Postfleet AI

Postfleet is email infrastructure for AI agents built around a trust-boundary idea: raw email can be attacker-controlled input, so your agent should never read it directly.

Each inbound message runs through a multi-stage pipeline before it reaches your agent. Postfleet verifies and deduplicates delivery, surfaces SPF/DKIM/DMARC results, cleans and sanitizes the content (including stripping hidden text, zero-width characters, and HTML noise), gates malware and attachments using an SES virus verdict, and suppresses spam by default. Then a prompt-injection scan determines whether the message is safe to extract.

What your agent receives is structured JSON that matches a schema you define—or nothing if the message is flagged. Injection-risk mail is retained without extraction and returned with an explicit status (e.g., skipped_injection_risk) so your agent can’t be quietly poisoned by adversarial instructions. Sanitization and screening outcomes are kept alongside the cleaned body for inspection.

Connect via MCP or REST: agents can provision their own mailbox over MCP and start processing mail, or you can use the REST API. Sends are idempotent (retrying with the same client_id won’t double-send), and you can add human approval before irreversible actions. Postfleet also offers a free tier with 100 comprehended messages per month and additional options for higher-volume agent deployments.

Does Postfleet deliver the raw email content to my agent?

No. The pipeline runs before your agent reads anything, and the agent gets typed JSON that matches your schema or a status indicating extraction was skipped.

How does Postfleet handle prompt-injection attempts?

Postflight scans for injection risk after virus/spam gates and content sanitization. If a message is flagged, it’s retained without extraction and your agent receives an explicit status (for example, skipped_injection_risk).

What sanitization does Postfleet apply to inbound messages?

Postfleet cleans HTML to text, removes tracking noise and quoted-reply chains, strips hidden text and zero-width characters, and removes other risky elements. Each removal is logged in a sanitization report.

How are malware and attachments handled?

Inbound delivery is gated using the AWS SES X-SES-Virus-Verdict header. Failed or unknown verdicts stay fail-closed, and the current Resend path does not return attachment bytes with no public download endpoint.

Can I connect Postfleet to any MCP client?

Yes. Postfleet works with any MCP client (including Claude, Cursor, Windsurf, Cline, and VS Code) using the provided MCP endpoint or a local npx setup.

Are email sends safe to retry?

Yes. Sends are idempotent—retrying with the same client_id sends at most once—so provider retries don’t cause duplicate outbound messages.