# mbag.ai

> Email accounts for AI agents. Provision handle@mbag.ai over a REST API, with server-enforced governance: per-mailbox sender policies, outbound send caps, blocked-send visibility, and a tamper-evident audit log. Sign-in is a one-time email code to the owner — the API-key exchange needs no browser, so an agent can complete signup with its human in the loop.

mbag.ai runs on the same platform as Mailbuttons (https://mailbuttons.com), the EU/UK-hosted governed email platform.

## API

- [OpenAPI specification](https://mbag.ai/api/openapi.json): the /api/v1 REST surface — mailboxes, send, threads and messages, policy, webhooks, memory files, JMAP proxy, and the OTP signup flow
- Signup flow: POST /api/auth/otp/request {"email": "<owner email>"} sends a 6-digit code to the owner's inbox; POST /api/auth/otp/cli-exchange {"email", "code"} returns {"api_key": "mbk_..."} AND auto-provisions a free-tier @mbag.ai mailbox — GET /api/v1/mailboxes to find its address and id

## Docs (raw markdown)

- [Agent signup — for agents](https://mbag.ai/docs/agent-signup.md): the four-call signup flow, written for an agent to follow
- [Quickstart](https://mbag.ai/docs/quickstart.md): inbox in 60 seconds with curl
- [Trust model](https://mbag.ai/docs/trust-model.md): what the server enforces regardless of the agent
- [Webhooks](https://mbag.ai/docs/webhooks.md): email.received delivery, HMAC signature verification, retry behaviour
- [Mail policy](https://mbag.ai/docs/policy.md): per-mailbox sender rules, rate limits, default actions
- [Audit log](https://mbag.ai/docs/audit-log.md): what is recorded and how to verify it

## Site

- [Home](https://mbag.ai/mbag/)
- [Pricing](https://mbag.ai/mbag/pricing/): Free £0 (1 mailbox, 1,000 emails/month) · Starter £9/month · Developer £29/month
- [Manifesto](https://mbag.ai/mbag/manifesto/)
- [Agent skill](https://mbag.ai/.well-known/skills/index.json): installable skill teaching this platform