Skip to main content
Claude Code already has everything it needs to drive Agent Mailbox — the API is plain HTTPS and it has a shell. What it lacks is knowing the shape of it: which field to read, when not to reply, what a 404 on an inbox actually means. That is what a skill is. A markdown instruction bundle that teaches an agent to use tools it already has, loaded only when the work calls for it.
Claude Code can take either route. A skill keeps you in control of the HTTP calls and needs no extra setup; the MCP server hands it twelve ready-made tools instead. Skill is the lighter default — reach for MCP if you want the tool-approval prompts that come with it.

​
Install

.claude/skills/ in a project scopes the skill to that repo. Put it in ~/.claude/skills/ instead and every project gets it.
Your existing Waterr wai_ developer key works — see Authentication. Nothing else to provision.

​
Check it loaded

Start Claude Code and ask for something mail-shaped:
Claude Code reads the skill, calls GET /v0/inboxes, and reports what it finds. If it asks what Agent Mailbox is, the file is in the wrong place — confirm .claude/skills/agent-mailbox/SKILL.md exists relative to where you started the session.

​
What the skill teaches

Not just the endpoint list. The parts that are easy to get wrong:

​
What it can do once installed

Handle a support thread

Read the thread for context, answer in it, keep replying as the conversation continues.

Collect a verification code

Sign up somewhere with the agent’s own address, then pull the OTP out of the inbox.

Follow up on its own

Queue a scheduled draft on a thread the moment it promises something, so nothing depends on remembering later.

Draft for your approval

Compose the reply, leave it unsent, and let you send it once you have read it.

​
Containment worth setting up first

An agent that reads email and can send email is a prompt-injection target — the content it processes is written by whoever emailed it. Before pointing one at a real inbox, bound where it can send:
One allow entry makes that direction deny-by-default, so add every address the agent legitimately needs before the first one. This holds even when the model is talked into something. See Allow and block lists.

​
Other coding agents

The skill is plain markdown against a plain REST API, so it carries anywhere an agent can read a file and run curl — Codex, Cursor, and similar. Only the install path differs:
These are skill-only installs — the agent calls the REST API directly. If you would rather it received tools than instructions, there is a hosted MCP server at https://agent.waterr.ai/mcp, which is also how Cursor and Grok connect.