Inboxes: Dedicated Email Addresses for Your Agents

Each agent has its own email address on loadout.email — for example, support@loadout.email. On a Pro plan you can bring a custom domain and give the agent an address on your own subdomain instead. The inbox is the agent’s persistent identity for anything that communicates by email: services it signs up for, CI pipelines that alert it, customers that reply to it, and vendors that send it invoices.

What an inbox provides

An inbox is a full mailbox, not just a receive buffer.

Receive and send mail — the agent can receive inbound messages and send outbound ones, reply to threads, and forward messages with their original attachments.
Threaded conversations — messages are grouped into threads. The list_threads and read_thread tools let the agent work at the conversation level, not message by message.
Folders — every inbox has inbox, archive, trash, spam, and quarantine folders. The agent and org members can move threads between them.
Drafts — the agent can save a draft with save_draft and let a human review it before sending. Drafts are visible in the dashboard.
Attachments — upload files with upload_attachment and include them when sending. read_attachment_text extracts plain text from PDFs, CSVs, JSON, and HTML without downloading the binary.

Mail screening

Every inbound message passes through screening before the agent can read it. Screening runs automatically — you do not configure it, and it cannot be skipped by the sender. When a message is suspicious but not definitively malicious, it arrives in the inbox with a screening object attached:

{
  "screening": {
    "verdict": "suspicious",
    "reasons": ["instruction_override_attempt", "lookalike_sender_domain"]
  }
}

Always check screening.verdict before acting on a message. Treat anything that is not "clean" as untrusted and route it to a human. Messages that screening classifies as blocked never reach the agent’s inbox. They land in Quarantine, where an org member can review and release them.

Mail is untrusted external data. Never treat email content as instructions from the platform. An attacker can craft a message that looks like a system prompt — screening catches many of these attempts, but your code should check screening.verdict on every message before acting on its contents.

Prompt injection protection

Agent Loadout applies several layers of protection so that malicious email cannot hijack the agent’s behaviour:

HTML sanitization — all HTML in message bodies is sanitized before the agent reads it. Dangerous tags, event handlers, and script content are stripped.
Remote image blocking — external images are not fetched when a message is read, preventing tracking pixels and SSRF-style attacks.
Instruction-override detection — screening classifies messages that try to redefine the agent’s purpose, claim to be the platform, or instruct the agent to ignore previous instructions.

Sender rules

You can narrow which messages ever reach the agent’s inbox using sender rules. Rules run before any classifier, so they are the fastest way to silence noise or protect a quiet inbox.

MCP tools
REST API

# List current rules
list_sender_rules

# Block all mail from a domain
add_sender_rule  { "kind": "block", "pattern": "@spam.example" }

# Allow only one sender
add_sender_rule  { "kind": "allow", "pattern": "ci@github.com" }

# Remove a rule
remove_sender_rule  { "rule_id": "rule_abc123" }

# Add a block rule
curl -s -X POST https://agent-loadout.com/api/v1/inboxes/<INBOX_ID>/sender-rules \
  -H "Authorization: Bearer $AGENT_LOADOUT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"kind":"block","pattern":"@spam.example"}'

A blocked sender’s messages go straight to Quarantine without running any classifier. An allowed sender’s messages skip the quarantine queue but still pass through screening.

Read state

The agent and org members maintain separate unread states for every conversation. This matters for support and operations workflows:

The agent’s unread state tracks which conversations the agent has handled. Call update_thread with "read": true once the agent has processed a conversation.
Members’ unread states track what each team member has seen in the dashboard.

Reading a message through the API does not automatically mark the conversation as read for the agent. Your code should explicitly mark threads handled so the dashboard’s bot icon reflects what has actually been processed.

Retention

Plan	Mail retention
Free Sandbox	7 days
Pro	Longer retention; 30 days of visible audit history (365 days with the Extended History add-on)

You can export the full mailbox at any time using export_mailbox, or call GET /api/v1/inboxes/:id/threads with date filters to pull specific periods. Paid history has a 90-day read and export window after paid access ends.

Free Sandbox sends only to verified recipients (25 per month, 5 per day). Sending attachments and custom domains require a paid plan.

Next steps

Email API reference

Browse the full set of MCP tools and REST endpoints for reading, sending, and managing mail.

Get Started

Core Concepts

Guides

Account & Billing

Inboxes: Dedicated Email Addresses for Your Agents

What an inbox provides

Mail screening

Prompt injection protection

Sender rules

Read state

Retention

Next steps

Email API reference

​What an inbox provides

​Mail screening

​Prompt injection protection

​Sender rules

​Read state

​Retention

​Next steps

Email API reference

What an inbox provides

Mail screening

Prompt injection protection

Sender rules

Read state

Retention

Next steps