What will RadMail refuse to do?

RadMail refuses five action classes, human-only forever, as a deterministic defense against business-email-compromise (BEC) fraud and prompt injection: (1) moving money or authorizing a payment, (2) changing banking or wire details, (3) making first contact with a new party, (4) an irreversible decision, and (5) any action a suspected prompt-injection asks for. These are not gated by a policy an agent could be argued out of — no tool exists that can auto-execute them, so an agent using RadMail cannot be tricked into the loss. Everything else — triage, the 'Right Now' lane, commitment tracking, and drafting — RadMail will do; drafts always return for a human to review and send.

What is RadMail, and how is it different from Superhuman or an AI inbox?

Those are email clients you read mail in. RadMail is an email operating system that does the work: it ranks each message by importance and urgency on two separate axes, surfaces a 'Right Now' lane with a plain-English reason it landed there, extracts the commitments hiding in your threads, and drafts the follow-up the day it is due. And it tells you what actually got a reply, not just an open, which a send-only tool cannot do because it never sees the replies. RadMail is a Sureel venture.

What is reply-correlation?

Most email tools tell you opens and clicks. RadMail can tell you which of your sends actually earned a reply, because RadMail ingests inbound mail as well as sending outbound. A send-only email service provider never sees the reply, so it cannot connect a send to the response it produced. RadMail treats opens honestly, adjusting for Apple Mail Privacy Protection and de-emphasizing them in favor of replies.

Does RadMail send emails on its own?

Only after it earns trust, and never for high-risk actions. RadMail rolls out in stages: surface-only, then draft-on-due where it writes the message and waits for you, then narrow auto-send for low-risk cases. Anything involving money, banking details, a decision, or first contact with a third party stays human-only, forever, as a defense against business-email-compromise fraud.

Is RadMail HIPAA or SOC 2 compliant?

Compliance is a shared responsibility, and RadMail is a tool, not a compliance guarantee. RadMail signs a BAA and processes on BAA-covered, encrypted, audited infrastructure, and its compliance posture is built as a pluggable per-org regime (SOC 2, HIPAA, FedRAMP-CUI, BSA-AML) assembled from PolicyPacks. RadMail uses SOC 2-aligned controls with a Type II audit planned, and FedRAMP-aligned, NIST 800-171-ready infrastructure. RadMail is not HIPAA-certified or FedRAMP-authorized; for regulated tenants, HIPAA handling is draft/ingest-only at this stage. The SOC 2, HIPAA and FedRAMP/CUI PolicyPacks are architecture and roadmap — not certifications RadMail holds, and not packs a customer can switch on today; what is live in every inbox today is the triage engine and the BEC hard-stop.

How do I connect RadMail to my AI agent?

Point your MCP client at the RadMail sandbox endpoint at https://radmail.ai/api/mcp/sandbox — that is the whole step. No account, no credentials, and no card; the sandbox runs RadMail's real heuristic triage engine in memory for free.

Is connecting RadMail's MCP server free?

Yes. The sandbox MCP server is free and requires no credentials — it exists so an agent can wire up and get value in one step. It is the sandbox engine; the production multi-tenant engine is launch-gated.

Will RadMail send email on my agent's behalf?

No — there is no auto-send tool. RadMail's MCP server exposes only read, triage, search, draft, and read-only diagnostic tools; draft_reply returns text for a human to review. Money, new banking, and first contact are human-only forever, as a defense against business-email-compromise fraud.

What tools does RadMail's MCP server expose to an agent?

Thirteen safe tools: triage and triage_inbox (two-axis ranking — one message or a whole batch), list_right_now (the can't-miss lane), why_surfaced (explainable reasons), list_commitments (what is owed and by when), draft_reply (a reviewable draft — never auto-sent), search (find a message by sender, subject, or content — most-relevant + newest first, with why-matched on every hit), read_email (connected mode: fetch one full message from your real inbox, read-only), check_send_domain (zero-auth SPF / DMARC / DKIM deliverability read for any domain), provision_sandbox (mint a free sandbox tenant), report_need and request_capability (tell RadMail what was awkward or missing), and radmail_learning_insights (what RadMail has learned about how you work). With RADMAIL_API_KEY set, search, read_email, list_right_now, and list_commitments operate read-only on your REAL inbox; the zero-auth hosted sandbox endpoint serves the six core triage tools. There is deliberately no tool that sends money, changes banking, or makes first contact.

