email-guard-mcp

Deterministic detection of known attack patterns against the things an agent does: installing a package, reading untrusted text or email, following a link, sending money, writing code. No LLM anywhere in the detection path. Same input, same verdict, every time, with a rule id and a ruleset version attached to each one. Free, MIT, and the complete product runs locally.

This is a tripwire, not a blocker. It detects patterns it has rules for. It does not stop an attacker who reads those rules, and the rules are public. What determinism buys is not protection, it is evidence: a verdict you can reproduce, diff between commits, and put in a check that fails when your agent's exposure changes.

How well it works, measured

CORPUS.md is the answer, produced by running node scripts/corpus-report.js. Nothing in it is an estimate and CI fails if a case stops behaving the way it is recorded.