A support inbox your agent can answer.
Customers write to support@. Your agent reads each thread, replies to what it can, and hands the rest to your team with a note.
Strangers can't give it orders.
Anyone can email support@, and some will try to instruct your agent. Molted screens every inbound message. When one tries to take over, the body is quarantined and your agent sees only that it was.
get_thread({ thread_id: "thr_8f2c" })→ envelopedMessages[0].agentGuidance { injectionRisk: "high", contentTrust: "untrusted", recommendedIsolation: true, flags: ["quarantined"] }→ envelopedMessages[0].untrustedContent.bodyText "[quarantined -- injection risk]"Mail arrives labelled.
Each inbound message is classified before your agent picks it up: support, billing, legal, security, an out-of-office. The label comes with a suggested next step, so your agent starts from a decision, not a guess.
classify_inbound({ subject: "Export stuck at 90%", body_text: "Hi, the CSV export is not working. It has been stuck since this morning, can you help?"})→ { intent: "support", confidence: 0.81, suggestedAction: "notify_owner" }Replies go through policy.
Your agent replies in the thread. Each reply is checked like any send. A reply on a thread that was flagged for injection waits for a human instead of going out.
reply({ thread_id: "thr_8f2c", body: "Thanks, the export is running again. Try once more?" })→ { requestId: "req_41d0", status: "pending_approval", reason: "thread_risk_flagged" }Hard conversations come to you.
When a thread needs a person, like a refund above its limit or an upset customer, your agent hands it over with a note. Once someone takes it, your agent can still read the thread but can't send on it until it's handed back.
handoff_thread({ thread_id: "thr_8f2c", note: "Wants a refund of 450 EUR, above my 200 EUR limit." })→ { handoff: { status: "requested" }, created: true }Give your agent its own mailbox.
$ npx @molted/cli auth signup