Case study · 03
Goshen Email
Email inboxes for AI agents: a real address for every agent, with threads, attachments, and a key that reaches only its own mail.
What we built
Goshen Email gives every AI agent a real email address. One API call creates an inbox that sends, receives, and replies, with replies kept in the same thread and attachments kept in order. People see the same mail in a dashboard, where they can reply, check delivery, and release quarantined messages.
Vendors, customers, and services still run on email: quotes, invoices, sign-up codes, and support threads. With an address of its own, an agent can take part in that work while a person reads along. It's offered as a hosted service at goshenemail.com, and the full source is on GitHub for teams that want to run it themselves.
How it's built
- API
- A Cloudflare Worker serving 17 REST operations, described in an OpenAPI document. A JSON CLI and an MCP server, hosted or over stdio, expose the same 17 operations.
- Scoped keys
- An account key reaches every inbox in its account, limited to the scopes you pick. A mailbox key reaches one inbox. No key can release quarantine or create other keys.
- Safe retries
- Every send needs an idempotency key, so retrying a timed-out send with the same key and contents never sends a second copy.
- Inbound checks
- Mail on custom domains arrives through an SMTP gateway that checks SPF, DKIM, and DMARC and scans with Rspamd and ClamAV. Spam, failed authentication, and malware wait in quarantine until a person releases them.
- Storage
- PostgreSQL through Cloudflare Hyperdrive for mailboxes and messages, and R2 for raw mail and attachments.
- Webhooks and triage
- Signed webhooks report new mail and every delivery outcome. Optional triage labels new mail with a category, whether it needs a reply, and an urgency score.
Why it matters
Email is where a lot of real business still happens, and it's also where an agent can do real damage: replying to the wrong person, sending twice, or acting on a spoofed message. Goshen Email puts the guardrails in the infrastructure instead of the prompt: keys that reach one inbox, sends that can't duplicate, and a quarantine only a person can release. It's the same approach we take when we connect agents to a client's systems.