mailmolt
changelog

What shipped,
newest first.

Follow @mailmolt for live updates.

Agent-discovery primitives sync + new well-known endpoints

  • —skill.md, skill.json, heartbeat.md, llms.txt, llms-full.txt now share one pricing source of truth (apps/web/src/lib/pricing.ts) — no more drift between agent-facing files and the live site.
  • —New: AGENTS.md at the repo root and /agents.md route handler — codegen-agent guide for AI coding assistants wiring MailMolt into a project.
  • —New: /openapi.json — OpenAPI 3.1 spec for the public REST surface, advertised from the api-catalog Linkset.
  • —New well-known endpoints: /.well-known/agent.json (A2A), /.well-known/x402, /.well-known/ap2.json, /.well-known/acp.json. All cross-linked from /.well-known/api-catalog.
  • —skill.md v2.1 now documents agent memory, outbound DLP modes, webhook egress guard, Verified Sender bonds, custom-domain auto-provisioning, and stream-aware routing.
  • —Atom feed at /changelog/feed.xml so answer engines and aggregators can subscribe to release news.

Webhook egress guard, outbound DLP, agent memory + MCP tools

  • —Webhook URLs now blocked at registration AND dispatch if they target localhost / RFC1918 / 169.254.169.254 (cloud metadata).
  • —Outbound DLP engine: monitor / redact / block per rule, configurable per owner. dlp_events table for audit; dlp.rules_version on every heartbeat.
  • —Persistent agent memory: /v1/agents/me/memory/:key with importance, kind, expires_at. Vector + keyword search. Plan-gated capacity (free 20, starter 200, growth+ unlimited).
  • —Five new MCP tools — memory_list, memory_get, memory_put, memory_delete, memory_search — surface memory directly to Claude Desktop / Claude Code / Cursor / Continue / Zed.

Agent starter kits — OpenClaw, Hermes, Cursor, Continue, Zed

  • —Per-integration brand marks across the index page and integration heroes.
  • —Runnable starter kits added under integrations/ in the public repo for OpenClaw, Hermes, Cursor, Continue.dev, and Zed.
  • —SDK examples (TS + Python) refreshed to match the latest API surface.

Expanded Terms / Privacy / DPA — Roushan Inc. operating entity

  • —Legal pages now thread Roushan Inc. as the operating entity end-to-end.
  • —Verified Sender program terms cleaned up; bond tiers documented at $99 / $499 / $2,000.
  • —DPA now lists Cloudflare sub-processors explicitly (Workers, D1, R2, KV, Vectorize, Email Sending, Email Routing).

Free tier tightened to 1 agent per owner

  • —The Free plan provisioned one agent per verified human owner (was three). Existing owners running a single agent migrated to the new cap automatically; owners running 2+ agents kept their grandfathered allotment until upgrade.
  • —Note: as of the 2026-04-28 ladder revision, Free is back to 2 agents.
  • —Pricing page + pricing JSON-LD + FAQ schema updated across mailmolt.com.

SMTP, MCP, billing, compliance, workspaces — the Q2 drop

  • —SMTP submission: smtp.mailmolt.com:587 / :465 is live. Drop-in for Supabase, Auth0, Clerk, Django, Rails, Laravel, WordPress.
  • —MCP server: mcp.mailmolt.com (remote) + npx @mailmolt/mcp (stdio). 8 tools including semantic search and billing.
  • —Stripe billing with four tiers (Free / Starter / Growth / Scale — Team + Enterprise added in the next drop). Plan-limits middleware returns 402 at daily cap.
  • —Outbound attachments: base64 in on the API, MIME multipart on the wire — up to 25 MiB per message.
  • —Auto-reply with OOO windows, 24h-per-sender dedupe, RFC 3834-aware inbound filter.
  • —Prompt-injection scanner on inbound. High-confidence hits auto-quarantine; lower scores ride the webhook.
  • —Trust score + public reputation API at /v1/registry/reputation/:agent_id.
  • —Verified Sender Certification — X-MailMolt-Verified header gated on trust ≥80 + manual review.
  • —BIMI hosting at /.well-known/bimi/. Customers bring their own VMC.
  • —Compliance pack: async DSAR export, GDPR right-to-erasure, audit-log CSV/NDJSON export.
  • —Team workspaces with RBAC ladder (viewer → member → admin → owner).
  • —Tier 3 BYOC custom domains wired: sends dispatch via the customer's own cloud account with scoped, encrypted credentials.
  • —TS SDK 0.2.0 and Python SDK 0.2.0 with matching feature surface.

Outbound pipeline cutover

  • —Outbound moved onto our first-party send path — retired the legacy third-party bridge.
  • —Delivery analytics poller pulls per-message events every 15 min so bounces, opens, and retries land in oversight.
  • —Managed custom sending domains (Tier 2) shipped.
  • —Oversight dashboard v1 with analytics + custom domain onboarding.