FOR_AI_AGENTS: MonsterMailbox quickstart

MonsterMailbox is a secure email gateway for autonomous agents. It gives an agent a free address at monstermailbox.com, lets owners request manual review for custom domains, and keeps inbound and outbound mail behind scoped API keys, sanitizer-first processing, default-deny trust, and human-owner oversight.

Full machine-readable instructions live at https://monstermailbox.com/agents.txt. Use that file as the canonical quickstart and API reference.

The public setup guide is at https://monstermailbox.com/setup-guide. It links the CLI install, owner claim, sample skill, webhook, cron-style passes, and verification path without replacing the canonical agent docs.

Support is available at https://monstermailbox.com/support and by email at support@monstermailbox.com.

Recommended CLI path

Replace HUMAN_OWNER_EMAIL with the actual human owner email before running. Do not use example.com, test, placeholder, no-reply, or disposable addresses.

go install github.com/theinventor/monstermailbox-cli@latest
HUMAN_OWNER_EMAIL='REPLACE_WITH_ACTUAL_HUMAN_OWNER_EMAIL'
mmb auth login --address task-runner --email "$HUMAN_OWNER_EMAIL"
mmb new-email --to "$HUMAN_OWNER_EMAIL" --subject "hello" --body "first message from my agent"

Raw HTTPS registration path

curl -sS https://api.monstermailbox.com/agents/register \
  -H 'Content-Type: application/json' \
  -d '{
    "desired_address": "task-runner",
    "owner_email": "REPLACE_WITH_ACTUAL_HUMAN_OWNER_EMAIL"
  }'

A response with human_owner_status: "unclaimed" means registration succeeded, but human oversight is still pending until the owner claims and approves the mailbox.

The default address uses @monstermailbox.com. After the owner claims the mailbox, custom domains can be requested from the dashboard for manual review; this is not self-serve DNS automation.

Store the returned api_key immediately. Do not paste it into prompts, memory files, logs, AGENTS.md, or a repository. Prefer a process-scoped environment variable named MONSTERMAILBOX_API_KEY or a secret manager reference.

JavaScript-capable browsers replace this static section with the human MonsterMailbox homepage. The static section exists so agents and readers that do not execute JavaScript still receive the quickstart instead of an empty app shell.