MachineMail vs AgentMail

Both give AI agents email addresses and serve the same /v0 API. MachineMail checks every inbound message before the agent sees it. AgentMail has the broader product. Here is where each one is ahead, with a source for every claim.

MachineMail and AgentMail are both email APIs for AI agents. MachineMail serves AgentMail’s /v0 API, so code written for AgentMail mostly runs against it unchanged. The difference is what happens to inbound mail before your agent reads it. MachineMail computes a trust report for every message before it is stored or announced, holds suspicious mail back, and gives the agent a cleaned-up trust.content.text to read. AgentMail delivers first and, with an optional Labs feature, scans afterwards.

Facts about AgentMail come from its public pages and docs, checked on 4 November 2026. Each one links to its source. AgentMail ships often, so check its docs for anything newer.

In short

Pick MachineMail if your agents act on the mail they receive: sign-up and one-time-code flows, support inboxes, agents that reply on their own. Suspicious mail is held back before the agent sees it, on every plan. It also suits you if you want Server-Sent Events, MCP Events for delivered and bounced mail, inboxes that expire on their own, catch-all domains, agents that sign themselves up, or a custom domain on the Free plan, which AgentMail does not include.
Pick AgentMail if you need SOC 2 Type II, IMAP and SMTP access, a calendar API, open tracking, an official Python SDK, an EU region, or a ready-made integration with your agent framework.
Switching takes a base URL and an API key. The AgentMail TypeScript SDK works against MachineMail for core mail operations, and the CLI copies your pods, domains, inboxes, webhooks and lists over. The compatibility reference lists every difference.

