radmail-ai/radmail-mcp

**An email operating system for agents — with a refusal you can trust.**
Every inbox got an AI in 2026. None can be trusted to hit *send*. RadMail is the one that can — because the consequential actions are refused **in code, model-independent**: money, changed-banking details, first-contact senders, decisions, and prompt-injection are **human-only, forever**. No prompt can talk RadMail into auto-sending them.
This is the Model Context Protocol (MCP) server, so any AI agent can use the inbox.
**If a fleet of MCP agents runs your execution layer while you sit in the decision seat, the inbox is the seat that needs a hard-stop first.** It's where a socially-engineered wire or banking change is irreversible — and where an autonomous process that can hit send can be talked into the loss. RadMail lets agents do the inbox's *work* (triage, the Right Now lane, commitment tracking, drafting) while money, changed banking, first contact, decisions, and prompt-injection stay human-only **by construction, not by a policy an agent could be argued out of**. That's what makes the company inbox delegable at all.
Why it withholds the draft, not just the send
Ask this category how it keeps a person in the loop and the published answer is a draft: the agent composes, a human approves, nothing auto-sends. **For ordinary mail that is the right design, and it is exactly what RadMail does** — draft_reply returns text a person reviews and sends, and the hosted tier lists no send tool at all.
For five classes RadMail does something stricter, and the reason is the whole product: **money, changed banking, first contact, a decision, and prompt-injection get no draft at all.** On a wire-change thread a draft is not a safeguard — it is the last mile of the attack. Business email compromise does not fail at the send button; it succeeds at the approval button, by putting a plausible, well-written reply in front of a busy person who only has to say yes. Handing that person a pre-written answer makes approving *easier than reading*. So RadMail withholds the draft and hands over the message and the signals instead, and the person writes the reply.
Both halves are verifiable by execution, with no account — run these two commands and compare:
Both commands were run verbatim against the published package on **2026-10-14**. The first returns a draft plus "mcpEnforcement": "No hard-stop. Still a DRAFT — the MCP surface never sends mail." The second returns "draft": null, "hardStop": "changed-banking", and "mcpEnforcement": "HARD-STOP (changed-banking). No draft offered — human-only forever (BEC defense)." Note what the second one still gives you: the extracted commitment and the reason, taint-tagged — the withheld thing is the *proposed reply*, not the information.
The five classes are published as draftRefusalClasses in the contract, and the refusal is a one-way ratchet: it may be tightened, never loosened.
**The cost, stated plainly.** This is a worse experience on precisely the mail you most want handled for you. If a wire-change notice lands at 2am and you wanted a reply waiting, RadMail will have nothing for you to approve — by design. That trade *is* the product. If what you need is a reply ready to approve on every thread including the ones that move money, a draft-and-approve server is the right tool and this is the wrong one.
Start in one call
Call triage_inbox and **omit the token** — RadMail auto-provisions a free sandbox tenant and returns a working triage in one round-trip. Reuse the returned token. (On the zero-auth hosted sandbox, triage_inbox takes no args — it triages a built-in demo inbox so your very first call returns the full wedge.)
> This server runs the **sandbox engine** (heuristic, in-memory, free, no credentials). It is real and runnable — not the production "99%" engine.
Tools
| Tool | What it does |
|---|---|
| triage_inbox | One round-trip over a batch: the Right Now lane + every open commitment + every hard-stop. The whole wedge in one call. |
| list_right_now | The can't-miss lane only — most-recent × most-important, each with why-surfaced. Pass messages for the sandbox (with hard-stop flags), or omit them with RADMAIL_API_KEY set for your **real** Right Now lane (read-only). |
| why_surfaced | Explain in plain English why a message surfaced — the signals behind its importance × urgency. Transparency, not a black box. |
| draft_reply | Draft the reply that discharges a commitment — **never** for a hard-stopped one (money / banking / first-contact stay human-only). |