# Unsendbox

> The agent-first email and communication platform for AI agents, where drift campaigns and templates are code run in a sandbox. Give every AI agent a dedicated email identity, create addresses on your domain, manage inbound and outbound mail, author code-driven drift-campaign sequences, and control every message from one inbox via UI or MCP.

Unsendbox does not host mailboxes. It provides a unified mailbox workflow with UI and MCP controls (create addresses, list and read threads, reply, send, and mirror) while your provider (Resend, Postmark, SES, or an SMTP relay) handles final delivery. Multi-step communication is code: drift-campaign sequences (XState) and templates (LiquidJS and React Email) compile and run in a secure sandbox. Deliverability guardrails (SPF/DKIM/DMARC auth gating, warmup budgets, idempotency, and suppression lists) reduce common failure modes for outreach and transactional mail.

URL: https://unsendbox.com
Keywords: AI email agent, email API for AI agents, email control plane, agent email address, MCP email, inbound email, outbound email, mirror rules, deliverability guardrails

## Core capabilities

- Create many agent addresses: provision addresses on your domain, manage aliases, and assign ownership in one place.
- Centralized inbox: a single pane across all agents (inbound and outbound) with thread views, search, and operational filters.
- Mirror rules (outreach isolation): sync mail across domains (e.g. hello@rebookos.win → hello@rebookos.io) to keep outreach domains separate without losing visibility.
- High-throughput outbound delivery: programmatic, API-driven sends triggered from the UI or MCP with idempotency built in.
- Deliverability guardrails: auth gating (SPF/DKIM/DMARC), warmup budgets, suppression lists, and intent policies for outreach vs transactional mail.
- Code-driven drift campaigns: author multi-step sequences as XState state machines and templates (LiquidJS and React Email) that compile and run in a secure sandbox, with idempotent effects and durable scheduling; enroll contacts and let agents run the sequence.
- UI + MCP control: operate manually in the UI or let agents work via MCP tools.

## Domain setup

For external Postmark setup, use a Postmark server API token for outbound sending, add the four DNS records shown by Unsendbox, and configure the server's inbound stream. Set `InboundHookUrl` to the URL provided by the Unsendbox deployment, enable `RawEmailEnabled`, and protect the URL with HTTP Basic auth using username `postmark` and the deployment-managed `CLOUD_AWS_SECRET_EMAIL_INGEST_SECRET` value. The secret and Postmark tokens must remain private. Postmark account-token API calls are separate from the server token used for outbound sending.

## MCP quickstart

Unsendbox exposes a Streamable HTTP MCP endpoint at https://unsendbox.com/api/v1/mcp.

### OAuth clients

OAuth-capable MCP clients should discover the protected resource at https://unsendbox.com/api/v1/.well-known/oauth-protected-resource and then use the advertised authorization-server metadata. The supported contract is authorization code flow with S256 PKCE. Live production discovery advertises `openid`, `profile`, `email`, `offline_access`, `read`, `write`, `mcp:read`, `mcp:write`, and `mcp:admin`. The server advertises Client ID Metadata Documents and dynamic public-client registration. Native clients may use dynamic loopback ports only with registered portless localhost, 127.0.0.1, or IPv6 loopback callbacks. A completed Claude Code OAuth callback and organization binding are not claimed here.

OAuth and API-key setup are separate. OAuth clients must not put an API key into an OAuth configuration. OAuth users with multiple organizations must select the organization through the MCP request context rather than relying on an implicit first organization.

### Custom API-key clients

A custom client may use an API key only when it explicitly supports the `x-api-key` header. Create the key in Dashboard → Settings → API Keys, keep it private, and send it on every MCP request. An organization-bound key is authoritative, and a conflicting `organizationId` query parameter is rejected. Do not put API keys in URLs, prompts, screenshots, or source control.

Discovery and local integration behavior are documented here. This file does not claim that a Claude Code session is authenticated or that Unsendbox has an Anthropic directory listing.

