What is an inbox for AI agents, and when do you need one?
An inbox for AI agents gives your agent its own email address, Telegram bot and Slack app. Learn how it works and when your agent needs one.
An inbox for AI agents is an address of the agent's own, on email and chat apps like Telegram and Slack, that works in both directions. People and services can write to the agent there, and the agent can write to people, ask them a question or an approval, and wait for the answer before it carries on.
You need one when your agent works while nobody is watching it, and either has to hear from people or has to reach them.
Why agents need an inbox of their own
For most of the short history of AI agents, the person was always there. You typed into a chat window, the agent answered, and if it needed something, it asked you in the next message.
That's no longer how a lot of agents run. Coding agents work through a task list while you're in meetings. Scheduled agents run overnight. Agents in CI jobs run when a pull request opens, with nobody looking at the logs. The chat window, the one place the agent could reach you, isn't open.
So two things break.
The agent can't reach you. It hits a decision only you can make, like whether to deploy, which of two approaches to take, or whether a refund is fine. It either guesses or stops and waits for someone to notice.
Nobody can reach the agent. A service sends it a verification code. A colleague replies to the report it sent. A vendor answers its email. If the agent has no address of its own, all of that goes to your inbox, and you forward it.
An inbox for AI agents fixes both by giving the agent its own place to send and receive messages, on the channels people already read.
How an inbox for AI agents works
An agent inbox has four parts: an identity, an outbound side, an inbound side, and rules about who gets through. We'll use Agent Inbox, the inbox we build at Novu, for the examples.
An identity of its own
The agent gets a name and an address, like atlas@agentinbox.mx, plus its own bot on Telegram and its own app on Slack. People see the agent, not you. That matters for trust: when the agent emails a vendor, it doesn't send as you, and when someone replies, the reply goes to the agent.
Outbound: the agent asks, and waits
A notification is one-way. An inbox has to bring the answer back to the agent, in a form its code can act on. Agent Inbox has four kinds of outbound message:
- ask: a free-text question, and the agent gets the typed answer.
- approve: a yes or no for anything hard to undo, with buttons you can label.
- choose: a pick from up to 10 options you write.
- tell: an update that needs no reply.
The question arrives where the person already reads messages, and the agent waits for the answer:
The command exits with a code a script can branch on: 0 for approved, 10 for denied, 11 if it stopped waiting, and 12 if the question expired. A late answer isn't lost. It lands in the conversation, where the agent finds it next time it looks.
Inbound: people and services write first
Anyone can email the agent's address, and once Telegram or Slack is connected, people can message it there. Everything said in one place on one channel is one conversation. A message the agent hasn't answered stays unread, so nothing slips while the agent is busy or not running:
This is also where service email lands. Sign up for a tool with the agent's address, and the verification code goes to the agent.
An agent that isn't running can't read anything, though. Agent Inbox's listen command handles that for Claude Code: when you or a contact you choose writes to the agent, your computer starts Claude Code in the project to answer.
Rules about who gets through
An address anyone can write to will hear from people you don't know, and some of them will try to give your agent orders. A good agent inbox separates the people the agent works with from everyone else:
- Contacts are the people the agent can message. You add them with an invite link, and they pick the channel they prefer.
- Strangers are everyone else. The agent can reply to a stranger who wrote first, but can't message one first, and it treats a stranger's text as information, never as instructions.
- The owner decides whether strangers can write at all, and can pause the agent. The agent can't change these settings itself.
Agent inbox vs a mailbox API vs access to your Gmail
Three things get called "email for AI agents", and they solve different problems. The difference comes down to whose identity the agent uses and what it needs to do with replies.
A mailbox API for agents gives each agent a programmable email inbox. It's built for agents whose work is email, and it suits running many inboxes at once. If your agent needs a person's decision, you write the asking, waiting and matching logic yourself.
Access to your own Gmail, through the Gmail API or an MCP server, lets an agent read and send mail as you. It's the right choice when the job is your mail, like triaging your inbox. It's the wrong choice when the agent needs its own identity: replies go to you, it sends under your name, and automated access to a personal account can trip Google's abuse checks.
An agent inbox sits between them. The agent has its own identity, on the channels the people it works with prefer, and the parts you'd otherwise build yourself are already there: questions with answers the code can act on, contacts, and screening for strangers.
When do you need one?
You probably need an inbox for your agent if any of these sound familiar:
- You forward messages to your agent. Verification codes, replies and requests reach you first, and you paste them into a chat.
- Your agent stops and waits for someone to notice. A long run sits at a question for hours because nobody was watching the terminal.
- You've turned off permission prompts to keep runs moving. It would be better to approve only the risky steps, from your phone.
- The decision isn't yours. A refund needs finance, or a release needs the on-call engineer, and the agent has no way to ask them.
- People want to talk to your agent directly. A teammate wants to ask your assistant something without going through you.
- You've built this before. A mailbox, a Telegram bot, a Slack app, approval logic and a database table to match replies to questions.
You probably don't need one if a person is always in the chat when the agent runs, or if the agent's only job is your own mail.
How to set one up
With Agent Inbox, one command creates the inbox. You don't need an account to start: the inbox receives email straight away, and you claim it with an account when you want the agent to send.
To use it from Claude, ChatGPT or Cursor instead, add https://mcp.agentinbox.md as an MCP server and sign in. To teach a coding agent like Claude Code or Codex when to reach you, install the skills:
Agent Inbox is free for 100 conversations a month. The docs cover every command.
FAQ
What is an inbox for AI agents?
An inbox for AI agents is an address the agent owns, on email and chat apps like Telegram and Slack. People and services can write to the agent there, and the agent can message people, ask them questions or approvals, and wait for their answers.
Can an AI agent have its own email address?
Yes. An agent inbox gives the agent an address of its own, like atlas@agentinbox.mx, so services and people can email it directly and it never sends as you.
How is an agent inbox different from giving an agent access to Gmail?
Gmail access lets an agent act as you, in your mailbox. An agent inbox gives the agent its own identity, so replies go to the agent, it sends under its own name, and you control who can reach it.
How does an agent get a human's approval?
The agent sends an approval request to a person on email, Telegram or Slack, with Approve and Deny buttons, and waits. The answer comes back with who gave it and when, so the agent acts on a recorded decision.
Is it safe to let strangers message my agent?
Only with screening. In Agent Inbox, the agent treats a stranger's message as information, never as instructions, and can't message a stranger first. The owner can also limit the inbox to contacts only, so strangers' messages never arrive.
