# MachineMail vs AgentMail > Both give AI agents email addresses and serve the same /v0 API. MachineMail checks every inbound message before the agent sees it. AgentMail has the broader product. Here is where each one is ahead, with a source for every claim. - Checked: 2026-11-04 - Source: https://machinemail.dev/compare/agentmail - AgentMail: https://www.agentmail.to MachineMail and AgentMail are both email APIs for AI agents. MachineMail serves AgentMail's `/v0` API, so code written for AgentMail mostly runs against it unchanged. The difference is what happens to inbound mail before your agent reads it. MachineMail computes a trust report for every message before it is stored or announced, holds suspicious mail back, and gives the agent a cleaned-up `trust.content.text` to read. AgentMail delivers first and, with an optional Labs feature, scans afterwards. Facts about AgentMail come from its public pages and docs, checked on 4 November 2026. Each one links to its source. AgentMail ships often, so check its docs for anything newer. ## In short - **Pick MachineMail** if your agents act on the mail they receive: sign-up and one-time-code flows, support inboxes, agents that reply on their own. Suspicious mail is held back before the agent sees it, on every plan. It also suits you if you want Server-Sent Events, MCP Events for delivered and bounced mail, inboxes that expire on their own, catch-all domains, agents that sign themselves up, or a custom domain on the Free plan, which AgentMail does not include. - **Pick AgentMail** if you need SOC 2 Type II, IMAP and SMTP access, a calendar API, open tracking, an official Python SDK, an EU region, or a ready-made integration with your agent framework. - **Switching** takes a base URL and an API key. The AgentMail TypeScript SDK works against MachineMail for core mail operations, and the CLI copies your pods, domains, inboxes, webhooks and lists over. The [compatibility reference](https://machinemail.dev/docs/reference/agentmail-compatibility) lists every difference. ## Side by side | | MachineMail | AgentMail | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | When inbound mail is checked | A [trust report](https://machinemail.dev/docs/trust/trust-report) is computed for every inbound message before it is stored and before any event fires. On every plan. | Agent Armor scans for prompt injection after delivery. In the default Monitor mode the message arrives and `message.received` fires as usual, then a verdict follows, usually within seconds. A Hold mode keeps `review` messages from agents until released. It is in Labs, free while there, US only, and an organization admin turns it on. [Source](https://docs.agentmail.to/agent-armor.md) | | Suspicious mail | Gets the `QUARANTINE` label instead of `INBOX` and a `message.received.quarantined` event. Lists leave it out unless you ask for it with `include_quarantine`, and search never returns it. A person reviews it in the dashboard. | In Monitor mode it stays in the inbox and the verdict (`clear`, `review` or `unavailable`) is a field your code reads. In Hold mode it gets an `agent-armor-held` label and a `message.security.review` event until an admin releases it. AgentMail says `clear` is advisory, not a guarantee. [Source](https://docs.agentmail.to/agent-armor.md) | | Text for the model | [`trust.content.text`](https://machinemail.dev/docs/trust/content) holds only the sender's new words. Quoted history, signatures, disclaimers, text hidden from human readers and invisible Unicode are removed. The raw `text` and `html` are kept as received. | No trust-annotated or cleaned text field is documented. `get_message` returns the full body. [Source](https://docs.agentmail.to/integrations/mcp.md) | | Hosted MCP server | 16 tools at `https://mcp.machinemail.dev/mcp`, built for mail an agent did not ask for: read tools return the agent-safe text inside an untrusted-content notice and leave quarantined mail out unless the raw body is asked for. [Tools](https://machinemail.dev/docs/reference/mcp-tools) | 47 tools at `https://mcp.agentmail.to/mcp`, plus 2 organization tools for OAuth sign-ins. They cover inboxes, threads, messages, drafts, attachments, calendar, lists, agent sign-up, apps and Labs. [Source](https://docs.agentmail.to/integrations/mcp.md) | | Waiting for mail in MCP | `wait_for_message` blocks