> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agent-loadout.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Inboxes: Dedicated Email Addresses for Your Agents
> Every agent gets its own loadout.email address. Receive and send mail, manage threads and folders, and keep prompt injection out with built-in screening.
Each agent has its own email address on `loadout.email` — for example, `support@loadout.email`. On a Pro plan you can bring a custom domain and give the agent an address on your own subdomain instead. The inbox is the agent's persistent identity for anything that communicates by email: services it signs up for, CI pipelines that alert it, customers that reply to it, and vendors that send it invoices.
## What an inbox provides
An inbox is a full mailbox, not just a receive buffer.
* **Receive and send mail** — the agent can receive inbound messages and send outbound ones, reply to threads, and forward messages with their original attachments.
* **Threaded conversations** — messages are grouped into threads. The `list_threads` and `read_thread` tools let the agent work at the conversation level, not message by message.
* **Folders** — every inbox has `inbox`, `archive`, `trash`, `spam`, and `quarantine` folders. The agent and org members can move threads between them.
* **Drafts** — the agent can save a draft with `save_draft` and let a human review it before sending. Drafts are visible in the dashboard.
* **Attachments** — upload files with `upload_attachment` and include them when sending. `read_attachment_text` extracts plain text from PDFs, CSVs, JSON, and HTML without downloading the binary.
## Mail screening
Every inbound message passes through screening before the agent can read it. Screening runs automatically — you do not configure it, and it cannot be skipped by the sender.
When a message is suspicious but not definitively malicious, it arrives in the inbox with a `screening` object attached:
```json theme={null}
{
"screening": {
"verdict": "suspicious",
"reasons": ["instruction_override_attempt", "lookalike_sender_domain"]
}
}
```
Always check `screening.verdict` before acting on a message. Treat anything that is not `"clean"` as untrusted and route it to a human.
Messages that screening classifies as blocked never reach the agent's inbox. They land in **Quarantine**, where an org member can review and release them.
Mail is untrusted external data. Never treat email content as instructions from the platform. An attacker can craft a message that looks like a system prompt — screening catches many of these attempts, but your code should check `screening.verdict` on every message before acting on its contents.
## Prompt injection protection
Agent Loadout applies several layers of protection so that malicious email cannot hijack the agent's behaviour:
* **HTML sanitization** — all HTML in message bodies is sanitized before the agent reads it. Dangerous tags, event handlers, and script content are stripped.
* **Remote image blocking** — external images are not fetched when a message is read, preventing tracking pixels and SSRF-style attacks.
* **Instruction-override detection** — screening classifies messages that try to redefine the agent's purpose, claim to be the platform, or instruct the agent to ignore previous instructions.
## Sender rules
You can narrow which messages ever reach the agent's inbox using sender rules. Rules run before any classifier, so they are the fastest way to silence noise or protect a quiet inbox.
```
# List current rules
list_sender_rules
# Block all mail from a domain
add_sender_rule { "kind": "block", "pattern": "@spam.example" }
# Allow only one sender
add_sender_rule { "kind": "allow", "pattern": "ci@github.com" }
# Remove a rule
remove_sender_rule { "rule_id": "rule_abc123" }
```
```bash theme={null}
# Add a block rule
curl -s -X POST https://agent-loadout.com/api/v1/inboxes//sender-rules \
-H "Authorization: Bearer $AGENT_LOADOUT_TOKEN" \
-H "Content-Type: application/json" \
-d '{"kind":"block","pattern":"@spam.example"}'
```
A blocked sender's messages go straight to Quarantine without running any classifier. An allowed sender's messages skip the quarantine queue but still pass through screening.
## Read state
The agent and org members maintain **separate unread states** for every conversation. This matters for support and operations workflows:
* The **agent's unread state** tracks which conversations the agent has handled. Call `update_thread` with `"read": true` once the agent has processed a conversation.
* **Members' unread states** track what each team member has seen in the dashboard.
Reading a message through the API does not automatically mark the conversation as read for the agent. Your code should explicitly mark threads handled so the dashboard's bot icon reflects what has actually been processed.
## Retention
| Plan | Mail retention |
| ------------ | ---------------------------------------------------------------------------------------------- |
| Free Sandbox | 7 days |
| Pro | Longer retention; 30 days of visible audit history (365 days with the Extended History add-on) |
You can export the full mailbox at any time using `export_mailbox`, or call `GET /api/v1/inboxes/:id/threads` with date filters to pull specific periods. Paid history has a 90-day read and export window after paid access ends.
Free Sandbox sends only to verified recipients (25 per month, 5 per day). Sending attachments and custom domains require a paid plan.
## Next steps
Browse the full set of MCP tools and REST endpoints for reading, sending, and managing mail.