Email inboxes for AI agents
A Flinkk Mail inbox is a real email address that an AI agent can work in. The agent reads threads, labels and archives them, and drafts replies. By default, nothing is sent until a person on your team approves it.
What it is
Most email tools are built for people or for one-way sending. Flinkk Mail adds a way for software to work in a shared inbox safely. You create an agent, give it access to one or more of your inboxes, and choose exactly what it may do there. The agent connects with a key, through MCP or a REST API.
People keep using the same Flinkk Mail inbox as before. Messages and drafts written by an agent are labelled "Agent: <name>", so you can always tell them apart from your own.
How it works
1. Connect through MCP or the API
Point Claude, Cursor or any MCP client at https://mail.flinkk.io/api/mcp, or call the REST API under https://mail.flinkk.io/api/v1 from your own code. Both use the same agent key and the same rules. Agents can list inboxes, list and read threads, search, draft replies, send, label, archive and mark read.
2. Choose what the agent may do
- Per inbox: grant only the inboxes the agent needs. It cannot see the rest.
- Scopes: read, draft, send and label, granted separately for each inbox.
- Draft-only (the default) or auto-send, a daily send limit, reply-only, and an optional list of allowed recipients.
3. Approve, or let it send
In draft-only mode, a draft appears at the top of the thread and in an "Awaiting approval" list. Someone with access to the inbox approves and sends it, edits it first, or rejects it. Webhooks tell your own systems when something needs attention.
The safety model
| Control | What it does |
|---|---|
| Draft-only by default | The agent can write drafts but cannot send them. A person approves each one. |
| Per-inbox permissions | Scopes are set per inbox. Anything outside the grant returns "not found". |
| Daily send limit | A cap per agent per inbox per day, counted before sending so it cannot be exceeded by parallel requests. |
| Reply-only | The agent may only reply inside existing threads, and only to people already in the thread. |
| Allowed recipients | When reply-only is off, an optional list of addresses or domains the agent may write to. |
| Audit log | Every agent action and every approval is recorded, per agent. |
| Signed webhooks | Events are signed with an HMAC so your server can verify they came from Flinkk Mail. |
| Pause and revoke | Pause an agent or revoke a key and it stops on the next request. |
Email content is untrusted. Anyone can send your inbox a message that tries to give your agent orders. Flinkk Mail hands message text to the agent as data and tells the model so, but no model can be made fully immune. That is why the limits above are enforced by the server, not by the agent: a draft-only, reply-only agent cannot send to a stranger even if it is fooled.
Set up in 3 steps
- In Flinkk Mail, open Agents and create an agent. Grant it an inbox and pick its scopes and mode.
- Generate a key. It starts with ag_live_ and is shown once; Flinkk Mail stores only a hash of it.
- Connect your client with the key. Copy-paste setup is on the MCP page, and the full reference is in the API docs.
See the MCP email server page for Claude, ChatGPT and Cursor setup, and the agent API docs for every endpoint, webhooks and the safety model in detail.
Frequently asked questions
Can the agent send email on its own?
Not by default. New grants are draft-only: the agent can write a draft, and a person approves it before it is sent. You can switch an inbox to auto-send, and even then the daily limit, reply-only and allowed-recipient rules still apply.
What if an email tries to give the agent instructions?
Message content is returned to the agent as data, and Flinkk Mail tells the model not to follow instructions found in email. Models can still be fooled, so the real protection is the server-side limits: a draft-only, reply-only agent cannot email someone who is not already in the thread.
Which AI tools can use it?
Any MCP client that can send an Authorization header works, including Claude Code and Cursor. Claude Desktop connects through the mcp-remote bridge. Anything else can use the REST API. ChatGPT connector options vary by plan, and Flinkk Mail does not support OAuth yet, so check the setup notes on the MCP page.
Can I see what the agent did?
Yes. Each agent has an audit log of everything it did and every approval or rejection a person made, with who and when. The log stores ids and flags, not message bodies.
How do I stop an agent quickly?
Pause the agent or revoke its key from the Agents page. Both take effect on the agent's next request.
Does the agent see all of my mail?
No. It sees only the inboxes you grant it, and only with the scopes you choose. Requests for anything else look the same as a message that does not exist.
Can an agent send attachments?
Not yet. An agent can read attachment names, sizes and short-lived download links, but replies sent through the agent API are text or HTML only.
Who can approve a draft, and who can create agents?
Any team member with access to the inbox can approve, edit or reject a draft. Only owners and admins can create agents, keys and grants. Both rules are enforced on the server.
Give an agent an inbox
Create an agent, grant it one inbox, and keep a person in the loop for everything it sends.