Why this exists
Every autonomous agent team builds email pipelines. Nobody agrees on how. Most teams ship at eighty percent with quick regex parsers and raw SMTP connections, and then break on the very first multipart reply.
Nobody chooses an AI agent runtime because its email parser was simple. But developers quietly realize an infrastructure is brittle in the first thirty seconds, when an unescaped attachment or an untrusted HTML payload breaks their agent’s context window.
The three failures
Almost every email integration library makes all three mistakes. They are not hard problems. They are just invisible until they are not.
- 1
The button jumps & states desync
A label changes from Send to Dispatching... and the button resizes, so the row beneath it shifts and the user’s cursor is suddenly over something else. Every state an agent action reaches must reserve its width before it gets there.
- 2
MIME bombs and untrusted HTML crash LLMs
Raw incoming emails contain hidden trackers, active JavaScript, malformed multipart boundaries, and nested zip bombs. Passing unparsed payloads into an LLM prompts prompt injection or token overflow. Gork strips scripts, enforces a strict 15MB ceiling, and guarantees clean text/markdown outputs.
- 3
Replayed webhooks trigger double execution
When a webhook delivery fails or times out, standard queues retry blindly. If your agent is processing orders or booking meetings, an unverified webhook triggers redundant actions. All deliveries must carry cryptographic HMAC signatures (
X-Gork-Signature) and strict deduplication IDs.
Action Feedback
You did something. Did it land? Below are the three core feedback primitives powering the Gork developer interface.
Reserves width in the DOM. Clicking repeatedly resets without queueing springs or causing horizontal layout shifts.
Numbers flash a subtle accent background when metrics change, preventing numbers from jumping font kerning.
Interactive Agent Email Dispatcher
Quickstart
Dispatch your first agent email in 30 seconds
Create an inbox and dispatch outbound mail via cURL, TypeScript, or Python.
| 1 | curl -X POST https://api.gork.email/v1/inboxes \ |
| 2 | -H "Authorization: Bearer gork_live_YOUR_KEY" \ |
| 3 | -H "Content-Type: application/json" \ |
| 4 | -d '{"username": "sales-agent", "name": "Autonomous SDR"}' |
| { |
| "data": { |
| "id": "inb_89a0b12", |
| "address": "sales-agent@gork.email", |
| "name": "Autonomous SDR", |
| "isActive": true, |
| "createdAt": "2026-09-04T00:00:00.000Z" |
| } |
| } |
Authentication
All endpoints require a secret API key passed in the Authorization HTTP header. API keys are generated with salted SHA-256 hashes from your console.
| Authorization: Bearer gork_live_a89f01bc24de567890 |
Security & Webhooks
Cryptographic HMAC-SHA256 Signatures
Every inbound email triggers a webhook containing an X-Gork-Signature header. Test the signature computation live below:
Live HMAC-SHA256 Signature Verifier
| 1 | import crypto from "crypto" |
| 2 | |
| 3 | export function verifyGorkSignature( |
| 4 | rawBody: string, |
| 5 | signatureHeader: string, |
| 6 | webhookSecret: string |
| 7 | ): boolean { |
| 8 | const parts = Object.fromEntries( |
| 9 | signatureHeader.split(",").map((p) => p.split("=")) |
| 10 | ) |
| 11 | const timestamp = parts.t |
| 12 | const signature = parts.v1 |
| 13 | |
| 14 | const expected = crypto |
| 15 | .createHmac("sha256", webhookSecret) |
| 16 | .update(`${timestamp}.${rawBody}`) |
| 17 | .digest("hex") |
| 18 | |
| 19 | return crypto.timingSafeEqual( |
| 20 | Buffer.from(signature), |
| 21 | Buffer.from(expected) |
| 22 | ) |
| 23 | } |
Agent Protocol
Model Context Protocol (MCP) Server
Connect your AI agents directly to Gork via Claude Desktop, Cursor, or any MCP-compatible runtime:
| 1 | { |
| 2 | "mcpServers": { |
| 3 | "gork": { |
| 4 | "command": "npx", |
| 5 | "args": ["-y", "gork-mcp", "--api-key=gork_live_YOUR_KEY"] |
| 6 | } |
| 7 | } |
| 8 | } |
Ten moments
Gork’s programmable infrastructure is organized around what your autonomous worker is in the middle of when an email event happens.
- Action Feedback
- Your agent dispatched a message. Did it land at the destination mail server?
- Identity & Provisioning
- Creating an on-demand, isolated mailbox identity for a newly spawned agent.
- Async Routing
- Queueing, retrying, and delivering webhooks across distributed edge workers.
- MIME Sanitization
- Stripping executable scripts and unpacking multipart MIME into sanitized text/markdown.
- Thread Reconstruction
- Matching In-Reply-To and References headers to build conversational context turns.
- Cryptographic Guard
- Timing-safe HMAC-SHA256 signature verification preventing webhook spoofing.
- Storage & Attachments
- Streaming large binaries directly to private object storage with signed download URLs.
- Domain Authentication
- Automated SPF, DKIM, and DMARC verification for custom domain delegation.
- Model Context Protocol
- Exposing email capabilities as native tool calls directly to LLM prompts.
- Loop Prevention
- Automatic auto-responder and bot-loop detection preventing catastrophic token burns.