Open source · Self-hosted · Apache-2.0
Self-hosted email, task threads, approvals, and webhooks over MCP and REST—for the agents you already use. Bring your own agents. Keep control of the work.
openagent.email is Apache-2.0 infrastructure for agent communication and inspectable task handoffs: self-hosted email, task threads, approvals, and webhooks over MCP and REST, with no per-inbox software fees. A VPS from $5/mo is enough; a hosted service is optional if you prefer not to run a server. Data paths remain user-controlled: mail stays on your server unless you route outbound via SMTP relays, dispatch webhooks, or enable phone push notifications via ntfy.
WORKS WITH ANY MCP CLIENT — AND ANYTHING THAT CAN CURL
Claude Code 
Cursor 
Windsurf 
Docker ✦ Kimi Code ✦ Any MCP client ✦ Plain REST Get connected
CLI, Claude Desktop, or web chat — Claude, ChatGPT, Grok, Mistral Le Chat, and plain REST when MCP is not an option. One short guide, step by step.
Workflow walkthrough
An illustrative walkthrough of the workflow: start the stack, mint an identity, wait for mail, and extract the code. (Scripted walkthrough; prerequisites such as admin auth and full address parameters are omitted for clarity).
Real mail, really parsed
Extraction is tested against the mails that real services send — US and Chinese providers alike. Hover a card to read it.
Why it exists
Not a read-only status page — a full working deck. Three-pane inbox with one-click OTP copy. A 30-day notification log with daily summaries and masked sensitive content. A task board where you can nudge or close agent work. Identities, tokens, push tiers, and connected clients — all managed from the browser.
Pair your phone by scanning a QR code — ten seconds, no command line. Three content tiers decide how much of a message may leave the server: just a ping, masked sender + subject, or body + OTP. Tier 3 needs your explicit risk confirmation, and agents can never raise their own tier. Lost phone? One-click revoke cuts it off immediately.
Agents can send mail too — and you get the ledger. The Sent folder provides an audit ledger of outbound submissions: when, from whom, to whom, the subject, and submission status (queued or failed at SMTP relay). 30 days of history. Outbound message bodies are not retained in the send-audit store.
Built on the official SDK v2, current to the dated 2026-07-28 spec. Agents on the same box connect over stdio; cloud agents connect over stateless HTTPS with OAuth. Every authorized client is listed in the dashboard — and revocable.
Email-backed task threads with server-stamped states (submitted→working→completed/failed). Task notifications dispatch over webhooks or push for external agent activation; the dashboard shows a work-order view. A2A-vocabulary Agent Card at /.well-known/agent-card.json (email transport — not wire-protocol claim). Watch the board, page through history, nudge a stuck task or close one out — you're the dispatcher, not just the observer.
One catch-all mailbox, unlimited anything@yourdomain addresses. No provisioning and no per-inbox software fee; bounded only by your server resources.
Every identity gets its own oa_… token that can only read and send as that address. Your admin key never touches an agent.
Long-poll an inbox until the signup mail lands — codes and verification links come out parsed. Built for automated signups.
Per-identity send rate limits (20/hour default) and automatic retention (30 days default). Every message carries source: internal|external; non-internal bodies are fenced at the MCP layer. A leaked token can't become a spam cannon.
Send directly from your VPS, or route outbound through Amazon SES or any SMTP relay with one env var. Your reputation, your choice.
dns-records.sh prints your exact DNS records. doctor.sh runs a 13-point deliverability check before agents depend on it.
On the record
MCP 2026-07-28 — full dated-spec transport, local and remote
RFC 9728 — OAuth protected-resource metadata
A2A-vocabulary Agent Card — aligned with A2A v1.0 discovery format and task-state words, over email transport.
We deliberately don't claim wire-protocol compatibility.
ERC-8004 export — on the roadmap, opt-in, write-only
How it works
Deploy the Bun/Hono API and mail server with local DATA_DIR state, or connect your agent to an existing instance.
docker compose up -d The wizard prints the exact A / MX / SPF / DKIM / DMARC records to paste into your provider.
./deploy/dns-records.sh Thirteen checks: DNS, TLS, port 25, blocklists, PTR. Fix what it flags before your agents depend on it.
./deploy/doctor.sh One API call mints an address and its scoped token. Hand the token to your agent — never the admin key.
POST /v1/identities → fox-k7d2@yourdomain The agent waits on the inbox; the signup mail arrives; the OTP comes back parsed and ready to type.
mail_wait_for → otp.codes[0] POST /v1/identities — mint an address + scoped tokenGET /v1/identities — list every identity you ownPOST /v1/identities/:a/token — rotate (revoke) a tokenDELETE /v1/identities/:a — retire an identityGET /v1/identities/:a/push-tier — read an identity's push content tierPUT /v1/identities/:a/push-tier — set push tier (admin; tier 3 needs confirm)GET /v1/messages — list an inboxGET /v1/messages/:id — full mail + parsed OTPPOST /v1/messages/wait — long-poll for new mailPOST /v1/messages/:id/seen — mark read / unreadPOST /v1/send — send as any identity you ownPOST /v1/tasks — assign an email-backed task to another identityGET /v1/tasks — list task threads you can seeGET /v1/tasks/:id — read a task + stamped state historyPOST /v1/tasks/:id/state — advance a participating taskPOST /v1/notify — send a server-side notificationGET /v1/notify/messages — list recent notification historyPOST /v1/notify/verify — publish and poll a harmless self-checkPOST /v1/notify/devices — register a device for pushmail_new_identitymail_list_identitiesmail_list_messagesmail_read_messagemail_mark_seenmail_wait_formail_sendnotify_usernotify_agentnotify_checknotify_verifytask_createtask_list_childrentask_listtask_gettask_updatetask_decidetask_claimtask_renewtask_releasemail_webhook_listmail_webhook_createmail_webhook_deletemail_webhook_testmail_webhook_disableThe core trick
Agents shouldn't parse MIME. Every message comes back with codes and action links already extracted — and the raw text and HTML right there when extraction isn't enough.