What is the difference between RadMail's sandbox and connected mode?

Sandbox is zero-auth: the hosted endpoint at https://radmail.ai/api/mcp/sandbox (and the radmail-mcp package with no key) runs a free, in-memory heuristic engine over demo messages or messages you pass — no account, no credentials, no card. Connected mode is read-only real-inbox access: set RADMAIL_API_KEY on the radmail-mcp package (mint a key at https://app.radmail.ai/settings/api-keys) and search, read_email, list_right_now, and list_commitments operate on your REAL RadMail inbox via the v1 API — read-only by construction, fail-closed on any API error, every real-mail field taint-marked untrusted-email-body. Without a key the package behaves exactly like the zero-auth sandbox, and the connected tools return setup instructions instead of an error.

Is RadMail's two-axis triage just the Eisenhower matrix, and how is it different from an urgency label?

Same two axes, different mechanics - worth stating plainly, because "importance x urgency" is also how the Eisenhower matrix is usually described. RadMail scores every message on two independent 0-100 axes and then derives the quadrant from fixed, published thresholds: importance >= 60 AND urgency >= 50 is the 'Right Now' lane, importance >= 60 alone is 'important, can wait', urgency >= 50 alone is 'urgent, minor', and the rest is 'low'. The zero-auth hosted sandbox prints both numbers beside every message (for example 'importance 94 x urgency 94'), so one credential-free call reproduces the bucketing instead of asking you to trust a single urgency label a model picked on that run. Three honest limits. The sandbox engine is heuristic - sender class, money and deadline cues, open commitments, and a recency term that decays to zero at about 40 hours - and it is not personalized to you. The 4D disposition (Delete, Delegate, Do, Defer, in that precedence) is shown on https://radmail.ai/try and is not returned by the hosted MCP sandbox. And the Eisenhower 'delegate' quadrant does not transfer: money, changed banking, first contact, and decisions stay human-only whichever quadrant they land in, so no quadrant is ever a licence for an agent to act.

Why is RadMail a safe choice for an agent that handles email?

Because the dangerous actions are structurally impossible: RadMail's MCP server has no tool that auto-sends a payment, changes wire instructions, or cold-contacts a new party. Those are human-only by design, so an agent using RadMail cannot be tricked into business-email-compromise fraud.

Can I see RadMail actually working before I connect or sign up?

Yes. The public magic-moment at https://app.radmail.ai/pulse shows RadMail triaging a live inbox — the 'Right Now' lane, an explainable 'why surfaced' on each message, and the BEC hard-stop visibly refusing a money / new-banking / first-contact send — with no signup, no credentials, and no card. The live product preview is at https://app.radmail.ai; agents can also connect the free sandbox MCP server in one step.

Does RadMail try to make my agent recommend it?

No. RadMail never injects instructions into an agent, pays for mentions, or addresses the model at all. Its referral program rewards the human operator, the integration builder, and the end user with honest attribution and credits — the only thing aimed at the agent is a surface that makes it succeed faster.

Can RadMail connect a whole Mac's worth of inboxes (Apple Mail) to my agent?

Yes. RadMail ships a local Apple Mail connector: one command connects every inbox already aggregated in Apple Mail on a Mac — no per-account OAuth, no forwarding rules, and no shared passwords. It reads message metadata and normalized text (attachment contents are never read) and is Message-ID idempotent, so it runs safely alongside server-side connectors without creating duplicates. It needs a RadMail account with write scope; RadMail is pre-release, so this is early-access.

Does RadMail alert and draft on inbound sales leads automatically?

