GigaMail MCP server gates 6 destructive email tools behind biometric approval, survives hostile-email red team
Soft-Lie-434 · reddit · 2026-09-09
GigaMail is an MCP server giving agents real mailbox access (Microsoft Graph/IMAP, stdio, no LLM inside). Its 24 tools are tiered by blast radius: 15 free reads, 3 logged reversible writes, and 6 destructive actions behind an approval gate. The agent only gets a preview and an inert request id; approval happens out of reach (console, CLI, Telegram, Windows toast) and ends in Windows Hello / Touch ID. Execution uses exactly the arguments you saw, senders come from authenticated threads not Reply-To, DMARC failures never auto-send. The author ran hostile emails ordering the agent to forward the inbox, wipe the mailbox, and self-approve a send — all three refused; the third scenario came from a real hole (an initial version handed the confirmation token to the agent). Hostile-test suite runs in CI, 279 tests, AGPL-3.0 open source.
More from coding & agent
- Tabular foundation models over LLMs for predictions: talk at AI Engineer Paris — helloiamleonie · 2026-09-09
- Kimi Work launches Remote Control: drive your desktop agent from your phone — Kimi_Moonshot · 2026-09-09
- Vulcan brings CAD into the Ontology: engineering geometry becomes operational data — pdamodaran · 2026-09-09
- Dev Rant: LLMs Should Build Games on WebGPU + WASM, Not Three.js Abstraction Layers — pvncher · 2026-09-09
- How to Be an Engineer: First Principles + 3 Hours of ChatGPT Per CS Fundamental — jackedAJ · 2026-09-09
- Running a $10,000 AI model at home: Fireworks AI engineer's agentic workflow — David Ondrej · 2026-09-09