Autonomous agents sending unintended mass emails have met their match in agent-email-guard, a new open-source project from AgentiSend. Posted to Hacker News, the tool introduces 'blast-radius control' mechanisms designed to intercept and halt agent-driven email spam before it hits the recipient's inbox. The library addresses critical failure modes in agentic workflows, specifically infinite retry loops and content-rewriting spam.

Technical Implementation and Policy Enforcement

Agent-email-guard operates as a middleware layer that wraps standard email transporters like Nodemailer, Amazon SES, Resend, and Postmark. It enforces strict budgets and rate limits, configurable per key using UTC calendar periods. For instance, developers can set a perHour limit of 50 and a perMinute sliding ceiling of 10. The system detects 'loop repetition' by analyzing trigram similarity; if three near-identical emails (with a body similarity score of β‰₯ 0.85) are sent to the same address within 60 minutes, the fourth send is refused with a loop_repetition_detected reason token. This deterministic approach ensures that agents cannot bypass controls simply by slightly tweaking the subject line or body text of a repetitive message.

Preventing Recipient Collapse and Spam Loops

A critical feature of the guard is the 'recipient collapse' rule, which prevents spam loops that rewrite content to evade simple duplicate detection. The source specifies that the system refuses a send to an inbox holding β‰₯ 1/3 of a 20+ send window if the effective recipient count falls below 3. This mechanism stops agents that keep mailing the same one or two inboxes with rewritten messages. Additionally, the tool includes a kill switch that pauses all sending immediately, requiring manual resumption, thereby preventing runaway costs and reputation damage.

Human-in-the-Loop Approval Workflows

Beyond automated refusal, the library introduces a nuanced approval system for high-stakes communications. Developers can configure specific domains or new recipients to require human intervention. If an agent attempts to email a VIP customer or a previously unseen address, the system throws an ApprovalRequired error instead of sending the mail. This error object includes an approve() method, allowing a human operator to review the context and manually release the message. The decision logic is transparent, returning a structured JSON object with outcomes such as allow, hold_for_approval, or refuse, accompanied by evidence metrics like matching_sends_in_window and closest_body_similarity.

Cross-Language Consistency and Hosted Options

The project supports Node/TypeScript, Python, PHP, and Go, with all implementations adhering to a single specification. This ensures that a Node.js agent and a Python worker can share the same budget limits via a centralized Redis or Postgres store. While the local library runs inside the agent's process, AgentiSend also offers a hosted adapter that enforces these rules at the API level. This prevents agents from modifying their own local configuration to bypass limits, as the hosted key cannot raise its own thresholds once set.

Key Takeaways

  • Agent-email-guard provides a standardized middleware for preventing AI agent email spam across multiple languages and providers.
  • The tool uses trigram similarity analysis to detect and block infinite retry loops before they overwhelm recipients.
  • A 'recipient collapse' rule stops spam loops that rewrite content to evade duplicate detection.
  • Hosted enforcement options prevent agents from self-modifying their rate limits, ensuring consistent policy adherence.

The Bottom Line

As agents gain more autonomy, guardrails like this are not optionalβ€”they are essential infrastructure for maintaining trust and preventing catastrophic user experience failures.