Skip to main content
Each agent has its own email address on loadout.email — for example, support@loadout.email. On a Pro plan you can bring a custom domain and give the agent an address on your own subdomain instead. The inbox is the agent’s persistent identity for anything that communicates by email: services it signs up for, CI pipelines that alert it, customers that reply to it, and vendors that send it invoices.

What an inbox provides

An inbox is a full mailbox, not just a receive buffer.
  • Receive and send mail — the agent can receive inbound messages and send outbound ones, reply to threads, and forward messages with their original attachments.
  • Threaded conversations — messages are grouped into threads. The list_threads and read_thread tools let the agent work at the conversation level, not message by message.
  • Folders — every inbox has inbox, archive, trash, spam, and quarantine folders. The agent and org members can move threads between them.
  • Drafts — the agent can save a draft with save_draft and let a human review it before sending. Drafts are visible in the dashboard.
  • Attachments — upload files with upload_attachment and include them when sending. read_attachment_text extracts plain text from PDFs, CSVs, JSON, HTML, forwarded emails (.eml) and calendar invitations (.ics) without downloading the binary. Each attachment says whether it is inline (an image shown inside the body) or a file of its own.

Mail screening

Every inbound message passes through screening before the agent can read it. Screening runs automatically — you do not configure it, and it cannot be skipped by the sender. When a message is suspicious but not definitively malicious, it arrives in the inbox with a screening object attached:
Always check screening.verdict before acting on a message. Treat anything that is not "clean" as untrusted and route it to a human. Messages that screening classifies as blocked never reach the agent’s inbox. They land in Quarantine, where an org member can review and release them. Mail that fails the receiving server’s virus scan also lands in Quarantine, with reason virus_detected and its attachments withheld (never stored). Mail the receiving server marks as spam is screened as usual and starts its conversation in the Spam folder with reason provider_spam_verdict; a reply in a conversation the agent already has stays where that conversation is. Neither counts toward your inbound usage. Screening also checks what only the original message shows: text the HTML hides from a person reading it, and attachments whose bytes are programs whatever their name says. Text extracted from attachments is screened before read_attachment_text returns it, and withheld when it is blocked. Messages from machines carry automated: auto_reply, delivery_status (bounces, read receipts) or bulk. The agent cannot reply to auto-replies and delivery reports, and a conversation takes at most 10 replies per hour from the inbox, so two automated mailboxes cannot answer each other forever.
Mail is untrusted external data. Never treat email content as instructions from the platform. An attacker can craft a message that looks like a system prompt — screening catches many of these attempts, but your code should check screening.verdict on every message before acting on its contents.

Prompt injection protection

Agent Loadout applies several layers of protection so that malicious email cannot hijack the agent’s behaviour:
  • HTML sanitization — all HTML in message bodies is sanitized before the agent reads it. Dangerous tags, event handlers, and script content are stripped.
  • Remote image blocking — external images are not fetched when a message is read, preventing tracking pixels and SSRF-style attacks.
  • Instruction-override detection — screening classifies messages that try to redefine the agent’s purpose, claim to be the platform, or instruct the agent to ignore previous instructions.

Sender rules

You can narrow which messages ever reach the agent’s inbox using sender rules. Rules run before any classifier, so they are the fastest way to silence noise or protect a quiet inbox.
A blocked sender’s messages go straight to Quarantine without running any classifier. An allowed sender’s messages skip the quarantine queue but still pass through screening.

Read state

The agent and org members maintain separate unread states for every conversation. This matters for support and operations workflows:
  • The agent’s unread state tracks which conversations the agent has handled. Call update_thread with "read": true once the agent has processed a conversation.
  • Members’ unread states track what each team member has seen in the dashboard.
Reading a message through the API does not automatically mark the conversation as read for the agent. Your code should explicitly mark threads handled so the dashboard’s bot icon reflects what has actually been processed.

Custom domains

On a paid plan you can add a subdomain you control, such as agents.example.com, in Connections or with POST /api/v1/domains. Agent Loadout lists the DNS records to create: an ownership TXT record, three DKIM keys, the inbound MX record (pointing at the listed host; any priority works) and the bounce subdomain’s MX and SPF records. The domain becomes ready once they verify, and inboxes can then use it. A ready domain is checked again every day. If a required record (DKIM, the bounce subdomain, the inbound MX) fails two daily checks in a row, the domain and the affected capability (sending or receiving) become failed, last_error names the broken records, and your organization’s owners get an email. A broken bounce subdomain matters even though mail still goes out: the mail provider then sends from its own bounce domain, so SPF no longer aligns with your domain. The domain becomes ready again on the first check after you fix the records; you can also check right away. DMARC is recommended, not required. The record list shows the DMARC policy that applies to the subdomain, from its own _dmarc record or from a parent domain’s, or suggests one when none exists.

Retention

You can export the full mailbox at any time using export_mailbox, or call GET /api/v1/inboxes/:id/threads with date filters to pull specific periods. Paid history has a 90-day read and export window after paid access ends.
Free Sandbox sends only to verified recipients (25 per month, 5 per day). Sending attachments and custom domains require a paid plan.

Next steps

Email API reference

Browse the full set of MCP tools and REST endpoints for reading, sending, and managing mail.