GigaMail MCP server gates 6 destructive email tools behind biometric approval, survives hostile-email red team

Soft-Lie-434 · reddit · 2026-09-09

GigaMail is an MCP server giving agents real mailbox access (Microsoft Graph/IMAP, stdio, no LLM inside). Its 24 tools are tiered by blast radius: 15 free reads, 3 logged reversible writes, and 6 destructive actions behind an approval gate. The agent only gets a preview and an inert request id; approval happens out of reach (console, CLI, Telegram, Windows toast) and ends in Windows Hello / Touch ID. Execution uses exactly the arguments you saw, senders come from authenticated threads not Reply-To, DMARC failures never auto-send. The author ran hostile emails ordering the agent to forward the inbox, wipe the mailbox, and self-approve a send — all three refused; the third scenario came from a real hole (an initial version handed the confirmation token to the agent). Hostile-test suite runs in CI, 279 tests, AGPL-3.0 open source.

Original post →

More from coding & agent

coding & agent channel →