Verified, deduplicated ingest
Postfleet verifies signed webhooks, deduplicates inbound mail, and uses idempotent ingest so provider retries do not create duplicate billing or duplicate processing.
Postfleet
ReivindicarPostfleet is email infrastructure for AI agents that screens inbound messages, sanitizes content, and extracts clean mail into typed JSON before an agent reads it.
Overview
Postfleet is email infrastructure for AI agents. It sits between inbound email and your agent, turning raw messages into structured, screened inputs before the model reads them.
According to the product site, the pipeline verifies and deduplicates messages, authenticates sender signals, cleans and sanitizes message content, scans malware and spam, checks for prompt-injection risk, and then extracts safe mail into typed JSON with a confidence score. Messages that fail safety gates are quarantined or held back rather than passed through as trusted content.
Core capabilities
Authentication verdicts
It parses SPF, DKIM, and DMARC verdicts from the email provider and surfaces them alongside each message for review.
Deterministic cleaning and sanitization
The pipeline strips HTML noise, tracking pixels, styling, quoted-reply chains, hidden text, zero-width characters, and homoglyph runs before the agent sees the message.
Virus, spam, and attachment gating
Mail is scanned for malware and spam, with spam quarantined by default and suspicious attachments handled fail-closed before delivery.
Injection scan and schema extraction
A model checks for prompt-injection risk before extraction; flagged messages are retained without extraction, while clean messages are converted into typed JSON with a confidence score.
Auditable message review
The dashboard keeps cleaned body text, verdicts, sanitization records, and raw-versus-comprehended inspection side by side for each message.
Practical uses
Mailbox for an agent
Use Postfleet when an AI assistant needs to read incoming mail but should only receive cleaned, screened content instead of raw HTML and attacker-controlled input.
Schema-based extraction
Use the structured JSON output when your workflow expects specific fields such as vendor, amount, or other schema-driven data from receipts and similar emails.
Operational inbox review
Use the spam quarantine and reclassification flow when an operator needs to review suspicious messages and redeliver only the messages that should reach the agent.
Agent-managed mailbox setup
Use the MCP tools when building with Claude, Cursor, Windsurf, Cline, or VS Code and you want the agent to provision its own mailbox and process mail without a dashboard.
REST-driven automation
Use the REST path when your framework is not MCP-based but still needs the same screening and extraction pipeline for inbound email.
Pros and Cons
Pros
- Adds deterministic sanitization before an agent reads email content.
- Screens for malware, spam, and prompt injection with fail-closed handling.
- Provides typed JSON output with classification and confidence scoring for clean messages.
- Supports both hosted and local MCP access, plus REST for non-MCP workflows.
- Includes audit visibility such as cleaned text, verdicts, sanitization logs, and raw-vs-comprehended inspection.
Cons
- Comprehension is metered, so extraction pauses once the monthly limit is reached, even though sanitization continues.
- Messages flagged as prompt-injection risk are not extracted, so the system prioritizes safety over completeness for those emails.
- The public site shows MCP and REST access, but detailed integration and docs coverage is still limited in the provided source.
FAQ
What is a comprehended message?
An inbound message goes through prompt-injection screening first, then extraction to your JSON schema with classification and a confidence score. Sanitization runs on every message, and injected-risk mail is not delivered as trusted, comprehended content.
What happens when I hit my comprehension limit?
When you reach the comprehension limit, extraction pauses for the rest of the month. Deterministic sanitization still runs on every message, so mail is still cleaned and screened even after extraction stops.
Is safety metered?
Yes. Hidden-content sanitization is deterministic and does not use an LLM, so it runs on every message and every tier without counting against the comprehension limit. You pay for comprehension, not for safety.
Do hosted and local MCP access use different pricing?
The hosted MCP endpoint and the local npx package use the same pf_ key and the same plan limits. You can choose either setup without changing your plan.
Can I cancel or change plans?
You can cancel anytime from the dashboard. Pro is also covered by a 30-day money-back guarantee.
Quick Facts
- Category
- Email infrastructure for AI agents
- Primary workflow
- Inbound email is screened, cleaned, and extracted into structured data before agent use
- Access methods
- Hosted MCP, local npx MCP, and REST
- Pricing
- Free, Pro, and Scale plans are listed on the pricing page
- Supported mail handling
- Quarantine and redelivery are mentioned for spam workflows
- Website
- postfleet.ai
Alternativas ao Postfleet
Orca
Orca is an Agent Development Environment for shipping with coding agents, running multiple CLI agents in parallel across isolated worktrees, with desktop and mobile workflows.
AI Magicx
AI Magicx is a unified AI workspace for chat, image, video, voice, music, email and developer tasks, helping teams and creators manage multiple models in one place.
Paper
Paper is a design tool that connects canvas, code, and AI agents so teams can create, share, and ship work in one workflow. Includes desktop app and MCP access.
blop
blop is a QA agent that writes browser tests as code in your repo, runs them in CI, clusters repeated failures, and can open PRs to fix broken tests.
RLAMA
RLAMA is a local AI platform for building RAG systems and intelligent agents on macOS, Linux, and Windows, with HTTP API support.
Kastra
Kastra authorization infrastructure for AI systems checks prompts, tool calls, shell commands, API requests, and browser actions before execution.