Side by side

	MachineMail	AgentMail
When inbound mail is checked	A trust report is computed for every inbound message before it is stored and before any event fires. On every plan.	Agent Armor scans for prompt injection after delivery. In the default Monitor mode the message arrives and `message.received` fires as usual, then a verdict follows, usually within seconds. A Hold mode keeps `review` messages from agents until released. It is in Labs, free while there, US only, and an organization admin turns it on. Source
Suspicious mail	Gets the `QUARANTINE` label instead of `INBOX` and a `message.received.quarantined` event. Lists leave it out unless you ask for it with `include_quarantine`, and search never returns it. A person reviews it in the dashboard.	In Monitor mode it stays in the inbox and the verdict (`clear`, `review` or `unavailable`) is a field your code reads. In Hold mode it gets an `agent-armor-held` label and a `message.security.review` event until an admin releases it. AgentMail says `clear` is advisory, not a guarantee. Source
Text for the model	`trust.content.text` holds only the sender’s new words. Quoted history, signatures, disclaimers, text hidden from human readers and invisible Unicode are removed. The raw `text` and `html` are kept as received.	No trust-annotated or cleaned text field is documented. `get_message` returns the full body. Source
Hosted MCP server	16 tools at `https://mcp.machinemail.dev/mcp`, built for mail an agent did not ask for: read tools return the agent-safe text inside an untrusted-content notice and leave quarantined mail out unless the raw body is asked for. Tools	47 tools at `https://mcp.agentmail.to/mcp`, plus 2 organization tools for OAuth sign-ins. They cover inboxes, threads, messages, drafts, attachments, calendar, lists, agent sign-up, apps and Labs. Source
Waiting for mail in MCP	`wait_for_message` blocks for up to 60 seconds until new mail arrives: sign-up codes, magic links, confirmations. Quarantined and spam mail never wake it.	No wait tool. New mail reaches an MCP client as a `message.received` push through MCP Events. Source
MCP Events	`message.received`, `message.delivered` and `message.bounced`, as signed Standard Webhooks pushes. Missed events replay from a cursor, up to 24 hours back.	`message.received` only, as a signed Standard Webhooks push carrying metadata, never the subject or body. Source
Realtime delivery	Signed webhooks with retries over five days, a delivery log, replay and test sends. A WebSocket at `/v0/ws`. Server-Sent Events at `/v0/events/stream` that resume from `Last-Event-ID`. Guide	Webhooks signed through Svix, including polling webhooks (US only) and custom headers, and WebSockets. Server-Sent Events are not documented. Source, WebSockets
Agent self sign-up	An agent follows auth.md and gets a sandbox inbox on machinemail.dev right away, with a 24-hour TTL and 10 messages a day. A person claims it with a six-digit code.	An agent calls `/v0/agent/sign-up`, then the attached person verifies by email with a six-digit code. Until then the agent can only email that person, 10 a day. Without a `human_email` it gets a receive-only inbox. Source
Short-lived inboxes	Per-inbox `ttl_seconds`. New mail extends the deadline. On expiry the inbox and its mail are deleted and `inbox.expired` fires. Inboxes	An optional organization-wide 24-hour message expiry, off by default, turned on by asking AgentMail. Source
Catch-all domains	Opt in per verified domain with `catch_all`. Mail to an unknown address on it creates the inbox, with `catch_all_ttl_seconds` if you want it to expire. Domains	Not in the docs we checked. Subdomain inboxes get a wildcard MX record, which is a different thing. Source
API and SDKs	Serves AgentMail’s `/v0` paths and field names. The AgentMail TypeScript SDK works with a different `baseUrl` and key, for core mail operations. No SDK of its own. A CLI. Differences	The reference API, with TypeScript and Python SDKs and a CLI. Source
Compliance and regions	No certifications. Data is stored in the US.	SOC 2 Type II, with the report on the Startup and Enterprise plans. US production, and an EU region on the Enterprise plan. Source, pricing
IMAP and SMTP	Not offered.	IMAP at `imap.agentmail.to:993`, SMTP at `smtp.agentmail.to` on 465 or 587, with the API key as the password. Source
Calendar	Not offered.	Events, invitations, recurrence and an agenda, for every organization in US production since 19 October 2026. Source
Open tracking	Not offered. `track_opens` is accepted and ignored.	`track_opens` on sends, an `opened` label and a `message.opened` event, for HTML mail from a custom domain with tracking verified. Source
Custom domains	One custom domain on the Free plan, 10 on Pro, 50 on Team, 250 on Scale. Pricing	None on the Free plan. 10 on Developer, 150 on Startup, custom on Enterprise, and $2 a month for an extra one. Source
Published pricing	Free at $0 with 3,000 messages a month, then $9, $49 and $199 a month. Inboxes are free on every plan, and Free includes a custom domain. Pricing	Free at $0 with 3 inboxes and 3,000 emails a month, Developer at $20 with 10 inboxes, Startup at $200 with 150 inboxes, Enterprise on request. Extra inboxes cost $2 a month. Source

What MachineMail does differently

A trust report before delivery

Every inbound message gets a trust report before it is stored, before any webhook or event fires, and before an agent can read it. The report gives one of five levels: verified, known, unknown, suspicious or quarantined. It combines SPF, DKIM and DMARC alignment, prior correspondence, your allow and block lists, link and attachment checks, hidden-text detection and a classifier for spam, phishing and instructions aimed at the agent, and it lists every reason it used. There is no plan or Labs gate. See the trust report.

Quarantine that agents never see

Mail that tries to instruct your agent, or looks like phishing, gets the QUARANTINE label and a message.received.quarantined event. Lists and search leave it out. MCP tools withhold its content, and it never wakes wait_for_message or an MCP Events subscription. A person reviews it in the dashboard.

Agent-safe text

trust.content.text is what the model should read: the sender’s new words, without quoted history, signatures, footers, text hidden from human readers or invisible Unicode. The raw text and html stay exactly as received. See content analysis and using trust in agents.

MCP built for untrusted mail

The hosted MCP server has 16 tools. Read tools return the agent-safe text inside an untrusted-content notice. wait_for_message long-polls for up to 60 seconds, which suits sign-up and one-time-code flows. MCP Events push message.received, message.delivered and message.bounced, and replay what a client missed. See MCP and the MCP tools.

