The Email API Built for AI Agents

Generic email APIs weren't designed for agents. MultiMail provides cryptographically signed agent identity, graduated oversight controls, and compliance built in — not bolted on.


Why this matters

When an AI agent sends email through a generic SMTP relay or transactional API, three things are missing: recipients have no way to verify the message came from an agent rather than a human, your organization has no mechanism to review or gate what the agent sends, and you have no audit trail that satisfies EU AI Act Article 50 disclosure requirements. These aren't edge cases — they're the default failure mode when you wire an LLM to a generic email API.


How MultiMail solves this

MultiMail is a purpose-built email API for AI agents. Every sent message carries a cryptographic signature identifying the sending agent. Oversight mode controls whether sends go immediately or wait for human approval. The full audit trail — what the agent tried to send, who approved it, and when — is stored automatically. Access via REST API at https://api.multimail.dev, the multimail-sdk Python package, or the 50-tool MCP server that works directly inside Claude Desktop, Cursor, and Windsurf.

1

Create a mailbox and get your API key

POST to /v1/mailboxes to provision a mailbox on your domain or at @multimail.dev. Your API key (mm_live_... for production, mm_test_... for sandbox testing) authenticates every request. Each mailbox is tied to a specific agent_id that gets embedded in outbound message headers for identity verification.

2

Configure an oversight mode

Set oversight_mode on the mailbox. gated_send (the default) lets your agent read autonomously but holds outbound messages in a pending queue until a human approves. gated_all gates reads too. monitored lets the agent act freely while notifying a human. autonomous is available once trust is established. The mode is enforced server-side — the agent cannot override it.

3

Send and receive through the API

POST to /v1/emails/send to send. GET /v1/inbox to check incoming messages. Under gated_send, a send call returns immediately with status pending and a message_id. The message sits in the approval queue until a human approves it via the dashboard or the /v1/pending/{id}/approve endpoint.

4

Handle approvals with webhooks

Register a webhook endpoint to receive real-time events: email.approved, email.rejected, email.delivered, email.inbound. Your agent subscribes to these events and continues its workflow once a human approves a draft — no polling required. Webhook payloads are signed with HMAC-SHA256 for verification.

5

Audit and compliance are automatic

Every send attempt, approval decision, and delivery event is written to an immutable audit trail. CAN-SPAM required headers are validated before delivery — missing unsubscribe links or physical addresses are rejected outright. EU AI Act Article 50 agent disclosure is added automatically to outbound messages when the mailbox carries an agent_id.


Implementation

Send your first email via REST
bash
curl -X POST https://api.multimail.dev/v1/emails/send \
  -H &"cm">#039;Authorization: Bearer $MULTIMAIL_API_KEY' \
  -H &"cm">#039;Content-Type: application/json' \
  -d &"cm">#039;{
    "from": "[email protected]",
    "to": "[email protected]",
    "subject": "API Integration Test",
    "text": "Testing MultiMail API integration. This message was sent by an AI agent.",
    "agent_id": "crm-agent-v1"
  }&"cm">#039;

"cm"># Response under gated_send oversight:
"cm"># {
"cm">#   "message_id": "msg_01HX9K3ZQABCDEF",
"cm">#   "status": "pending",
"cm">#   "oversight_mode": "gated_send",
"cm">#   "approval_url": "https://app.multimail.dev/pending/msg_01HX9K3ZQABCDEF"
"cm"># }

A minimal send request showing authentication, required fields, and the pending response returned under gated_send oversight.

Python SDK — send and handle approval flow
python
from multimail import MultiMailClient

client = MultiMailClient(api_key="$MULTIMAIL_API_KEY")

"cm"># Send — returns immediately with pending status under gated_send
result = client.send_email(
    from_address="[email protected]",
    to="[email protected]",
    subject="API Integration Test",
    text="Testing MultiMail API integration.",
    agent_id="crm-agent-v1",
)

print(f"Status: {result.status}")          "cm"># pending
print(f"Message ID: {result.message_id}")  "cm"># msg_01HX9K3ZQABCDEF

"cm"># Inspect what's waiting for approval
pending = client.list_pending()
for msg in pending:
    print(f"Awaiting approval: {msg.subject} → {msg.to}")

"cm"># Read incoming messages autonomously (reads are not gated)
messages = client.check_inbox(
    mailbox="[email protected]",
    limit=10,
)
for msg in messages:
    print(f"Received: {msg.subject} from {msg.from_address}")

Using multimail-sdk to send a message and inspect the pending queue before the human approval event fires.

