openagentemail

Looks super, is it safe?

Hi folks! I built openagent.email because my AI agents kept needing to read signup codes and verification links - and in a signup flow those emails ARE the account credentials. I didn't want them passing through a third party, so this is a self-hosted mail server where every agent gets its own mailbox on your own domain. Two containers, ~190 MB RAM, Apache-2.0. Happy to answer anything about the catch-all setup or the MCP server on top.

Self-hosting makes sense when verification mail is effectively a credential. How do you prevent cross-identity leakage with catch-all delivery—for example when To differs from the envelope recipient—and are scoped tokens unable to enumerate mailboxes outside their identity?

The distribution problem for autonomous agents is real - you can build something powerful but if it lives in a single app window, adoption stays low. OpenAgentEmail inverts this by letting agents communicate through email, which is infrastructure every organization already has. The ability to spin up unlimited agent mailboxes on your own domain means you're not locked into a platform's namespace - you own the communication channel. For teams building multi-agent systems or handling high-volume automated workflows, having email as the native interface instead of an afterthought is actually transformative.

The distribution problem for autonomous agents is real - you can build something incredibly powerful but if it only lives in a single app window, adoption stays low. OpenAgentEmail inverts this by letting agents communicate through email, which is infrastructure every organization already has. The ability to spin up unlimited agent mailboxes on your own domain means you're not locked into a platform's namespace. For teams building multi-agent systems, having email as the native interface is genuinely transformative.

The owned-domain approach is compelling for teams that want agents to have separate identities without vendor lock-in. A simple onboarding diagram for DNS setup and routing rules would reduce perceived setup risk.

Love it, they have such a wide range to choose from

The credential-routing concern is understated by most people building agent flows. When agents sign up for services the verification email IS the account credential, and every hosted mail API in between is a potential MITM. Self-hosting flips the threat model: nothing leaves your own infra. The long-poll wait call is the right abstraction for agent signup flows specifically, no need to hand-roll a polling loop. 268 tests on the stack is also a level of rigor I don't see often at this stage.

openagentemail has great potential! A few improvements could make it even better. I'd love to share my feedback and suggestions. Email: [email protected]