Email Guard MCP

Resolve an ENS name to an address and screen that address against the OFAC EVM sanctions lists and the scam/abuse blocklists. Resolution is namehash, then the mainnet ENS registry resolver, then a direct addr() call. There is no ENSIP-10/CCIP-Read, so offchain and L2 names (Basenames, .cb.id, gasless subnames) report resolved:false here even though a wallet resolves them. It does NOT detect lookalike or homoglyph names: no confusable check and no ENSIP-15 normalization, so a spoofed name that resolves to a clean address comes back clean. A failed registry call is reported as a failed lookup, n…

Scan a code snippet for the vulnerability classes that show up most in generated code: injection, SSRF, hardcoded secrets, weak crypto, unsafe deserialization, disabled TLS, XSS. Regex rules matched line by line — no parser, no data flow, no taint tracking. JS/TS and Python only. Fully local.

Scan untrusted text for prompt-injection patterns and Unicode obfuscation before an agent acts on it. Deterministic known-pattern matching plus hidden-character detection, not a classifier: novel phrasing is not covered. Pass text directly, or a url to fetch and scan.

Scan only the added lines of a unified diff, reporting findings against the new file line numbers. Use this on a patch before committing so untouched code does not drown the result. Fully local.

Scan an INBOUND email before an agent acts on it. Parses the message, matches subject and body against known prompt-injection and hijack patterns (including zero-width, bidi and hidden-HTML payloads), compares sender headers (Reply-To and Return-Path domain mismatch, an address hidden in the display name, a 24-name brand list matched as a substring of the display name), and scores the links. The injection scan is deterministic known-pattern matching, not a classifier: novel phrasing, a brand off that list, or a lookalike domain that contains the brand string is not flagged. SPF, DKIM and DMARC…

Scan an OUTBOUND email before an agent sends it. Runs 22 credential patterns (AWS, GitHub, OpenAI, Anthropic, Google, Slack, Stripe, Twilio, npm, JWT, PEM private-key blocks, and api_key/secret/password/token assignments) and 3 PII patterns (email address, US SSN, Luhn-valid card number) over subject, plain-text body and HTML, and returns a redacted copy. It also flags deliverability problems that burn a sender domain (spam-trigger words, ALL CAPS subject, excessive exclamation, missing List-Unsubscribe, image-heavy, many links) and recipient risk (disposable domain, or no MX record which mean…

Find API keys, tokens, private keys and PII in text and return a redacted copy with the secret VALUES removed. Fully local: the text never leaves the machine. Matches 22 known credential formats plus generic assignments; a secret in an unknown format is not detected.

The pre-send check for an agent about to send funds to a crypto address. Takes an EVM address or an ENS name and returns safe, caution or block from three inputs: the OFAC EVM sanctions lists, the ethereum-lists and ScamSniffer scam blocklists, and an on-chain read (brand-new and unused address, which is the shape of a scam drop address, or a contract). Sanctions coverage is EVM-format address lists only, so Bitcoin, Tron, Solana and Monero sanctioned addresses are not checked; it applies to every EVM chain, because OFAC lists addresses by currency rather than by chain. If a list fails to load…

Check an x402 endpoint or merchant URL before paying it. The structural half is local: punycode host, raw-IP host, credentials in the URL, abuse-prone TLD, known shorteners, excessive subdomains, nonstandard port, and a substring match against 14 brand names flagged when the brand is not the registrable domain, so paypal.com.secure-pay.xyz is caught. There is no edit distance and no homoglyph mapping, so an ASCII typo like paypa1.com is not caught by that rule. Domain age needs RDAP and the destination after redirects needs a fetch; the intermediate hops are not analysed. Offline it still retu…

Check a token contract before an agent buys, swaps or approves it: is it a HONEYPOT (you can buy but not sell), does it have an extreme sell tax, is it on a scam/abuse blocklist. The buy+sell simulation comes from api.honeypot.is, which supports Ethereum and Base only and answers 400 "Invalid chain" for polygon, arbitrum and optimism, so the honeypot and tax fields cannot be populated there. It also has no result for tokens with no liquidity pool, which is exactly the population most likely to be a rug. When no simulation ran the verdict is never safe: it is caution, or block if the blocklist …

Open a TLS connection to a host on port 443 and report its certificate: issuer, subject, validity window, days remaining, SANs, protocol, and whether it validates against the system trust store. Port 443 only, and this reads one certificate rather than grading the configuration the way a full TLS scanner would.

Pull a page's machine-readable structured data: JSON-LD (schema.org), OpenGraph and Twitter card tags, plus the schema.org types declared. This is the page describing itself, so treat prices, ratings and availability as claims. JSON-LD that does not parse is skipped rather than repaired.

Generate lookalike names around an npm or PyPI package and report which ones are actually registered and which look recent enough to be suspicious. The variants are heuristic and ASCII only: single-character deletions, adjacent transpositions, doubled letters, the swaps l/1, o/0, rn/m, -/_, ./-, i/l and s/z, and the name with every hyphen or underscore dropped. Up to 20 variants, no Unicode homoglyphs, no prefix or suffix squats such as name-js or python-name, so an empty result is not evidence that nobody is squatting the name. "suspicious" means only that the variant is registered and is eit…

Read a URL's declared metadata for a link preview: title, description, preview image, site name, favicon, canonical URL, language. This is what the page says about itself in its own meta tags, not a verified fact about it. Cheaper than read_url when you only need to know what a link is.

Validate an email address: syntax, a live MX or A lookup on the domain, and disposable, role and free-provider flags. Returns a deliverability call and a 0 to 1 quality score. There is no SMTP probe, so this says the domain can receive mail, never that the specific mailbox exists. The disposable list is fetched and falls back to a small built-in set when it cannot be reached, so a false "not disposable" is possible.

The pre-install guard for npm and PyPI. Call it before installing or recommending a package. Returns safe, caution or danger from deterministic checks: is the name registered, does OSV hold vulnerability or malware advisories for it, how old is it, weekly downloads, deprecation, license. If the name is not in the registry, likely_hallucination is set and npm names come with a "did you mean" list (PyPI names get an empty list). That flag means "not in this registry" and cannot tell an AI-invented name from a typo, a rename, or a package that only lives in a private registry. The slopsquat and t…