Create a mailbox and set oversight mode
python
import httpx

HEADERS = {
    "Authorization": "Bearer $MULTIMAIL_API_KEY",
    "Content-Type": "application/json",
}

"cm"># Create mailbox with gated_send (sends queue for approval, reads are autonomous)
response = httpx.post(
    "https://api.multimail.dev/v1/mailboxes",
    headers=HEADERS,
    json={
        "address": "[email protected]",
        "display_name": "Support Agent",
        "oversight_mode": "gated_send",
        "agent_id": "support-agent-v2",
    },
)
mailbox = response.json()
print(f"Created: {mailbox[&"cm">#039;address']}")
print(f"Oversight: {mailbox[&"cm">#039;oversight_mode']}")

# Later: promote to monitored once trust is established
httpx.patch(
    f"https://api.multimail.dev/v1/mailboxes/{mailbox[&"cm">#039;id']}",
    headers=HEADERS,
    json={"oversight_mode": "monitored"},
)
print("Promoted to monitored — agent now sends autonomously with notifications")

Provision a mailbox with gated_send oversight, then promote it to monitored once the agent's output quality is verified.

Webhook handler for approval events
python
from flask import Flask, request, jsonify
import hmac, hashlib

app = Flask(__name__)
WEBHOOK_SECRET = "whsec_your_webhook_secret"

@app.route("/webhooks/multimail", methods=["POST"])
def handle_multimail_event():
    sig = request.headers.get("X-MultiMail-Signature", "")
    body = request.get_data()
    expected = hmac.new(
        WEBHOOK_SECRET.encode(), body, hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(sig, f"sha256={expected}"):
        return jsonify({"error": "invalid signature"}), 401

    event = request.json

    if event["type"] == "email.approved":
        message_id = event["data"]["message_id"]
        resume_agent_workflow(message_id)

    elif event["type"] == "email.rejected":
        message_id = event["data"]["message_id"]
        reason = event["data"].get("rejection_reason", "no reason given")
        handle_rejection(message_id, reason)

    return jsonify({"received": True})

def resume_agent_workflow(message_id: str):
    print(f"Email {message_id} approved and delivered — continuing workflow")

def handle_rejection(message_id: str, reason: str):
    print(f"Email {message_id} rejected: {reason}")

Receive real-time notifications when a human approves or rejects an agent-drafted email so your workflow can continue without polling.

MCP server — email tools inside Claude Desktop
json
"cm">// ~/.config/claude/claude_desktop_config.json
{
  "mcpServers": {
    "multimail": {
      "command": "npx",
      "args": ["-y", "@multimail/mcp-server"],
      "env": {
        "MULTIMAIL_API_KEY": "$MULTIMAIL_API_KEY"
      }
    }
  }
}

"cm">// Claude Desktop can then invoke tools directly, for example:
"cm">//
"cm">// Tool: create_mailbox
"cm">// { "address": "[email protected]", "oversight_mode": "gated_send" }
"cm">//
"cm">// Tool: send_email
"cm">// { "from": "[email protected]",
"cm">//   "to": "[email protected]",
"cm">//   "subject": "API Integration Test",
"cm">//   "text": "Testing MultiMail API integration." }
"cm">//
"cm">// Tool: list_pending
"cm">// {}  — returns all messages awaiting human approval
"cm">//
"cm">// Tool: check_inbox
"cm">// { "mailbox": "[email protected]", "limit": 20 }

Configure the MultiMail MCP server once and Claude Desktop gains access to send_email, check_inbox, list_pending, and 40 other tools natively.


What you get

Cryptographic agent identity on every message

Every email sent through MultiMail carries a signature identifying the sending agent by its agent_id. Recipients and mail infrastructure can verify the message originated from a known AI agent. This satisfies EU AI Act Article 50 requirements for AI-generated content disclosure without any additional instrumentation.

Oversight that scales with trust

Start with gated_send — your agent reads freely but all outbound messages hold for human review. Promote to monitored once you've validated the agent's judgment on your specific use case, then to autonomous when full trust is established. The mode is enforced server-side and cannot be bypassed by the agent.

