Your agent is one email from a breach

Molted catches that email before your agent reads it.

Start freeRead the docs
Works with
  • Claude Code
  • Cursor
  • Codex
  • MCP
  • CLI
  • REST

The email that hijacks your agent is already written.

Strangers can't give your agent orders.

Hijack attempts are quarantined. Only you can release them.

Hard conversations come to you.

Your agent hands you the thread and stays out until you're done.

You decide how much it does alone.

Approve first emails, or every email. Your agent can't approve itself.

No double sends.

The same email to the same person twice within minutes is blocked.

Set up with one prompt.

  1. ✓Paste one prompt into your agent.
  2. ✓It sets up its own inbox.
  3. ✓It asks you only for what it can't do.

Your agent gets answers, not just a send button.

Over MCP, a CLI or a REST API.

It knows before it sends.

Would this go out? Your agent can ask first.

Mail arrives sorted, as data.

Labelled, with anything steering your agent quarantined.

A hijacked agent can't unlock itself.

Agents can tighten a rule, never loosen one.

Priced by mailbox, not by email.

Every plan gets the whole product. Pick by how many mailboxes you run.

8 mailboxes → Solo, $19/mo

Free

$0

free for people

For people trying it: a form inbox, alerts, a waitlist.

  • 3 mailboxes on a shared domain
  • 3,000 sends a month
  • 1,000 inbound emails a month
  • No humanizer rewrites
Start free

Solo

$19 /mo

$1.90 per mailbox

For indie developers and freelancers, on your own domain.

  • 10 mailboxes
  • 3 custom domains
  • 10,000 sends a month
  • 5,000 inbound emails a month
  • 50 humanizer rewrites a month
Start with Solo

Team

$79 /mo

$1.58 per mailbox

For teams with agents in production.

  • 50 mailboxes
  • 10 custom domains
  • 50,000 sends a month
  • 25,000 inbound emails a month
  • 300 humanizer rewrites a month
Start with Team

On every plan

  • Prompt-injection screening
  • Quarantine
  • Canary tokens
  • Thread checks
  • Policy on every send
  • Autonomy you set
  • Audit log
  • Keys scoped to mailboxes
  • Sends to your team don't count
  • Spam never counts

What each one does, and every limit side by side: pricing.

Free is for people and needs no card. An agent that signs up on its own can't use Free: it sends you a checkout link for Solo or Team, and nothing is charged until you complete it. Solo and Team start with a 3-day trial, or skip it and start right away.

Past your allowance on Solo and Team: $1.50 per 1,000 sends, $0.50 per 1,000 inbound. More mailboxes or volume? Talk to us.

Questions, answered.

Anything else? Talk to us or read the docs.

What happens when someone emails my agent a prompt injection?
Molted screens every incoming email before your agent can read it. A message scored high risk for trying to instruct your agent is quarantined: your agent sees only that it was held, and only a person can release the original. Replies your agent writes on a flagged thread wait for a person to approve them, and a reply that leaks the thread's canary token is blocked. On new workspaces, a send our check flags as sharing another person's card or personal data is held for you too. Your agent can't switch any of these checks off.
How is this different from giving my agent a Gmail account?
Gmail is built for a person at a keyboard. Molted is built for software: your agent gets its own address and inbox over MCP, a CLI or REST, every email it sends is checked first, every email it receives is screened for prompt injection, and anything it shouldn't handle comes to you.
Do I need a Resend, Postmark or SES account?
No. Sending, receiving and delivery are included. There is no provider account or API key to set up: your agent connects, gets an address, and sends.
Which agents does it work with?
Anything that speaks MCP, such as Claude Code, Cursor and Codex, locally or through the hosted server at mcp.molted.email. There is also a CLI (@molted/cli) and a REST API. Agents can read skill.md to learn the whole API on their own.
What stops my agent from doing something it shouldn't?
Every send is checked for duplicates, a cooldown on sending the same email to the same person, suppressions (bounces, complaints and unsubscribes are added automatically) and send limits. Incoming mail that tries to instruct your agent is quarantined. If a mailbox's bounce or complaint rate climbs, Molted pauses it, and only a person can resume it: agents may tighten a rule, never loosen one.
Can I review emails before they go out?
Yes, per mailbox. Mailboxes run on their own by default. Turn one down and either first emails to new contacts or every email waits for you to approve or reject in the dashboard. Requests nobody answers expire after 24 hours, unsent.
Can a person take over a conversation?
Yes. Your agent can hand you a thread with a note, or you can take one yourself. You read and reply from the dashboard, and the agent can't email that contact until you hand the thread back.
How does my agent hear about new mail?
Whichever way suits it: read the inbox when it likes, receive webhooks, follow a live event stream, or run molted listen from the CLI.
Can several agents share a mailbox?
Yes. Duplicate and cooldown checks apply across all of them, and an agent can take a lease on a contact so no other agent emails that person at the same time.
How is my data handled?
API keys are hashed, never stored in plain text. You can export your data or delete your account whenever you like. Molted is operated from Sweden.
Can my agent sign up by itself?
New signups are waitlist-only today: join the waitlist first. When signups open, your agent can create the account from the command line (npx @molted/cli auth signup) and set everything up. Paying is always a person's call: your agent sends you the checkout link.

Put Molted in front of your agent before that email arrives.

Set up with one prompt.

Start free
$ npx @molted/cli auth signup

free for people · from $19/mo · set up in minutes