Give a review team an inbox your agent reads.

1 Create your project

Sign in at app.boundedloop.net. Your account gets a client slug (e.g. acme). In Projects & delivery, add a project — reviews. Every address under it looks like:

acme-reviews-<word>-<word>-<word>@boundedloop.net

2 Hand each reviewer an address

Give every reviewer a distinct three-word address. The words are an unguessable capability — pick memorable ones; the gateway accepts any 3–5 word address under your project and maps it to your account.

Reviewer A → acme-reviews-otter-maple-cobalt@boundedloop.net
Reviewer B → acme-reviews-harbor-ember-quill@boundedloop.net

Distinct phrases let you attribute, rate-limit, and revoke per reviewer. For sensitive channels, enable a sender allowlist so only that reviewer's email is accepted (backed by upstream SPF/DKIM/DMARC). Flooded addresses auto-rotate and reissue.

3 Choose how your agent receives mail

Two patterns — use either or both. Push is best for always-on agents; pull for agents that can't expose an endpoint.

// verify the delivery (Node)
import crypto from 'node:crypto';
app.post('/inbound', (req, res) => {
  const sig = req.headers['x-bl-signature'];
  const mac = 'sha256=' + crypto
    .createHmac('sha256', BL_SECRET)
    .update(req.rawBody).digest('hex');
  if (sig !== mac) return res.sendStatus(401);
  const { id, project, phrase, from,
          subject, pullUrl } = req.body;
  // fetch full text/html/attachments:
  // GET pullUrl with your Bearer token
  res.sendStatus(200);
});

# Claude Code — remote MCP
claude mcp add --transport http boundedloop \
  https://mcp.boundedloop.net \
  --header "Authorization: Bearer bl_live_…"

# CLI
bl login --token bl_live_…
bl inbox list --project reviews

# REST
curl https://api.boundedloop.net/v1/messages?project=reviews \
  -H "Authorization: Bearer bl_live_…"

4 Mint a scoped token

In the dashboard's API tokens, mint a token with just the scopes the agent needs. Give it messages:read to read, and add messages:reply if the agent should answer reviewers. Tokens are shown once, hashed at rest, and revocable instantly.

5 Your agent reads the message

Over MCP the agent calls get_message; over REST it GETs the message. Either way it gets parsed text, html, and an attachment list.

GET /v1/messages/reviews/otter-maple-cobalt/$ID
→ { "from": "reviewer@partner.com",
    "subject": "Re: spec v3",
    "text": "Looks good — ship it, but fix the title.",
    "html": "…",
    "attachments": [ { "index":0, "filename":"notes.pdf",
                       "contentType":"application/pdf", "size":18342, "url":"…" } ] }

6 The agent replies — and the loop closes

With messages:reply, the agent answers the reviewer. The reply is sent as the address they wrote to and threads natively in their client.

POST /v1/messages/reviews/otter-maple-cobalt/$ID/reply
Authorization: Bearer bl_live_…
{ "text": "Thanks! Filed as ACME-412 and fixed the title." }
→ delivered from acme-reviews-otter-maple-cobalt@boundedloop.net, threaded

7 Optional niceties

• • Read-receipts — toggle per project to auto-acknowledge reviewers on receipt.
• • Sender allowlist — lock an address to a reviewer's verified email.
• • Usage — the dashboard shows inbound counts; billing is ~$1 / 100 accepted emails (rejections free).
• • Revoke — kill a token or an address instantly when a reviewer rolls off.