SirenoRELAY

YOUR MAILBOX GUARDIAN · vdevelopment

Email access, on your terms.

A policy boundary between your mailbox and an agent. It lets the useful mail through—and keeps the rest, including your credentials, where it belongs.

Getting started →Watch it work ↓
Star on GitHub 1
Direct mailbox accessAgent holds upstream credentials

The agent can use the mailbox credential directly. Folder and sender policy is not applied at the relay boundary, and sends bypass relay recipient checks.

Protected relay gatewayScoped bearer token + current policy

SirenoRELAY owns upstream credentials, authenticates the agent token, filters folders and messages, and checks outbound recipients before handoff.

ONE REQUEST · TWO OUTCOMES

Giving an agent your full mailbox is dangerous.

The invoice request below is a concrete example: compare what an agent can see and send through SirenoRELAY with what it receives when it holds direct mailbox credentials.

MAILBOXupstream · credentials stay here

Invoices3 messages

billing@vendor.testApril invoice · €420

newsletter@vendor.testHidden · sender not allowed

billing@vendor.testMarch invoice · €380

Personalhidden

friend@example.testPrivate conversation

SirenoRELAYauthfolder policysender policyrecipient policyUPSTREAM CREDS
NEVER SENT TO AGENT
AGENTconnected with bearer token

“Find the invoices and send them to my financial assistant.”

TOOL CALLlist_foldersagent → SirenoRELAY
VISIBLE FOLDERS InvoicesSent / ReportsPersonal is not returned.

SirenoRELAY returns only folders permitted by the agent's policy.

POLICY ENGINE

A mailbox view shaped by policy, not trust.

01

Folders disappear

Unapproved folders never become part of the agent’s mailbox view or virtual IDs.

02

Senders are checked

An allowed recipient cannot make an unapproved From sender visible.

03

Recipients are enforced

Every recipient is checked before SirenoRELAY hands a message to the upstream provider.

04

Access is rechecked

Bearer-token bindings and current policy are checked again for every operation.

THE CREDENTIAL STAYS WITH THE OWNER

An MCP tool call.
Not a mailbox login.

The agent sends a bearer token to SirenoRELAY’s MCP endpoint. SirenoRELAY—not the agent—loads the IMAP/SMTP credentials, talks to the mail server, applies policy, and returns only the allowed result.

AgentMCP tool call + scoped bearer token
→
SirenoRELAYOwns credentials · checks policy · filters results
→
Mail serverUpstream credentials stay on this side

Run it under a dedicated OS service user or in an isolated container the agent cannot inspect. Do not give the agent access to the config, secret files, process environment, or a direct upstream route. Read the security model →

OWNER OPERATED

Start with a key.
Not a compromise.

Install the relay in the owner-controlled environment. The agent gets a scoped token—not a way into the mailbox.

01 / INSTALLMACOS · LINUX

Homebrew Available after the first release.

$ brew install sergiocarracedo/tap/sirenorelay

Agent-guided setup Install the skill, then ask your agent to use it.

Preview the owner-safe prompt
First install the SirenoRELAY setup skill with `npx skills add sergiocarracedo/sireno-relay --skill sirenorelay`. Then read and use that skill to help me install and configure SirenoRELAY on an owner-controlled account. Verify the Homebrew formula is published before using it. Keep upstream mail credentials and the relay configuration out of the agent environment; guide me through onboarding and policy validation without asking me to paste secrets into chat.

OWNER-OPERATED

Configure the boundary.
Then hand over one token.

Start with interactive onboarding, inspect the policy model, and keep upstream credentials outside the agent’s reach.

Read the docs →