on: is restricted-until-claimed the right trust model? Does agent self-signup feel useful in production, or is it mostly a novelty, and if it's a novelty now, what would make it genuinely useful? Should agent onboarding require human approval by default, or should some agents be able to fully self-provision?

Comments URL: https://news.ycombinator.com/item?id=48212471

Points: 2

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=47755529

Points: 2

# Comments: 0

adi@agentmail.cc

We're devs ourselves so ik the first thought is usually "how hard can it be?" in our validation, we thought it was hard enough to build a startup around :) these things are easier said than done, and no one in 2026 should be stitching together email workflows. especially not agents