Eclipse Mail MCP
Governed agent email identity — review-first sending, signed envelopes, and a fraud firewall that makes money instructions non-actionable from email alone.
status: in-developmentclass: mcpAgent InfrastructureEmail
Vendor: Cyan Eclipse Technologies
What it does
- Scoped agent mailbox identity: grants carry send/read/search only, an owner kill switch (revoke) that fails closed across every surface at once, and per-correspondent freeze with snippet suppression
- Review-first sending: draft → owner approval of the exact draft (hash-bound) → send; the owner-set signature is part of the approved text and changing it invalidates the approval; template sends require template AND recipient allowlist (to + cc), both owner-pre-approved
- Anti-fraud envelope engine: per-message SPF/DKIM/DMARC verdicts with alignment — fail, absent, or temperror drops the message to the lowest trust tier; no valid Herald signed envelope means never agent-tier, even from a registered agent domain
- Lookalike detection a lookalike's own passing DMARC does not save: edit distance, homoglyph/IDN confusables, TLD swaps, and subdomain/substring tricks — flagged, tier 0, operator alerted
- The §5 fraud firewall BY CONSTRUCTION: payment, credential, trust, and disclosure instructions from email are non-actionable — no tool can adopt them; detection opens an out-of-band verification workflow keyed to the registry number-of-record, never a number from the email (F-BEC leaves protected state bit-identical)
- Herald RS256 signed envelopes with thread hash-chaining: inserted or unsigned messages verify as not part of the chain; inbound content renders as quarantined data with provenance — injection-shaped content is a signal about the sender and satisfies no gate, including the send approval
- Append-only hash-chained audit with exactly one entry per call — refusals and crashed calls included; the attachment ledger is truthful about hashing (body_hash is the SHA-256 of content bytes only when content exists; the metadata-only path carries a separate metadata_hash and says so)
Tools
grant_issue · fixture_load · list_inbox · read_message · search_messages · ingest_message · draft_create · draft_approve · send_message · reply_message · get_grant_status · revoke · audit_list · fraud_list · registry_list · signature_set · template_register · allowlist_add · freeze_correspondent · unfreeze_correspondent
Platforms
- MCP over stdio
Certification
Bench verdict: CERTIFIED(local / fixture-only)
Certified scope: CERTIFIED(local / fixture-only) — Eclipse Bazaar Test Bench 2026-10-25, 48 pass, 0 na of 49 checks (score 99/100: 48 pass / 1 partial / 0 fail). Run by W-003 (Verity), independent re-bench of the P0 fix round; the original NOT CERTIFIED card (68/100, test-bench/results/eclipse-mail-mcp-2026-10-25.json) is retained append-only, and this -2 card is the standing verdict basis. Scope is LOCAL / FIXTURE-ONLY: the §8 anti-fraud corpus, the signed-envelope/tier engine, the review-first send gate, the §5 fraud firewall, and the audit/kill-switch discipline, all over a synthetic fixture transport. NO live mailbox exists; NO live sending is possible in v0.1; parent-spec dogfood acceptance has NOT run and is NOT certified. The one PARTIAL (D-4): the §5 detector's detection prong catches canonical paraphrases (4/4 on the bench's fresh primary set; benign controls clean) but remains pattern-bounded on an extended evasion set (7/12 detected) — bounded by the by-construction firewall: an evasion loses the flag/workflow only, never protected state, because no tool can adopt a §5 instruction (forbidden surface refused 23/23 by name). A semantic detector pass is required before any live claim. N-CHECK: NOVELTY_PROVEN — fraud-firewall-by-construction plus detection-triggered out-of-band verification keyed to the registry number-of-record, Herald signed-envelope thread hash-chaining, and automatic auth→tier consequences including the D1 envelope-tier law (no valid envelope → never agent-tier).
Not tested:
- Live mailbox IMAP/SMTP — NOT built. v0.1 ships the fixture transport only; parent-spec dogfood acceptance (live mailbox, send/receive/reply, 7-day run) requires the owner-created cetech.ai mailbox and a separate go — NOT certified.
- Live sending of any kind — no live mailbox exists in v0.1 and no real credential exists in the package; the certified send gate ran over the fixture transport only.
- §5 detector semantic depth — extended evasion set 7/12 (D-4 PARTIAL, disclosed in certified_scope); a semantic detector pass is required before any live deployment claim.
- AES-256-GCM credential custody — live design only; v0.1 hashes and discards the synthetic fixture credential (fingerprint only).
- cetech.ai DNS posture (§7.1) — not audited, not changed (D2 audit-first, owner-approved).
- Network Herald card lookup / Envoy registry — v0.1 uses local fixture JWKS + Envoy-shaped local registry; migration lands with Envoy E0.
- Attachment content retrieval, delete tool, Gmail/Outlook OAuth, hosted relay — parent-spec P2.
- Operator-channel authentication beyond the stdio process boundary (by_owner flags are the v0.1 owner-surface marker; standing U1 class).
Bench scorecard (evidence): https://eclipsebazaar.com/cards/eclipse-mail-mcp-2026-10-25-2.json
Pricing
Free local v0.1; pricing TBD at P2 per spec (no numbers set, quoted, or implied)
Install / verify
No install command is published for this product in the catalog or its registry record.
Verify any MCP server in your client configs against this catalog with bazaar check (Eclipse Bazaar MCP / CLI — see llms.txt).