for up to 60 seconds until new mail arrives: sign-up codes, magic links, confirmations. Quarantined and spam mail never wake it. | No wait tool. New mail reaches an MCP client as a `message.received` push through MCP Events. [Source](https://docs.agentmail.to/integrations/mcp.md) | | MCP Events | `message.received`, `message.delivered` and `message.bounced`, as signed Standard Webhooks pushes. Missed events replay from a cursor, up to 24 hours back. | `message.received` only, as a signed Standard Webhooks push carrying metadata, never the subject or body. [Source](https://docs.agentmail.to/integrations/mcp-events.md) | | Realtime delivery | Signed [webhooks](https://machinemail.dev/docs/concepts/webhooks) with retries over five days, a delivery log, replay and test sends. A WebSocket at `/v0/ws`. Server-Sent Events at `/v0/events/stream` that resume from `Last-Event-ID`. [Guide](https://machinemail.dev/docs/guides/realtime-events) | Webhooks signed through Svix, including polling webhooks (US only) and custom headers, and WebSockets. Server-Sent Events are not documented. [Source](https://docs.agentmail.to/webhooks-overview.md), [WebSockets](https://docs.agentmail.to/websockets.md) | | Agent self sign-up | An agent follows [auth.md](https://machinemail.dev/docs/agents/auth-md) and gets a sandbox inbox on machinemail.dev right away, with a 24-hour TTL and 10 messages a day. A person [claims it](https://machinemail.dev/docs/agents/claiming) with a six-digit code. | An agent calls `/v0/agent/sign-up`, then the attached person verifies by email with a six-digit code. Until then the agent can only email that person, 10 a day. Without a `human_email` it gets a receive-only inbox. [Source](https://docs.agentmail.to/agent-onboarding.md) | | Short-lived inboxes | Per-inbox `ttl_seconds`. New mail extends the deadline. On expiry the inbox and its mail are deleted and `inbox.expired` fires. [Inboxes](https://machinemail.dev/docs/concepts/inboxes) | An optional organization-wide 24-hour message expiry, off by default, turned on by asking AgentMail. [Source](https://docs.agentmail.to/message-expiry.md) | | Catch-all domains | Opt in per verified domain with `catch_all`. Mail to an unknown address on it creates the inbox, with `catch_all_ttl_seconds` if you want it to expire. [Domains](https://machinemail.dev/docs/concepts/domains) | Not in the docs we checked. Subdomain inboxes get a wildcard MX record, which is a different thing. [Source](https://docs.agentmail.to/knowledge-base/subdomain-inboxes.md) | | API and SDKs | Serves AgentMail's `/v0` paths and field names. The AgentMail TypeScript SDK works with a different `baseUrl` and key, for core mail operations. No SDK of its own. A [CLI](https://machinemail.dev/docs/cli). [Differences](https://machinemail.dev/docs/reference/agentmail-compatibility) | The reference API, with TypeScript and Python SDKs and a CLI. [Source](https://docs.agentmail.to/faq.md) | | Compliance and regions | No certifications. Data is stored in the US. | SOC 2 Type II, with the report on the Startup and Enterprise plans. US production, and an EU region on the Enterprise plan. [Source](https://docs.agentmail.to/documentation/resources/security-privacy/soc-2-compliance.md), [pricing](https://www.agentmail.to/pricing) | | IMAP and SMTP | Not offered. | IMAP at `imap.agentmail.to:993`, SMTP at `smtp.agentmail.to` on 465 or 587, with the API key as the password. [Source](https://docs.agentmail.to/imap-smtp.md) | | Calendar | Not offered. | Events, invitations, recurrence and an agenda, for every organization in US production since 19 October 2026. [Source](https://docs.agentmail.to/changelog.md) | | Open tracking | Not offered. `track_opens` is accepted and ignored. | `track_opens` on sends, an `opened` label and a `message.opened` event, for HTML mail from a custom domain with tracking verified. [Source](https://docs.agentmail.to/knowledge-base/open-tracking.md) | | Custom domains | One custom domain on the Free plan, 10 on Pro, 50 on Team, 250 on Scale. [Pricing](https://machinemail.dev/pricing) | None on the Free plan. 10 on Developer, 150 on Startup, custom on Enterprise, and $2 a month for an extra one. [Source](https://www.agentmail.to/pricing) | | Published pricing | Free at $0 with 3,000 messages a month, then $9, $49 and $199 a month. Inboxes are free on every