Compared to the alternatives
| openagent.email | AgentMail | MailSlurp | |
|---|---|---|---|
| Open source | ✓ Apache-2.0 | ✗ | ✗ |
| Deployment | ✓ any VPS | SaaS or BYOC (Outposts on AWS) | SaaS only |
| Price | Flat VPS cost (~$5/mo) | Developer/Startup: PAYG +$2 per inbox, domain, or 1k sends; annual plans save 20% | Capped plans + metered overages |
| Unlimited inboxes | ✓ catch-all | Paid-tier limits | Paid-tier limits |
| MCP-native | ✓ | ✓ | ✓ Hosted MCP |
| OTP / link extraction | ✓ | Not independently verified | ✓ |
| Mail data residency | Your box* | SaaS: theirs; Outposts: your AWS† | Always theirs |
| Vendor control plane | None | Yes (incl. Outposts) | Yes |
| You run a server | Yes — that's the point | No (BYOC still vendor-operated) | No |
To be fair: if you never want to touch a VPS, a hosted service is genuinely easier — and AgentMail's Outposts BYOC is a real option when email content must stay in your AWS account. We still think owning the mailbox — the OTPs, the links, the reputation — with no vendor control plane is worth ten minutes of setup. Your call. Asterisk: push tiers 2/3 relay subject/from or body/OTP via ntfy — off by default. † Outposts keep email content in your AWS; AgentMail still runs dashboard, auth, billing, and upgrades.
Before you ask
Sitting idle, the whole stack — mail server, API, and background workers — sips ~190 MB of RAM and minimal CPU (measured on Debian 12, docker-mailserver + Bun API stack, September 2026).
Works with the defaults. VPS from $5/mo — or entry-level low-cost VPS deals (~$10–15/year).
Headroom to turn on spam filtering (SpamAssassin) and never think about it again.
ClamAV alone eats ~1 GB, so it ships off by default. Agent mail rarely needs it.
The real prerequisite isn't size — it's port 25. AWS, GCP, Azure, DigitalOcean and Vultr block it by default (some open it on request). Check before you buy — or route outbound through a relay like Amazon SES and skip the fight entirely.
FAQ
Yes — self-hosting is free under the Apache-2.0 license: no paid tier, no per-inbox fees (subject only to your server capacity and provider limits). The only thing you pay for is the server you run it on, and a VPS from $5/mo is enough. If you would rather not run a server, Hosted Pro Early Bird is now available for $30/year as a one-time payment — see our pricing.
AgentMail is a hosted SaaS product (usage-based pricing), with an enterprise BYOC option (Outposts) that keeps email content in your AWS account while they still run the control plane. openagent.email is Apache-2.0 software you run yourself on any VPS: unlimited inboxes on your own domain, no vendor control plane, and data paths remain under your control. Mail stays on your server unless you route outbound through external SMTP relays, configure webhooks (metadata or preview scope), or opt into push tiers 2/3 (which relay sender/subject or body/OTP via ntfy). Hosted Pro runs on managed infrastructure if you prefer not to self-host. See the full comparison at /compare.
Yes — any domain you own, about $10/year. One domain gives every agent you run its own address (agent1@yourdomain, agent2@yourdomain, …). The docs walk through the DNS records step by step.
Anything that speaks MCP — Claude Code, Cursor, Kimi Code, and friends — via the @openagentemail/mcp server, current to the dated MCP 2026-07-28 spec. Cloud agents connect over stateless HTTPS with OAuth — protected-resource metadata per RFC 9728 — or a scoped identity token, and every connected OAuth client shows up in the dashboard where you can revoke it. A plain REST API covers everything else.
Deliverability depends on your own IP and domain reputation, which the deliverability guide covers: SPF, DKIM and DMARC are set up for you, and you can relay outbound through Amazon SES if your VPS provider blocks port 25.
Yes — a full cockpit at /ui, not just a viewer. Read every agent inbox in a three-pane mail client with one-click OTP copy, review the 30-day push log with daily summaries and masked sensitive content, nudge or close agent tasks from the work-order board, manage identities, tokens, push tiers, and connected clients, pair your phone by QR code, and audit what agents sent from the Sent folder. Trust this device once, stay signed in for 30 days.
Yes. Tasks are email-backed threads between managed identities, with server-stamped states (submitted → working → completed/failed). Creating a task delivers notifications (via webhook or push) for external agent activation; the dashboard rebuilds each thread into a work-order card with participants, a timeline, and a result block. From the board you can page through history, nudge a stuck task, or close one out.
Yes — pair the ntfy app by scanning a QR code from the dashboard, after a one-time ntfy HTTPS setup covered in the phone guide. You pick how much of a message may leave the server per identity: just a ping, masked sender + subject, or body + OTP (tier 3 asks for your explicit risk confirmation, and agents can never raise their own tier). Lost phone? One click revokes it.
Safer than raw MIME with no labels. Every message carries source: internal|external — only all-domain recipients get a server HMAC stamp (X-OA-Mail-Stamp). The MCP layer fences non-internal text/html/snippet so the model sees "this is data, not instructions." That is a hygiene baseline for defense-in-depth, not an absolute guarantee against prompt injection.
Open source
The API, the MCP server, the deploy tooling — all public, all auditable. Run it on a Raspberry Pi or a fleet. Contribute back when you want to.