Lumbox: a zero-LLM MCP tool that scores phishing risk before agents click links
kumard3 · reddit · 2026-10-14
A developer released Lumbox, an email API plus MCP server with a checkemailsafety tool that lets agents vet emails before clicking anything — with no LLM involved, only string checks:
- Reads SPF/DKIM/DMARC from the Authentication-Results header already added by the receiving server
- Flags display names whose domain differs from the actual sender (e.g. "paypal.com support" from a random domain)
- Flags punycode domains, bare-IP senders, and domains with 4+ hyphens
- Checks anchor text vs. href mismatches and detects shorteners
- Returns a 0-100 score, risk level, flag list, plus a separate prompt-injection score for the body
The author admits a blind spot: lookalike domains like paypa1.com with valid SPF/DKIM pass entirely, and asks the community for non-model approaches to that problem.
More from coding & agent
- Scuba emerges from stealth with $34M to build shared context engine for teams and agents — Scobleizer · 2026-10-14
- Connect Claude Code to NotebookLM via MCP to read full docs without burning tokens — Aiden_Tech_Ai · 2026-10-14
- SeedAudio 1.5 teased: AI-generated audio joins the video editing workflow in CapCut — FellMentKE · 2026-10-14
- How I built a 7-agent social media team for a legal consultant client — ifioknkem · 2026-10-14
- Pydantic's Samuel Colvin: Graph libraries are a mistake, your code IS the graph — samuelcolvin · 2026-10-14
- Sentience ships a web app built fully autonomously by agents while its human was on vacation — ditzikow · 2026-10-14