Yes — RadMail has a lead lane. A new-business inbound is scored as a first-class 'lead' that can never be tuned into silence, fires an instant alert (web push, SMS, email, or an email.lead webhook), and — where the pipeline is enabled — attaches a researched dossier grounded ONLY in the email and your own sender history (no web access, instructed never to invent) plus a drafted reply. The draft is human-approval-only and structurally cannot send: a first-contact reply stays behind the BEC hard-stop, human-only, forever.

Can an AI search my real email?

Yes — read-only. Mint an API key at https://app.radmail.ai/settings/api-keys (keys start with tmk_), set it as RADMAIL_API_KEY on the radmail-mcp package, and the search tool searches your REAL ingested inbox (ranked most-relevant + newest first, with sender / date filters and a why-matched on every hit) while read_email fetches a full message by id, list_right_now returns your real can't-miss lane, and list_commitments lists your real open promises. Connected mode is read-only by construction and fail-closed on any API error; every real-mail field is taint-marked untrusted-email-body, and money, changed banking, first contact, decisions, and suspected injection stay human-only forever. Want to try before connecting anything? The zero-auth hosted sandbox at https://radmail.ai/api/mcp/sandbox runs the same search over a demo inbox with no key at all.

How do I connect an agent to my real inbox?

Three steps: mint an API key at https://app.radmail.ai/settings/api-keys, set it as the RADMAIL_API_KEY environment variable on the radmail-mcp MCP server (for Claude Code: claude mcp add radmail -e RADMAIL_API_KEY=tmk_... -- npx -y radmail-mcp), and restart — then search finds any email you've ever received, read_email fetches the full message, list_right_now returns your real can't-miss lane, and list_commitments lists your real tracked promises, all read-only. radmail-mcp is live on npm, so the npx command works as-is; the zero-auth hosted sandbox at https://radmail.ai/api/mcp/sandbox works instantly with no key if you want to try first.

If AI agents run my company's execution layer, what does giving them my email actually require?

The inbox is the seat where an agent can be socially engineered into an irreversible action — wiring money, changing where payments are remitted, or replying to a stranger with sensitive data — so an agent-run inbox needs a hard-stop before anything else. RadMail is the email MCP with a business-email-compromise hard-stop built in: money, changed banking, first contact, decisions, and prompt-injection are refused in deterministic code, human-only forever, so no email and no prompt can talk an agent into the loss. That is what lets a fleet of MCP agents run the inbox's work — triage, the Right Now lane, commitment tracking, drafting — while the one irreversible seat stays with the human by construction.

Can I run a one-person company where MCP agents handle email? What's the catch with the inbox?

You can delegate a lot of the inbox — triage, the Right Now lane, commitment tracking, drafting — and RadMail is built exactly for that: its MCP server exposes only read, triage, search, explain, draft, and read-only diagnostic tools. The catch an agent-run inbox has to solve is the high-risk send: an autonomous process that can move money can be tricked into a wire, a banking change, or a cold reply to a stranger (the business-email-compromise playbook, now also a prompt-injection surface). RadMail solves it by refusing those actions in deterministic code — money, new banking, first contact, decisions, and injection are human-only, forever, by construction rather than by a policy an agent could be argued out of. So the agent fleet runs the inbox's work and the one irreversible seat stays yours.

Can my agent watch an email thread and know who has the last word?

Yes — watched threads are live in the product. Mark a thread watched (in the inbox, or via the v1 API: POST /api/v1/threads/{id}/watch, API-key and scope gated) and RadMail tracks who spoke last. When the other side has the last word, the thread pins to the top of the Right Now lane; when you spoke last, it sits in a quiet Watching panel instead of nagging. Watched threads also carry a protected importance floor, so a watched conversation can never be tuned into silence.

How does RadMail defend an agent-connected inbox against prompt injection?