Every realtime option

Signed webhooks with retries, a delivery log, replay and test sends. A WebSocket at /v0/ws that speaks AgentMail’s subscribe protocol. Server-Sent Events at /v0/events/stream, which resume from Last-Event-ID. See realtime events.

Inboxes that come and go

Give an inbox a ttl_seconds and it deletes itself, mail and all, when nothing new arrives. Turn on catch_all for one of your verified domains and any address on it works, with the inbox created on first delivery. Agents can also sign themselves up through auth.md and work in a sandbox until a person claims them.

Where AgentMail is ahead

These are real gaps. If one of them is a requirement for you, AgentMail is the better choice today.

SOC 2 Type II. AgentMail says it is SOC 2 Type II compliant, and its pricing page lists the report on the Startup and Enterprise plans. MachineMail has no compliance certifications. Source, pricing
IMAP and SMTP. Mail clients and SMTP libraries can use an AgentMail inbox directly, with the API key as the password. MachineMail has no IMAP or SMTP access. Source
Calendar. AgentMail’s calendar API left Labs on 19 October 2026: events, invitations, recurrence, an agenda, and invitations imported from mail. MachineMail has no calendar API. Source
Open tracking. AgentMail’s API has track_opens, an opened label and a message.opened event. MachineMail does not track opens and ignores the field. Source
Official SDKs. AgentMail publishes TypeScript and Python SDKs. MachineMail has no SDK of its own. The AgentMail TypeScript SDK is tested against MachineMail; the Python SDK is not. Source
EU region. AgentMail offers an EU cloud on its Enterprise plan. MachineMail stores data in the US. Source
More MCP tools. AgentMail’s MCP server has 47 tools, including calendar, lists, apps and attachments. MachineMail’s has 16. Source
Integrations. AgentMail documents integrations with Google ADK, LangChain, the Vercel AI SDK, the OpenAI Agents SDK, the Claude Agent SDK, OpenClaw, Replit, Vercel, LiveKit, x402, MPP and others. Source
Polling webhooks, custom webhook headers and inbox signatures. MachineMail has none of these. Source, changelog
Apps and accounts. AgentMail inboxes can connect to third-party apps. MachineMail does not serve those endpoints. Source

Switching from AgentMail

Core mail operations carry over: inboxes, messages, threads, drafts, webhooks, domains, lists, pods and API keys. The full guide is Switching from AgentMail.

Get an API key. Sign up at machinemail.dev/signup and copy the key the dashboard shows. Keys start with mm_live_. An agent can also register itself through auth.md.
Copy your setup. machinemail import agentmail reads your AgentMail organization and recreates its pods, custom domains, inboxes, webhooks and allow and block lists. Webhooks arrive disabled with new secrets. Mail and API keys are not copied. See the import command.
Change the base URL. In the TypeScript SDK, pass baseUrl: 'https://api.machinemail.dev' and the MachineMail key to new AgentMailClient({ apiKey, baseUrl }). Over HTTP, replace https://api.agentmail.to with https://api.machinemail.dev and send the key as Authorization: Bearer.
Change webhook verification. MachineMail signs webhooks with X-MachineMail-Signature: t=<unix>,v1=<hex>, an HMAC-SHA256 of <t>.<raw body> keyed with the webhook’s secret. Replace your Svix check with this one. See Verify webhook signatures.
Change error handling. Error bodies are {"error": {"type", "message", "param"}}, not AgentMail’s {"name", "code", "message"}. HTTP status codes match. Read error.type, for example not_found, validation or rate_limited. See Errors.
Check the differences. Creates return 201, not 200. System labels are uppercase, such as INBOX and UNREAD. MCP tool names differ, and the MCP server is at https://mcp.machinemail.dev/mcp. Calendar, open tracking, apps, agent sign-up endpoints, polling webhooks and Agent Armor events are not available. The compatibility reference lists every difference.
Read trust before acting. Have your agent read trust.content.text and act on trust.level. Leave quarantined mail to a person. See using trust in agents.

Sources

AgentMail pages, all checked on 4 November 2026:

MachineMail facts come from the MachineMail docs and were checked against the code the same day.