Give your LangChain agent a real inbox

LangChain agents are good at calling tools. They are less good at owning a conversation that a person can reply to next week. Chat history in a graph checkpoint is not a mailbox. If a customer, vendor, or coworker needs to answer by email, the agent needs an address, threads, and a send path that waits for a human.

This is a pattern, not a claimed official LangChain partnership. You wrap Agent Inbox as ordinary tools, keep credentials out of the prompt, and use LangGraph interrupts for approval. Neuro OS can be the place those interrupts land when the work is a company role rather than a notebook experiment.

Four tools, not a kitchen sink

Expose a small tool surface:

• create_inbox — provision username plus domain, return the inbox id. Call this once per role or per tenant, not on every turn.
• list_threads — recent conversations with subject, last message time, and unread state.
• search_mail — find messages by sender, subject, or a token such as an order id.
• draft_send — prepare a reply on a thread. The tool must not actually deliver mail. It returns a draft id and waits.

Read tools can be Allow when the inbox belongs to this agent. Send is Ask. If you also write to a CRM from the same graph, that write is Ask as well.

Create the mailbox with the SDK, then hand the inbox id into the agent state:

from agentinbox import AgentInbox
client = AgentInbox()
inbox = client.inboxes.create(username="support-graph", domain="agentinbox.space")

LangGraph interrupt for human approval

The hard part is not generating a reply. It is pausing the graph until a person has seen the draft. After draft_send, raise an interrupt that carries the thread id, recipients, body, and any attachments. Persist graph state. When the human approves, resume and call the real send. When they edit, replace the draft and send the edited version. When they reject, log the reason and do not send.

That interrupt can render in a local review UI during development. In production, forwarding the thread into Neuro OS is the durable wait surface: the role already has policy, an accountable owner, and an audit log. Do not keep approval tokens in Redis with a five-minute TTL and hope someone is watching the terminal.

Threading is memory

LangChain memory modules store what the model said. Email threading stores what the other party said, including people who never opened your app. Load the thread before you generate. Quote the last inbound message. Keep In-Reply-To and References intact so the next human reply stays on the same conversation — the mechanics are in email threading for AI agents.

Search exists so the agent does not reread the entire mailbox on every turn. Query by customer domain or ticket key, then read two or three threads, not the whole inbox.

What not to put in the chain

Do not embed SMTP passwords in a LangChain hub prompt. Do not let the model invent recipients. Do not auto-send because the classifier scored 0.91. Do not grant one agent every inbox in the workspace. Scope tools to the inbox id in state.

Start with inbound classification plus a drafted reply. Measure how often a human edits the draft. Only then consider letting low-risk internal mail skip the queue — and even then, keep external sends on Ask.

The goal is a LangChain (or LangGraph) agent that people can email, with the same approval culture you already want for CRM writes. Agent Inbox is the mailbox layer. The graph remains yours.

Agent Inbox gives each role a mailbox people can reply to, with forwarding into Neuro OS when a human must see the thread. Outbound mail defaults to Ask. Run the role on Neuro OS. To scope the first inbox, get started.

Explore Neuro OS →