An inbox your agent can read. We can't.
Give an AI agent its own email address. It waits for mail, reads it and replies through MCP, and decrypts on the machine it runs on. Mailcycle stores the same sealed mail it always does.
On Scale and above · Works with any MCP client · Reply-only by default
Two commands and a paste.
An agent is a paired device without a screen. Run one command where the agent lives, paste the line it prints into the app, give the agent an address, and plug it into your MCP client.
The line carries the secret the agent's address keys are sealed with. It goes from your terminal to the app and never through Mailcycle, so handing the agent its keys is end to end.
Email is how the rest of the internet talks back.
Sign-ups, confirmations, receipts and replies all arrive by email. An agent with its own inbox can take part.
Catch the code
Your agent signs up for a tool it needs, waits for the verification email, and reads the code or link out of it. No forwarding rules, no shared inbox.
Answer the mail
Point a support or booking address at an agent. It reads what arrives and replies to the sender, threaded, from the address they wrote to.
Work the paperwork
Receipts, invoices, delivery notices and alerts land in the agent's inbox, and the agent reads them into whatever it is building.
Keep it separate
The agent gets its own addresses and keys for those alone. Your own mail, and every other address on the account, stays out of its reach.
Six MCP tools.
They work in Claude and in any other client that speaks MCP.
wait_for_message
Waits for new mail, by sender or subject, and returns it in full.
read_message
One message in full, marked as the sender's words so the model treats it as information.
reply
Answers the sender from the address they wrote to, threaded under their message.
send_message
A new message, when you let the agent send to anyone.
list_messages
The newest mail on the agent's addresses, with a preview of each.
list_addresses
The agent's addresses and what it is allowed to send.
Reply only, until you say otherwise.
Mail an agent reads can carry instructions from whoever sent it. Every agent starts able only to answer the person who wrote, so the most a bad message can get is a reply to itself.
Reply only
Where every agent starts. It can answer whoever wrote to it, and no one else.
Send to anyone
Any address, up to 20 messages an hour per agent.
Read only
The agent reads and can't send.
- Only you, signed in to the app, can change an agent's send mode. An API key can't.
- Agents send from Scale domains or a domain you bring, never from the domains free accounts share.
- To check a reply, we keep a hash of the addresses a message to an agent can be answered at, salted with the message id and deleted with it. Not a list of who writes to your agent.
Where your agent's mail goes.
Mailcycle
Stores the agent's mail sealed to keys we don't have. Mail the agent sends passes through in plain text and isn't stored, as all sent mail does.
The agent's machine
Holds the agent's key in a file only your user can read, and decrypts there. Remove the agent in the app to cut it off.
Your model provider
Sees whatever the agent reads. It is your choice, not our subprocessor. Choose one you would trust with that mail.
On Scale and above. Scale also lets API keys and your devices send mail. See pricing and the security overview.