Mailcycle
Gives an AI agent its own email addresses: read, wait for and reply to mail, sign-up codes and attachments. Mail is decrypted only on the agent's machine.
Documentation
AI agents
An inbox for your agent, sealed on arrival.
Give an AI agent its own email address. It waits for mail, reads it and replies through MCP, and decrypts on the machine it runs on. Mailcycle stores the same sealed mail it always does.
On Scale and above · Works with any MCP client · Reply-only by default
Setting it up? The email MCP server has every tool, input and client config.
How it works
Two commands and a paste.
An agent is a paired device without a screen. Run one command where the agent lives, paste the line it prints into the app, give the agent an address, and plug it into your MCP client.
The line carries the secret the agent's address keys are sealed with. It goes from your terminal to the app and never through Mailcycle, so handing the agent its keys is end to end.
1. On the agent's machine
npx -y mailcycle-mcp pair
# In the Mailcycle app, open AI agents and paste this line:
MC1:48151623:qR7…
2. Plug it into your agent
Claude Code setup
claude mcp add mailcycle -- npx -y mailcycle-mcp
Adds the server to Claude Code on this machine.
Also listed on Smithery and the MCP Registry.
What agents do with it
Email is how the rest of the internet talks back.
Sign-ups, confirmations, receipts and replies all arrive by email. An agent with its own inbox can take part.
Catch the code
Your agent signs up for a tool it needs, waits for the verification email, and reads the code or link out of it. No forwarding rules, no shared inbox.
Answer the mail
Point a support or booking address at an agent. It reads what arrives and replies to the sender, threaded, from the address they wrote to.
Work the paperwork
Receipts, invoices, delivery notices and alerts land in the agent's inbox, and the agent reads them into whatever it is building.
Keep it separate
The agent gets its own addresses and keys for those alone. Your own mail, and every other address on the account, stays out of its reach.
Tools
Seven MCP tools.
They work in Claude and in any other client that speaks MCP.
wait_for_message
Waits for new mail, by sender or subject, and returns it in full.
read_message
One message in full, marked as the sender's words so the model treats it as information.
read_attachment
Opens a file from a message. Text and images come back directly; anything else is saved to a folder on the agent's machine.
reply
Answers the sender from the address they wrote to, threaded under their message, with files attached if needed.
send_message
A new message, with files if needed, when you let the agent send to anyone.
list_messages
The newest mail on the agent's addresses, with a preview of each.
list_addresses
The agent's addresses and what it is allowed to send.
Sending
Reply only, until you say otherwise.
Mail an agent reads can carry instructions from whoever sent it. Every agent starts able only to answer the person who wrote, so the most a bad message can get is a reply to itself.
Reply only
Where every agent starts. It can answer whoever wrote to it, and no one else.
Send to anyone
Any address, up to 20 messages an hour per agent, more on Fleet and Enterprise.
Read only
The agent reads and can't send.
- Only you, signed in to the app, can change an agent's send mode. An API key can't.
- Give an agent a sender name in the app, like "Support at Acme", and its mail goes out under that name.
- Agents send from the addresses you give them, on a shared domain or one you bring, within your plan's daily limit.
- To check a reply, we keep a one-way fingerprint of the addresses a message to your agent can be answered at, deleted with the message. Not a list of who writes to your agent.
What sees what
Where your agent's mail goes.
Mailcycle
Stores the agent's mail sealed to keys we don't have. Mail the agent sends passes through in plain text, as all sent mail does, and the copy kept in Sent is sealed like the rest.
The agent's machine
Holds the agent's key in a file only your user can read, and decrypts there. Remove the agent in the app to cut it off.
Your model provider
Sees whatever the agent reads. It is your choice, not our subprocessor. Choose one you would trust with that mail.
On Scale and above. Scale also lets API keys send mail. See pricing and the security overview.
Questions
About AI agents.
Which agents does it work with?
Anything that speaks MCP: Claude Code, Claude Desktop, and other MCP clients and agent frameworks. The server runs on Node 20 or later, on the same machine as the agent.
Can Mailcycle read my agent's mail?
No. Mail is sealed to the address's key as it arrives, and the agent's copy of that key reaches it sealed with a secret that never passes through us. The agent decrypts on its own machine. Mail the agent sends leaves as plain text so the recipient's server can read it. The copy in its Sent folder is sealed to the address's key.
Who else sees the mail?
Whichever model provider your agent uses sees what the agent reads, because the agent passes it to the model. That provider is your choice, not ours. Choose one you would trust with that mail.
What stops a malicious email taking over my agent?
Three things. The agent starts reply-only, so the most a bad message can get is a reply to its own sender. Message bodies reach the model marked as the sender's words, not instructions. And each agent can send at most 20 messages an hour (more on Fleet and Enterprise), only from the addresses you give it. Only you, signed in to the app, can widen what an agent may send.
What does it cost?
Agents are included on Scale ($19 a month) and above, and are not billed on their own. An agent's addresses count toward your plan like any others.
Can I run more than one agent?
Yes. Each agent is paired separately, gets its own addresses and send mode, and can be disabled or removed on its own. On one machine, point each at its own key file with MAILCYCLE_AGENT_FILE.
Can an agent sign up for accounts in bulk?
No. An agent is held to the same Acceptable Use Policy as everything else on Mailcycle, which rules out registering accounts on other services at scale or against their terms.
Give your agent an address.
Start on Scale, connect an agent in a couple of minutes, and keep the mail sealed with a key we never hold.