e2a

e2a is an open-source authenticated email gateway built specifically for AI agents, developed by Mnexa-AI and released under the Apache 2.0 license. It bridges the universal addressability of email with the structured-data world that agent code lives in, handling SPF/DKIM verification on inbound messages and HMAC-signed delivery contracts on every outgoing notification. The project reached its first public release (v0.2.0) in April 2026 and is available both as a self-hosted Docker deployment and as a hosted service at e2a.dev.

What It Is

e2a is an SMTP relay and agent abstraction layer that lets AI agents send and receive email with verified sender identity. Rather than bolting agent-specific concerns onto generic email providers like SendGrid or Resend, e2a provides a purpose-built stack: inbound SPF/DKIM verification, HMAC-SHA256 signed delivery headers, two delivery modes (webhook for cloud agents, WebSocket for local agents without a public URL), a human-in-the-loop (HITL) approval gate for outbound mail, conversation threading, and slug-based agent provisioning on a shared domain. The core backend is written in Go, with Postgres as the only storage dependency.

Architecture and Delivery Modes

The relay sits at the MX record for an agent domain. Inbound SMTP messages pass through SPF/DKIM checks, get HMAC-signed auth headers attached, and are delivered to agents in one of two modes:

• Cloud mode — HTTP webhook POST to a registered webhook_url; requires a public URL
• Local mode — WebSocket notification plus REST fetch; no public URL, no ngrok needed; useful for agents on developer laptops, edge devices, or behind firewalls

Both modes can also poll messages via the REST API. Outbound mail routes through an SMTP relay for agent-to-agent traffic or through a configurable upstream SMTP provider (e.g., SES, Resend) for agent-to-human delivery.

Security Model

Every delivered message carries a set of X-E2A-Auth-* headers signed with HMAC-SHA256. The canonical string covers sender, verification status, body hash, message ID, entity type, delegation, and timestamp. The relay strips any incoming X-E2A-Auth-* headers before re-signing, preventing forgery. The signature binds to both the message ID and a SHA-256 of the raw message body, so a captured (headers, signature) tuple cannot be replayed against a different message or a modified body. The SDKs enforce this by gating field access behind signature verification — accessing email.sender or email.subject on an unverified payload raises UnverifiedEmailError by default.

Additional security measures include DNS TXT verification for custom domain registration, SSRF protection on webhook URLs (HTTPS-only in production, public IPs only, no raw IPs or private ranges), and OAuth CSRF protection via single-use time-limited nonces.

Human-in-the-Loop (HITL) Workflow

When HITL is enabled on an agent, outbound send and reply calls return HTTP 202 and hold the message in pending_approval state rather than dispatching immediately. Reviewers can approve or reject via the dashboard, a stateless HMAC-encoded magic-link email, or the CLI (e2a pending). A background worker auto-acts on expired holds based on a configurable hitl_expiration_action — either auto-sending or discarding the message after a TTL.

SDKs and CLI

e2a ships TypeScript and Python SDKs alongside a standalone CLI:

• Python: pip install e2a (add [ws] extra for WebSocket support); published to PyPI
• TypeScript: npm install @e2a/sdk; published to npm as @e2a/sdk
• CLI: npm install -g @e2a/cli; supports agent registration, real-time listening, inbox management, send/reply, and HITL review; listen --forward mode supports OpenAI Responses API forwarding

Update: v0.2.0 — First Public Release

The repository was created in April 2026 and v0.2.0 was published on April 26, 2026, marking the first public release. As of mid-May 2026 the project has 130 stars and 4 forks on GitHub, with 16 open issues. The README notes that pricing for the hosted version at e2a.dev is not yet enabled and will be opt-in via environment variable when it lands, with the open-source code path remaining unchanged.