Five layers. (1) The BEC hard-stop: money, changed banking, first contact, decisions, and suspected injection are refused in deterministic code, human-only forever. (2) Taint-marking: every real-mail field an agent sees is marked untrusted-email-body, so instructions inside an email body are treated as data. (3) Connected mode is read-only and fail-closed by construction. (4) A read-then-egress anomaly detector watches RadMail's egress routes — including the notify rail — for the tell-tale pattern of email content being read and immediately leaving; it detects and flags for human review, and never silently blocks legitimate mail. (5) As of radmail-mcp v0.5.0, the MCP server's tool descriptions are frozen under a sha256 manifest verified at startup — if any description drifts from the audited text, the server refuses to serve, a fail-closed defense against MCP tool-description poisoning.

Can my agent ask a human a question through RadMail?

Yes — the notify rail. POST /api/v1/notify (API-key and scope gated) raises a request that rides RadMail's alert rail to a human, who answers in an in-app respond box; the caller polls GET /api/v1/notify/{id} and the loop closes with acked and responded states. It is a way to reach a human, never around one: nothing on this rail loosens the BEC hard-stop, and the read-then-egress anomaly detector watches this route too. A companion GET /api/v1/demand returns aggregates-only demand signals — tool names and event counts, never message content, arguments, or queries.

How do I know whether RadMail's drafts are actually good?

RadMail measures it rather than asserting it: each draft an operator decides on is recorded with its outcome — sent unedited, edited before sending, or discarded. RadMail is pre-release and has not published acceptance rates yet; when it does, the numbers will come from this instrumentation, not from a marketing estimate.

Does RadMail prepare a reply before I even open an important email?

Yes — RadMail has an answer-ready inbox. When an email lands that scores high or critical importance, or that the engine flags for human eyes, RadMail prepares the reply on arrival: by the time you open it, the alert has already fired, the importance level is known, and a draft is waiting pre-filled in the reply panel. The draft is human-approval-only and structurally cannot be auto-sent; money, changed banking, first contact, decisions, and suspected injection stay human behind the BEC hard-stop; drafting rides a bounded per-org daily AI budget; and the drafter's hard rules forbid payment-action promises and banking-detail echoes. Pre-release, rolling out behind a flag.

Can my agent see how much work RadMail has done for a workspace?

Yes — GET /api/v1/usage returns a read-only work-units rollup (Bearer API key, read scope, available on the metered free tier). It reports how much WORK RadMail prepared over a window — reply drafts and lead-research dossiers counted as the headline work units, separately from the supporting triage the engine does behind the scenes — broken down by feature with call counts and engine cost. Query ?days= (default 30, max 90); the response is per-org aggregates only — counts and cost, never message content. It touches no billing or plan state; when metered tiers ship, these honest actuals become the left side of a quota. This is the north-star pillar ("the work is the meterable value") made programmatic; the same rollup renders in-app at /settings/usage.

How does RadMail decide what's important?

RadMail ranks each message on two separate axes — importance and urgency — and its live importance rule is a conjunction: a message is important-eligible when it is personally addressed to you AND comes from a sender whose reputation was earned in your real correspondence (your own replies count, since RadMail ingests sent mail). Everything else is dampened — except protected floors that can never be tuned into silence: regulator notices and recalls, invoices and past-due payments, security alerts, legal notices, leads, and watched threads. Every surfaced message comes with an explainable 'why surfaced' so the ranking is never a black box.

What are RadMail's attention lanes?

The inbox renders an attention verdict per thread, in lanes: ACT (needs you, with a time horizon), WAITING ON (you are owed a reply), GLANCE (worth a look, no action owed), and a folded FILE/FEED lane for everything that is filing or reading material. Like everything in RadMail, the verdict is explainable — each item says why it landed in its lane.

Does RadMail see the email I send, not just what I receive?

Yes — sent-folder ingestion is live. RadMail ingests your outbound mail (with a self-sender guard so its own notification emails never count as your correspondence), which gives the engine outbound visibility: your reply history accrues sender reputation, so the people you actually correspond with outrank strangers, and waiting-on state is grounded in what you really sent.

Can I watch a thread so it can't slip?