Built-in CAN-SPAM and EU AI Act compliance

Required CAN-SPAM headers — unsubscribe mechanism, physical address, honest From — are validated before delivery. Missing fields are rejected, not silently dropped. EU AI Act disclosure is appended automatically when the mailbox carries an agent_id and the recipient is a natural person.

50-tool MCP server for LLM-native access

Beyond REST, MultiMail ships an MCP server with 50 tools covering the full email lifecycle: send_email, reply_email, check_inbox, read_email, get_thread, tag_email, decide_email, manage_contacts, and more. Install once via npx @multimail/mcp-server and any MCP-compatible client gets full email access.

Immutable audit trail on every action

Every send attempt, approval decision, rejection, and delivery event is logged to an append-only audit trail. You can reconstruct exactly what an agent tried to send, who reviewed it, what they decided, and when — which matters when an enterprise customer or regulator asks.

Sandbox testing without a separate environment

mm_test_... keys validate the full request contract — auth, required fields, compliance checks — but discard the message before delivery. Switch to mm_live_... for real delivery. Both key types hit the same base URL. No separate test environment configuration, no mock servers, no delivery side effects during development.


Recommended oversight mode

Recommended
gated_send
For a general-purpose email API integration, gated_send is the correct default. Your agent needs to read incoming email without friction to be useful, but outbound sends warrant human review until you've verified the agent's judgment on your specific use case and data. The cost of an agent sending an incorrect, off-brand, or compliance-violating email is high; the cost of a human approving a pre-written draft is low. Promote to monitored once you have statistical confidence in output quality across a representative sample of sends.

Common questions

How is MultiMail different from SendGrid or Postmark?
SendGrid and Postmark are built for humans configuring transactional templates. They have no concept of an AI agent as the sender, no oversight controls, no pending queues for human review, and no agent identity verification. MultiMail is built specifically for the case where an LLM composes and sends email autonomously — with the identity, oversight, compliance, and audit machinery that requires.
What does 'formally verified security' mean in practice?
MultiMail's oversight model, identity verification logic, and authorization rules are specified and proven correct in Lean 4, a proof assistant. The proofs are machine-checked: if the implementation matches the specification, the security properties hold by construction. The Lean proofs live in the repo at Proofs/ and run in CI on every push. This is not a marketing claim — the proofs are publicly auditable.
What happens when an agent calls send_email under gated_send oversight?
The call returns HTTP 202 with status: pending and a message_id. Nothing is delivered yet. A webhook fires to your registered endpoint with type email.pending. A human reviews the draft in the dashboard or approves it via POST /v1/pending/{id}/approve. On approval, delivery proceeds and an email.approved webhook fires. On rejection, an email.rejected event fires with an optional rejection_reason.
Can I use MultiMail with LangChain, CrewAI, or AutoGen?
Yes. The REST API works with any HTTP client. The multimail-sdk Python package has explicit integrations for LangChain, CrewAI, AutoGen, and Semantic Kernel. The MCP server works with any MCP-compatible client: Claude Desktop, Cursor, Windsurf, and others. There is no lock-in to a specific orchestration framework.
How does EU AI Act compliance work exactly?
EU AI Act Article 50 requires that recipients be notified when they are interacting with an AI system. When a mailbox has an agent_id set and the recipient is a natural person (not another system), MultiMail automatically appends the required disclosure to outbound messages. The disclosure format follows guidance published by the European AI Office. You do not need to modify your message body or add custom headers.
Do mm_test_... API keys actually send email?
No. Keys prefixed mm_test_... run the full request through authentication, field validation, and compliance checks, then discard the message before delivery. This lets you build and test your integration without sending real email. Switch to mm_live_... when you are ready for live delivery. Both key types use the same base URL: https://api.multimail.dev.
What is the difference between the REST API and the MCP server?
The REST API is for programmatic integration in code you write — you call https://api.multimail.dev endpoints directly from your agent's backend. The MCP server exposes the same capabilities as 47 named tools that an LLM can invoke natively inside an MCP-compatible client without writing any integration code. Use the REST API when you are building the agent yourself; use the MCP server when you want an existing client like Claude Desktop to have email access.

Explore more use cases

The only agent email with a verifiable sender

Email infrastructure built for AI agents. Verifiable identity, graduated oversight, and a 50-tool MCP server. Formally verified in Lean 4.