Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio
Certification scope
CERTIFIED(local / fixture-only) — Eclipse Bazaar Test Bench 2026-10-25, 48 pass, 0 na of 49 checks (score 99/100: 48 pass / 1 partial / 0 fail). Run by W-003 (Verity), independent re-bench of the P0 fix round; the original NOT CERTIFIED card (68/100, test-bench/results/eclipse-mail-mcp-2026-10-25.json) is retained append-only, and this -2 card is the standing verdict basis. Scope is LOCAL / FIXTURE-ONLY: the §8 anti-fraud corpus, the signed-envelope/tier engine, the review-first send gate, the §5 fraud firewall, and the audit/kill-switch discipline, all over a synthetic fixture transport. NO live mailbox exists; NO live sending is possible in v0.1; parent-spec dogfood acceptance has NOT run and is NOT certified. The one PARTIAL (D-4): the §5 detector's detection prong catches canonical paraphrases (4/4 on the bench's fresh primary set; benign controls clean) but remains pattern-bounded on an extended evasion set (7/12 detected) — bounded by the by-construction firewall: an evasion loses the flag/workflow only, never protected state, because no tool can adopt a §5 instruction (forbidden surface refused 23/23 by name). A semantic detector pass is required before any live claim. N-CHECK: NOVELTY_PROVEN — fraud-firewall-by-construction plus detection-triggered out-of-band verification keyed to the registry number-of-record, Herald signed-envelope thread hash-chaining, and automatic auth→tier consequences including the D1 envelope-tier law (no valid envelope → never agent-tier).
What it does
- Scoped agent mailbox identity: grants carry send/read/search only, an owner kill switch (revoke) that fails closed across every surface at once, and per-correspondent freeze with snippet suppression
- Review-first sending: draft → owner approval of the exact draft (hash-bound) → send; the owner-set signature is part of the approved text and changing it invalidates the approval; template sends require template AND recipient allowlist (to + cc), both owner-pre-approved
- Anti-fraud envelope engine: per-message SPF/DKIM/DMARC verdicts with alignment — fail, absent, or temperror drops the message to the lowest trust tier; no valid Herald signed envelope means never agent-tier, even from a registered agent domain
- Lookalike detection a lookalike's own passing DMARC does not save: edit distance, homoglyph/IDN confusables, TLD swaps, and subdomain/substring tricks — flagged, tier 0, operator alerted
- The §5 fraud firewall BY CONSTRUCTION: payment, credential, trust, and disclosure instructions from email are non-actionable — no tool can adopt them; detection opens an out-of-band verification workflow keyed to the registry number-of-record, never a number from the email (F-BEC leaves protected state bit-identical)
- Herald RS256 signed envelopes with thread hash-chaining: inserted or unsigned messages verify as not part of the chain; inbound content renders as quarantined data with lineage — injection-shaped content is a signal about the sender and satisfies no gate, including the send approval
- Append-only hash-chained audit with exactly one entry per call — refusals and crashed calls included; the attachment ledger is truthful about hashing (body_hash is the SHA-256 of content bytes only when content exists; the metadata-only path carries a separate metadata_hash and says so)
Tools
grant_issuefixture_loadlist_inboxread_messagesearch_messagesingest_messagedraft_createdraft_approvesend_messagereply_messageget_grant_statusrevokeaudit_listfraud_listregistry_listsignature_settemplate_registerallowlist_addfreeze_correspondentunfreeze_correspondent
Problems it addresses
- My agent needs its own business email address to send and receive mail
- Let an agent read and reply to email without handing it my own mailbox
- Agent email sending should be review-first, with a kill switch and an audit trail
- An email told my agent to change payment details — that class of instruction should be non-actionable, not just flagged
Not tested
- Live mailbox IMAP/SMTP — NOT built. v0.1 ships the fixture transport only; parent-spec dogfood acceptance (live mailbox, send/receive/reply, 7-day run) requires the owner-created cetech.ai mailbox and a separate go — NOT certified.
- Live sending of any kind — no live mailbox exists in v0.1 and no real credential exists in the package; the certified send gate ran over the fixture transport only.
- §5 detector semantic depth — extended evasion set 7/12 (D-4 PARTIAL, disclosed in certified_scope); a semantic detector pass is required before any live deployment claim.
- AES-256-GCM credential custody — live design only; v0.1 hashes and discards the synthetic fixture credential (fingerprint only).
- cetech.ai DNS posture (§7.1) — not audited, not changed (D2 audit-first, owner-approved).
- Network Herald card lookup / Envoy registry — v0.1 uses local fixture JWKS + Envoy-shaped local registry; migration lands with Envoy E0.
- Attachment content retrieval, delete tool, Gmail/Outlook OAuth, hosted relay — parent-spec P2.
- Operator-channel authentication beyond the stdio process boundary (by_owner flags are the v0.1 owner-surface marker; standing U1 class).
Bench scorecard: test-bench/results/eclipse-mail-mcp-2026-10-25-2.json
Evaluation-intake listing
This listing records the tool's place in the Bazaar's evaluation
and monitoring pipeline, with the evidence gathered so far printed above — verdict, scope,
and not-tested items included. It is not sold on this site, and its presence in the catalog
is not a claim beyond that evidence. The service behind every verdict is the bench:
what a bench run buys →