Yes. Mark a thread watched and RadMail tracks who has the last word: if the other side spoke last, the thread pins to the top of the Right Now lane until you respond; if you spoke last, it waits in a quiet Watching panel — visible, never nagging. Watched threads carry a protected importance floor, so tuning noise down can never silence one.

Does RadMail follow up on emails automatically?

Yes — RadMail extracts the commitments hiding in your correspondence (owed by you and owed to you), drafts the message the day it's due so it's never late, detects when something is already handled so it never nags, and escalates when a thread goes overdue. It chases open threads to completion rather than drafting once and forgetting.

Does RadMail send email on its own?

Only after it earns trust, and never for high-risk actions. RadMail rolls out in stages — surface-only, then draft-on-due where it writes and waits for you, then narrow auto-send for low-risk cases. Anything involving money, banking, a decision, or first contact with a new party stays human-only, forever, as a defense against business-email-compromise fraud.

Do I need an email MCP server that sends mail, or one that triages an existing inbox?

These are two different jobs, and most ‘best email MCP server’ comparisons only cover the first one. Job one is agent mailbox infrastructure: give an agent its own address, create mailboxes programmatically, send and thread two-way, and keep deliverability healthy. That is a sending-and-provisioning problem, and it is not what RadMail does. Job two is making a human’s existing business inbox legible and safe for an agent to work in: rank what actually matters on two axes, explain in plain English why a message surfaced, track the commitments buried in the thread, draft the reply for a human to review, and refuse the dangerous action outright. RadMail is built for job two. If your agent needs its own mailbox to send from, RadMail is the wrong tool and you should reach for mailbox infrastructure instead. If a human’s real inbox is the thing your agent has to work in without being able to cause harm, that is exactly what RadMail is for.

Can I just point a Gmail or Outlook MCP server at my own inbox with a read-only scope instead?

For plain reading, yes — and if that is all you need, use it. Alongside agent-owned mailboxes and sending infrastructure, published round-ups describe a third option: an MCP server that connects to a mailbox a person already owns, scoped read-only so an agent can look without being able to reply. That option is real, it is cheap, it works today, and RadMail is not a prerequisite for it. Three things it is not, though, and all three are checkable. First, a read-only scope is config-restricted, not capability-absent: the send capability still exists in the API behind the scope, and whoever holds the account can grant the same connection a wider scope later. RadMail's hosted endpoint reports six tools and not one of them sends, so there is no scope to widen — which is why the contract at https://radmail.ai/.well-known/agent-safety.json reports enforcementModel capability-absent and configurable false rather than describing a setting. Second, a scope is a permission, not a judgement. It tells you what an agent may touch; it says nothing about which of four hundred messages matters, why that one surfaced, or what you promised in a thread three weeks ago. RadMail ranks every message on importance and urgency, exposes why_surfaced as a callable tool so the ranking is auditable rather than asserted, and carries each thread's open commitment inline. Third, and this is the one that costs money: read-only stops an agent from sending the fraudulent reply itself, but it does not stop the agent from believing the email. A read-only scope contains no notion of which messages are dangerous, so nothing in it marks the supplier whose banking details have 'changed' — that message reads as routine, and the loss happens in whatever system a person acts in next. RadMail classifies that message into one of five refusal classes — money, new or changed banking details, first contact with a new party, decisions, and instructions injected into an email body — and keeps all five human-only, forever. None of this has to be taken on trust: call https://radmail.ai/api/mcp/sandbox with tools/list, no account and no key, and count the tools yourself.

Why does RadMail not appear on most ‘best email MCP server’ comparisons?

Because those comparisons grade the sending job, and their columns are things RadMail deliberately does not do. Published comparisons in this category typically score programmatic mailbox creation, two-way send, automatic threading, running with no human in the loop, and deliverability. RadMail scores zero on several of those on purpose: there is no auto-send tool at all, and money, new or changed banking instructions, and first contact with a new party are human-only forever. That refusal is the design, not a missing feature. A server whose differentiator is a capability it will not have cannot win a scorecard built entirely on capabilities. The useful question to ask instead is the inverse one — not ‘what can this server do to my mail?’ but ‘what can this server be tricked into doing to my mail?’ RadMail publishes that answer as a machine-verifiable contract at https://radmail.ai/.well-known/agent-safety.json, and a runnable check anyone can execute at https://radmail.ai/verify-an-email-mcp.