## Integrations

- [Integrations](https://unsendbox.com/integrations): Browse Unsendbox connections for delivery, AI clients, and mailbox forwarding.
- [Postmark](https://unsendbox.com/integrations/postmark): Route Unsendbox email through Postmark delivery infrastructure with DNS and inbound webhook setup.
- [Claude Code](https://unsendbox.com/integrations/claude-code): Connect Claude Code to the organization-scoped Unsendbox MCP server over Streamable HTTP and OAuth.
- [Gmail and Google Workspace](https://unsendbox.com/integrations/gmail): Forward selected Gmail messages to managed Unsendbox addresses while keeping Google Workspace as the mailbox layer.

Example tool calls:

```
create_address(domain="rebookos.win", local_part="hello", mirror_to=["hello@rebookos.io"])
list_threads(filter={"domain":"rebookos.win"})
get_thread(thread_id="thr_92f...")
reply(thread_id="thr_92f...", from="hello@rebookos.win", body="Thanks, here are next steps.")
send(to=["lead@company.com"], from="hello@rebookos.win", subject="Quick question", body="...", intent="outreach")
create_sequence(name="onboarding", machine_source="/* XState v5 drift-campaign machine */")
enroll_contact(sequence_id="seq_1a2...", email="lead@company.com")
```

## Pricing

- Free: $0/mo: 3k messages/mo, 1 domain, 5 agent addresses, 7-day retention, MCP rate-limited.
- Starter: $14/mo: 50k messages/mo, 2 domains, 25 addresses/domain, 30-day retention, 5 mirror rules, $0.65/1k overage.
- Pro: $59/mo: 100k messages/mo, 5 domains, 100 addresses/domain, 90-day retention, unlimited mirror rules, 3 operator seats, $0.55/1k overage.
- Team: $99/mo: 500k messages/mo, 10 domains, 200 addresses/domain, 180-day retention, unlimited mirror rules, 10 operator seats, $0.45/1k overage.

## Documentation

- Docs home: https://unsendbox.com/docs
- Getting started (send your first email in 10 minutes): https://unsendbox.com/docs/getting-started
- Domain setup: https://unsendbox.com/docs/domain-setup
- Connect your AI tool (MCP): https://unsendbox.com/docs/user-guide/connect-ai-tool
- Add a new sender address: https://unsendbox.com/docs/user-guide/setup-new-email
- Sending and receiving email: https://unsendbox.com/docs/user-guide/sending-receiving-email
- Forwarding email: https://unsendbox.com/docs/user-guide/forwarding-email
- Thread management: https://unsendbox.com/docs/user-guide/thread-management
- Mirror rules and safety: https://unsendbox.com/docs/user-guide/mirror-rules
- Contact management: https://unsendbox.com/docs/user-guide/contact-management
- Email templates: https://unsendbox.com/docs/campaigns/email-templates
- Broadcasts: https://unsendbox.com/docs/campaigns/broadcasts
- Campaign workflows: https://unsendbox.com/docs/campaigns/workflows
- Push notifications: https://unsendbox.com/docs/notifications/push
- Workspace and API access: https://unsendbox.com/docs/configuration/workspace-and-api-access
- Suppressions: https://unsendbox.com/docs/configuration/suppressions
- Blog: https://unsendbox.com/blog
- Security: https://unsendbox.com/security
- System status: https://unsendbox.com/status

## FAQ

- Does Unsendbox host mailboxes? No. Unsendbox provides a unified mailbox workflow and UI/MCP controls while your email infrastructure handles final delivery.
- Can I isolate outreach from my core domain? Yes. Use a separate outreach domain and configure mirror rules to copy inbound/outbound context to your core domain.
- How do you help avoid spam? Authentication checks (SPF/DKIM/DMARC), warmup send budgets, idempotency to prevent agent loops, and suppression lists. Inbox placement is never guaranteed.
- Are campaigns code? Yes. Drift-campaign sequences are XState state machines and templates are LiquidJS and React Email, compiled and executed in a secure sandbox, so multi-step communication is deterministic and reviewable.
- Do you support MCP? Yes. The MCP toolset can create addresses, list threads, fetch threads, reply, send, manage mirror rules, and create and run drift-campaign sequences.
- What is the fastest way to get started? Connect your domain, add your first agent address, then send and receive from the unified inbox.