plan, and Free includes a custom domain. [Pricing](https://machinemail.dev/pricing) | Free at $0 with 3 inboxes and 3,000 emails a month, Developer at $20 with 10 inboxes, Startup at $200 with 150 inboxes, Enterprise on request. Extra inboxes cost $2 a month. [Source](https://www.agentmail.to/pricing) | ## What MachineMail does differently ### A trust report before delivery Every inbound message gets a trust report before it is stored, before any webhook or event fires, and before an agent can read it. The report gives one of five levels: `verified`, `known`, `unknown`, `suspicious` or `quarantined`. It combines SPF, DKIM and DMARC alignment, prior correspondence, your allow and block lists, link and attachment checks, hidden-text detection and a classifier for spam, phishing and instructions aimed at the agent, and it lists every reason it used. There is no plan or Labs gate. See [the trust report](https://machinemail.dev/docs/trust/trust-report). ### Quarantine that agents never see Mail that tries to instruct your agent, or looks like phishing, gets the `QUARANTINE` label and a `message.received.quarantined` event. Lists and search leave it out. MCP tools withhold its content, and it never wakes `wait_for_message` or an MCP Events subscription. A person reviews it in the dashboard. ### Agent-safe text `trust.content.text` is what the model should read: the sender's new words, without quoted history, signatures, footers, text hidden from human readers or invisible Unicode. The raw `text` and `html` stay exactly as received. See [content analysis](https://machinemail.dev/docs/trust/content) and [using trust in agents](https://machinemail.dev/docs/trust/using-trust-in-agents). ### MCP built for untrusted mail The hosted MCP server has 16 tools. Read tools return the agent-safe text inside an untrusted-content notice. `wait_for_message` long-polls for up to 60 seconds, which suits sign-up and one-time-code flows. MCP Events push `message.received`, `message.delivered` and `message.bounced`, and replay what a client missed. See [MCP](https://machinemail.dev/docs/agents/mcp) and the [MCP tools](https://machinemail.dev/docs/reference/mcp-tools). ### Every realtime option Signed webhooks with retries, a delivery log, replay and test sends. A WebSocket at `/v0/ws` that speaks AgentMail's `subscribe` protocol. Server-Sent Events at `/v0/events/stream`, which resume from `Last-Event-ID`. See [realtime events](https://machinemail.dev/docs/guides/realtime-events). ### Inboxes that come and go Give an inbox a `ttl_seconds` and it deletes itself, mail and all, when nothing new arrives. Turn on `catch_all` for one of your verified domains and any address on it works, with the inbox created on first delivery. Agents can also sign themselves up through [auth.md](https://machinemail.dev/docs/agents/auth-md) and work in a sandbox until a person claims them. ## Where AgentMail is ahead These are real gaps. If one of them is a requirement for you, AgentMail is the better choice today. - **SOC 2 Type II.** AgentMail says it is SOC 2 Type II compliant, and its pricing page lists the report on the Startup and Enterprise plans. MachineMail has no compliance certifications. [Source](https://docs.agentmail.to/documentation/resources/security-privacy/soc-2-compliance.md), [pricing](https://www.agentmail.to/pricing) - **IMAP and SMTP.** Mail clients and SMTP libraries can use an AgentMail inbox directly, with the API key as the password. MachineMail has no IMAP or SMTP access. [Source](https://docs.agentmail.to/imap-smtp.md) - **Calendar.** AgentMail's calendar API left Labs on 19 October 2026: events, invitations, recurrence, an agenda, and invitations imported from mail. MachineMail has no calendar API. [Source](https://docs.agentmail.to/changelog.md) - **Open tracking.** AgentMail's API has `track_opens`, an `opened` label and a `message.opened` event. MachineMail does not track opens and ignores the field. [Source](https://docs.agentmail.to/knowledge-base/open-tracking.md) - **Official SDKs.** AgentMail publishes TypeScript and Python SDKs. MachineMail has no SDK of its own. The AgentMail TypeScript SDK is tested against MachineMail; the Python SDK is not. [Source](https://docs.agentmail.to/faq.md) - **EU region.** AgentMail offers an EU cloud on its Enterprise plan. MachineMail stores data in the US. [Source](https://www.agentmail.to/pricing) - **More MCP tools.