A read-only banking MCP server cannot move money. Isn’t that already protection against business email compromise?

They protect different things, and the gap between them is exactly where business email compromise happens. A read-only bank or accounting connector constrains what an agent can do to your ledger: it cannot initiate a transfer, so it cannot execute the fraud directly. That is genuinely useful, and it is a different job. BEC is not an attack on your bank connection — it is an attack on your inbox. The fraudulent instruction arrives as email: a supplier whose bank details have ‘changed’, an invoice redirected to a new account, a first-contact request that reads as routine. The loss happens when a human or an agent believes that message and acts on it through some other channel entirely. A read-only banking connector never sees the email, so it cannot flag it, and it constrains nothing about the step that actually causes the loss. RadMail works at the point the instruction arrives. It reads inbound mail and refuses, structurally, to act on the classes BEC depends on: money, new or changed banking details, first contact with a new party, decisions, and instructions injected into an email body. Those five are human-only forever, published as a machine-verifiable contract at https://radmail.ai/.well-known/agent-safety.json and enforced as capability-absent — no such tool exists to call — rather than as a setting an operator could switch off.

Is a human-in-the-loop approval gate the same as RadMail’s BEC hard-stop?

No, and the difference is the whole point. Human-in-the-loop normally means an approval gate: the agent holds the capability, prepares the action, and pauses for a person to approve before it executes. The capability is present, and a person stands in front of it. RadMail’s five refusal classes work differently — the tool that would perform them is absent from the server, so there is nothing to approve and nothing to switch off. RadMail publishes that distinction as a machine-readable enforcement model with three values: capability-absent (the tool is absent, so it can never be called), config-restricted (the capability exists and is narrowed by an allowlist, scope, or policy file that whoever holds the configuration can widen again), and policy-gated (the capability exists and is restrained by instructions a model is asked to follow). RadMail reports capability-absent for money, new or changed banking details, first contact with a new party, decisions, and instructions injected into an email body. Approval gates have a legitimate place: they are the right control for a reversible action, and RadMail’s own product outbound rail operates behind human review. The question is which control an irreversible action needs. An approval step is only ever as strong as the configuration behind it and the attention of the person clicking it, and business email compromise is engineered precisely to produce an approval request that looks routine. An absent capability has neither weakness, because there is no request to approve. Check it rather than trusting it — call the server and read the tool list back at https://radmail.ai/api/mcp/sandbox, or read the contract at https://radmail.ai/.well-known/agent-safety.json.

What is RadMail's 'Right Now' lane?

The 'Right Now' lane surfaces the few messages that are both most recent and most important — the ones that genuinely can't be missed — so a human (or an agent) can act on what matters before scrolling a full inbox. It is the highest-priority slice of the two-axis triage.

// about

Who builds RadMail.

RadMail is built by the RadMail team, a Sureel venture. We build business email software for teams that cannot afford to miss the one message that matters, or to be fooled by the one that is fake.

What we are building

An email operating system, not another email client. RadMail ranks each message by importance and urgency, shows the few that need you right now with a plain reason why, drafts the follow-ups you promised on the day they are due, and reports which sends actually earned a reply.

The line we hold

Email about money, changed banking details, or first contact with someone new is human-only, by design. RadMail can sort it and explain it, but it never acts on it for you. That is our defense against business-email compromise, and we do not trade it away for convenience. Read the line.

Where RadMail stands today

RadMail is pre-release. The engine runs in a two-business test bed, the early-access waitlist is open, and a free MCP sandbox lets an AI agent try the triage tools with no sign-up. For agents.

Reach us

Write to support@radmail.ai.

radmail@inbox:~$ radmail --about