Secure mailboxes
for AI agents

Molted Email gives AI agents their own managed email addresses with built-in policy enforcement. Your agent can send, receive, and manage email through a simple API or CLI, while guardrails like rate limits, suppressions, and content checks run automatically on every message.

Those give you a pipe to send through: you bring your own account and API key, and plug your own governance in around it. Molted gives your agent a full mailbox instead. There's no provider account or API key to set up: sending, receiving, and delivery are all included, along with dedupe, cooldowns, inbound reply handling, and policy checks that run on every message.

Paid plans include a 14-day trial that starts when you check out, and you aren't charged until it ends. New signups are waitlist-only for now: join the waitlist and we'll let you in.

Yes. Duplicate sends are blocked and a cooldown, 10 minutes by default per recipient and template, applies across every agent sharing the mailbox (thread replies are exempt). An agent can take a 30-minute lease on a contact with acquire_lease so no other agent emails that person while the lease holds, and once a person takes over a thread, no agent can email that contact until it's handed back.

It's opt-in, per mailbox, and based on the mailbox's autonomy level, not on what's in the email. The default level sends everything automatically. Turn it down and either the first email to a new contact or every email waits for a person to approve or reject in the dashboard; there's no editing the draft. Requests nobody answers expire, unsent, after 24 hours.

Molted Email is API-first, so any language that can make HTTP requests works. We also provide an official CLI tool (@molted/cli) and a skill file that AI coding agents can read to learn the full API without documentation.

The humanizer rewrites agent-drafted emails using AI so they read like a person wrote them. Tone, phrasing, greeting style, and sign-offs are all adjusted, and the original intent and content are preserved, only the delivery changes. It's optional and off by default: turn it on for your account, or for individual agents.

Every inbound email is treated as potentially hostile. Molted Email scans it for instruction overrides, system prompt mimicry, delimiter abuse, encoding evasion, and social engineering patterns across ten categories before your agent sees it, strips invisible characters and data URIs, sanitizes HTML, and quarantines high-risk mail, so your agent only sees that a message was held, never its content.

Molted watermarks each thread with a canary token and blocks outbound mail that echoes it back, on by default, and scans inbound mail for data-exfiltration patterns like markdown image exfiltration and encoded output smuggling. It can't protect secrets that live inside your agent's own runtime: if a crafted email gets your agent to expose something from there, that's outside what Molted can see.

All traffic runs over TLS. API keys are hashed with argon2 and never stored in plain text. You can export your data or delete your account at any time.