AgentMail API + MCP vs Postfleet

AgentMail API + MCP

Inbox creation, threads, drafts and labels built for agents, with extracted_text that drops quoted history, per-operation key permissions and opt-in injection scanning. Since 12 October 2026 the privacy notice allows training on email content without a written agreement.

Postfleet

Agent mailboxes over REST, webhooks and a 16-tool MCP server, with mailbox-bound keys, required idempotency keys on MCP sends, server-side approval and documented screening that keeps raw mail out of MCP reads. The screening is the vendor's claim, untested by us. Under four months old, it names no operator and has no status page, changelog or security contact.

AgentMail API + MCP

1. Subscribe over WebSocket instead of polling. It needs no public URL and avoids 429s
2. Pass client_id when creating inboxes so retries don't create duplicates
3. Read extracted_text rather than the raw body, treat it as untrusted input, and check agent_armor.verdict when the organisation has Agent Armor on
4. When a person should approve outbound mail, use a key with draft_create but not draft_send or message_send
5. Send the key in the x-api-key header, not ?apiKey=, which ends up in logs

Postfleet

1. Check comprehension.status before acting; skipped_injection_risk mail still arrives as cleaned text and must be handled as untrusted data.
2. Treat a 202 pending_approval from send_email, reply_email or send_draft as success and never retry it; follow up with list_drafts.
3. Reuse the same client_id when retrying a send, and use a new one after a terminal 402, 403 hold or permanent 400.
4. Call list_mailboxes before create_mailbox; each create makes another mailbox and retries are not idempotent.
5. Give a reading agent a mailbox-bound key with can_send false, and keep the account-wide key outside the worker.