** AgentMail's MCP server has 47 tools, including calendar, lists, apps and attachments. MachineMail's has 16. [Source](https://docs.agentmail.to/integrations/mcp.md) - **Integrations.** AgentMail documents integrations with Google ADK, LangChain, the Vercel AI SDK, the OpenAI Agents SDK, the Claude Agent SDK, OpenClaw, Replit, Vercel, LiveKit, x402, MPP and others. [Source](https://docs.agentmail.to/llms.txt) - **Polling webhooks, custom webhook headers and inbox signatures.** MachineMail has none of these. [Source](https://docs.agentmail.to/webhooks-overview.md), [changelog](https://docs.agentmail.to/changelog.md) - **Apps and accounts.** AgentMail inboxes can connect to third-party apps. MachineMail does not serve those endpoints. [Source](https://docs.agentmail.to/integrations/mcp.md) ## Switching from AgentMail Core mail operations carry over: inboxes, messages, threads, drafts, webhooks, domains, lists, pods and API keys. The full guide is [Switching from AgentMail](https://machinemail.dev/docs/getting-started/from-agentmail). 1. **Get an API key.** Sign up at [machinemail.dev/signup](https://machinemail.dev/signup) and copy the key the dashboard shows. Keys start with `mm_live_`. An agent can also register itself through [auth.md](https://machinemail.dev/auth.md). 2. **Copy your setup.** `machinemail import agentmail` reads your AgentMail organization and recreates its pods, custom domains, inboxes, webhooks and allow and block lists. Webhooks arrive disabled with new secrets. Mail and API keys are not copied. See [the import command](https://machinemail.dev/docs/cli/commands/import). 3. **Change the base URL.** In the TypeScript SDK, pass `baseUrl: 'https://api.machinemail.dev'` and the MachineMail key to `new AgentMailClient({ apiKey, baseUrl })`. Over HTTP, replace `https://api.agentmail.to` with `https://api.machinemail.dev` and send the key as `Authorization: Bearer`. 4. **Change webhook verification.** MachineMail signs webhooks with `X-MachineMail-Signature: t=,v1=`, an HMAC-SHA256 of `.` keyed with the webhook's secret. Replace your Svix check with this one. See [Verify webhook signatures](https://machinemail.dev/docs/guides/verify-webhooks). 5. **Change error handling.** Error bodies are `{"error": {"type", "message", "param"}}`, not AgentMail's `{"name", "code", "message"}`. HTTP status codes match. Read `error.type`, for example `not_found`, `validation` or `rate_limited`. See [Errors](https://machinemail.dev/docs/reference/errors). 6. **Check the differences.** Creates return `201`, not `200`. System labels are uppercase, such as `INBOX` and `UNREAD`. MCP tool names differ, and the MCP server is at `https://mcp.machinemail.dev/mcp`. Calendar, open tracking, apps, agent sign-up endpoints, polling webhooks and Agent Armor events are not available. The [compatibility reference](https://machinemail.dev/docs/reference/agentmail-compatibility) lists every difference. 7. **Read trust before acting.** Have your agent read `trust.content.text` and act on `trust.level`. Leave quarantined mail to a person. See [using trust in agents](https://machinemail.dev/docs/trust/using-trust-in-agents). ## Sources AgentMail pages, all checked on 4 November 2026: - [Pricing](https://www.agentmail.to/pricing) - [Agent Armor](https://docs.agentmail.to/agent-armor.md) - [MCP server](https://docs.agentmail.to/integrations/mcp.md) - [MCP Events](https://docs.agentmail.to/integrations/mcp-events.md) - [WebSockets](https://docs.agentmail.to/websockets.md) - [Webhooks](https://docs.agentmail.to/webhooks-overview.md) - [Agent onboarding](https://docs.agentmail.to/agent-onboarding.md) - [Message expiry](https://docs.agentmail.to/message-expiry.md) - [Subdomain inboxes](https://docs.agentmail.to/knowledge-base/subdomain-inboxes.md) - [Open tracking](https://docs.agentmail.to/knowledge-base/open-tracking.md) - [IMAP and SMTP](https://docs.agentmail.to/imap-smtp.md) - [SOC 2 compliance](https://docs.agentmail.to/documentation/resources/security-privacy/soc-2-compliance.md) - [FAQ](https://docs.agentmail.to/faq.md) - [Changelog](https://docs.agentmail.to/changelog.md) - [Docs index](https://docs.agentmail.to/llms.txt) MachineMail facts come from the [MachineMail docs](https://machinemail.dev/docs) and were checked against the code the same day.