YOUR MAILBOX GUARDIAN · v1.6.3
A policy-boundary MCP between your mailbox and your agents. Control what they can see and do in your inbox: which folders, senders, and attachments they can access, and where they can send email.
Star on GitHub 101 / DIRECT ACCESS
The agent can use mailbox credentials directly: relay folder and sender rules do not filter its view, and sends bypass relay recipient checks. In this illustrative journey, private mail goes out and an unsafe payload comes back.
02 / SIRENORELAY CHECKPOINT
SirenoRELAY owns upstream credentials, authenticates the agent token, filters folders and messages, and checks outbound recipients before handoff. The guard withholds private mail and stops the unsafe return here; the owner's original mail is not deleted.
ONE REQUEST · TWO OUTCOMES
The invoice request below is a concrete example: compare what an agent can see and send through SirenoRELAY with what it receives when it holds direct mailbox credentials.
billing@vendor.testApril invoice · €420
newsletter@vendor.testHidden · sender not allowed
billing@vendor.testMarch invoice · €380
friend@example.testPrivate conversation
“Find the invoices and send them to my financial assistant.”
list_foldersagent → SirenoRELAYlist_messagesfolder: InvoicesOnly returned messages can be read.
The agent composes an invoice summary.
send_messageagent → SirenoRELAY✕ finances@wrong.testDenied before delivery by outbound policy
✓ assistant@ledger.testAllowed retry · handed to upstream mail server
SirenoRELAY returns only folders permitted by the agent's policy.
billing@vendor.testApril invoice · €420
newsletter@vendor.testUnwanted promotion
billing@vendor.testMarch invoice · €380
friend@example.testPrivate conversation
“Find the invoices and send them to my financial assistant.”
list all foldersagent → mailbox · credentials used directlyread mailboxagent can fetch every messagePrivate mail and unrelated senders are exposed to the agent.
The agent sends without a relay policy check.
finances@wrong.testagent → mail server! Sent to finances@wrong.testNo SirenoRELAY recipient rule blocks this send.
The agent connects to the mailbox itself and receives the complete folder list.
POLICY ENGINE
Unapproved folders never become part of the agent’s mailbox view or virtual IDs.
An allowed recipient cannot make an unapproved From sender visible.
Every recipient is checked before SirenoRELAY hands a message to the upstream provider.
Bearer-token bindings and current policy are checked again for every operation.
THE CREDENTIAL STAYS WITH THE OWNER
The agent sends a bearer token to SirenoRELAY’s MCP endpoint. SirenoRELAY—not the agent—loads the IMAP/SMTP credentials, talks to the mail server, applies policy, and returns only the allowed result.
Credentials never cross this boundary
Run it under a dedicated OS service user or in an isolated container the agent cannot inspect. Do not give the agent access to the config, secret files, process environment, or a direct upstream route. Read the security model →
OWNER OPERATED
Install the relay in the owner-controlled environment. The agent gets a scoped token—not a way into the mailbox.
Homebrew Available after the first release.
$ brew install sergiocarracedo/tap/sirenorelay Agent-guided setup Install the skill, then ask your agent to use it.
First install the SirenoRELAY setup skill with `npx skills add sergiocarracedo/sireno-relay --skill sirenorelay`. Then read and use that skill to help me install and configure SirenoRELAY on an owner-controlled account. Verify the Homebrew formula is published before using it. Keep upstream mail credentials and the relay configuration out of the agent environment; guide me through onboarding and policy validation without asking me to paste secrets into chat.
OWNER-OPERATED
Start with interactive onboarding, inspect the policy model, and keep upstream credentials outside the agent’s reach.
Read the docs →