Loading…
Use case · AI agents
Agents need email: booking confirmations, verification codes, notifications from the services they operate. They do not need your Gmail and a full OAuth scope. Give each one its own address, decide exactly what it sees, and keep a kill-switch in your hand.
What your agent receives
POST https://agent.yourapp.dev/inbox
X-Signature: hmac-sha256=9f2ab04c...
{
"to": "travel-bot@you.hidemy.world",
"from": "no-reply@airline.example",
"auth": { "spf": "pass", "dkim": "pass" },
"subject": "Booking confirmed",
"data": {
"pnr": "KX93JD",
"flight": "BA2490",
"departs_at": "2026-09-14T09:35"
}
}Signed, verified, already parsed. Straight into the agent loop.
The problem
The usual shortcut
The HideMy.world way
Built for the agent loop
Transformers turn each email into the fields your agent actually needs (a PNR, a code, an order status) delivered to your webhook as structured JSON with SPF/DKIM results attached. Your agent reasons over data, not markup, and every call is HMAC-signed so you can trust what arrives.
travel-bot@you.hidemy.world, support-bot@, qa-bot@. Invent an address per agent in seconds. Each one is its own sealed compartment: its own rules, its own delivery, its own off switch.
Allowlist the senders the agent manages, require SPF and DKIM to pass, drop everything else. Your agent gets the confirmations and codes it needs, never the raw firehose, never a stranger’s payload.
One click pauses an address and delivery stops instantly. Suspicious behaviour, a prompt injection, a demo gone weird: cut the feed first, investigate second.
Agents can look back through what they received, but they can never send. No outbound scope means no outbound scope to hijack.
How it works
Pick a name: booking-bot@you.hidemy.world. No DNS, no OAuth consent screens, no sharing your mailbox.
Allow only the services this agent deals with, require authentication to pass, and add an AI rule for anything fuzzier: “only booking confirmations and verification codes”.
Each matching email arrives at your endpoint as clean, HMAC-signed JSON. Your agent reads structured fields, not MIME soup.
No testimonials, just configs
Plans
One or two agents: Lite
€9.90/mo: unlimited addresses and rules, 250 AI evaluations, 1,000 emails a month and 2 transformers. Plenty for a side project’s worth of agents.
Agent fleets: Pro
€24.90/mo: the read-only API, 1,000 AI evaluations, 5,000 emails a month, unlimited transformers and 5 team members. Built for production loops.
Start on Free to prototype: 2 addresses, no card. Compare all plans
FAQ
Every webhook delivery is signed with HMAC. Verify the signature header against your secret before your agent acts on anything: one comparison, and forged calls are dead on arrival.
We check SPF and DKIM on inbound mail and include the results in the payload, so your rules can require a pass before the agent ever sees the message. Spoofed senders get filtered out, not fed to your agent.
Pause the address and delivery stops instantly. No DNS changes, no OAuth revocation dance. Because each agent has its own address with its own rules, the blast radius is one inbox you built for the purpose, never your real mailbox.
No, and that is deliberate. Addresses receive; the API is read-only. There is no outbound scope for a hijacked agent to abuse, which is exactly why you can hand this to an agent without losing sleep.
Free is enough to prototype one agent. Lite (€9.90/mo) adds unlimited addresses, AI rules and 2 transformers. Pro (€24.90/mo) adds the read-only API, 1,000 AI evaluations and 5,000 emails a month, the fit for agent fleets.
Create the first agent address free in under a minute: rules, signed webhooks and the kill-switch included.