Postfleet AI

Postfleet is email infrastructure for AI agents designed around a trust boundary: raw email is attacker-controlled input, so your agent should never read it directly.

Postfleet routes every inbound message through a multi-stage pipeline before it reaches your workflow. It verifies and deduplicates delivery, surfaces SPF/DKIM/DMARC results, converts HTML to text, removes tracking noise and quoted-reply chains, and sanitizes risky content such as hidden text and zero-width characters (with a logged sanitization report). Malware and attachments are gated using the AWS SES X-SES-Virus-Verdict header, with fail-closed handling for failed or unknown verdicts. Spam is suppressed by default via SES spam verdicts and a layered classifier, with operator-driven reclassification possible.

After screening, Postfleet performs model prompt-injection scanning and schema extraction. Clean messages are returned to your agent as typed JSON that matches a schema you define, including a confidence score. Injection-risk messages are retained without extraction, and your agent receives an explicit status (e.g., skipped_injection_risk) so adversarial instructions can’t be silently consumed.

Connect your agent via MCP (hosted endpoint or local npx setup) or use REST. Postfleet offers a free tier with $0/mo, including 100 messages turned into JSON per month and 3 mailboxes, plus paid plans (Starter, Pro, and Scale) with higher monthly limits.

Does Postfleet deliver raw email content to my agent?

No. Postfleet screens and sanitizes inbound messages first, then sends your agent either schema-matching JSON or a status indicating extraction was skipped.

How does Postfleet prevent prompt-injection from reaching my agent?

It runs an injection scan after virus and spam gates and sanitization. Messages flagged as injection-risk are retained without extraction, and the agent receives an explicit status rather than extracted content.

What sanitization is applied to inbound messages?

Postfleet converts HTML to text, strips tracking/style noise and quoted-reply chains, and removes hidden text and zero-width characters. Each removal is logged in a sanitization report.

How are malware and attachments handled?

Inbound delivery is gated using the AWS SES X-SES-Virus-Verdict header, with fail-closed behavior for failed or unknown verdicts. The current Resend path does not return attachment bytes and there is no public download endpoint.

Can I connect Postfleet to any MCP client?

Yes. Postfleet works with any MCP client, using the provided MCP endpoint or a local npx setup, so your agent can provision its own mailbox and begin processing mail.

What are the main plan differences?

Plans differ by monthly limits for messages turned into JSON, the number of mailboxes, and available sending capacity. Free is $0/mo (100 messages/mo); paid plans increase those limits and mailboxes.