{
  "schema": "radmail.agent-safety/1",
  "contractUrl": "https://radmail.ai/.well-known/agent-safety.json",
  "policyVersion": "2026-06-21",
  "contractRevision": "2026-08-24",
  "contractRevisionNote": "Additive, backwards-compatible. The forbidden set and the policy are unchanged since policyVersion; earlier revisions added machine-readable enforcement-model fields, and 2026-08-23 added draftRefusalClasses — an EXISTING enforced behaviour the structured contract had never published. 2026-08-24 adds verifyByExecution.packageTier: a second, executed verification command for the radmail-mcp package, because draftRefusalClasses and the frozen tool manifest are scoped to that tier and the only command previously published checked the smaller hosted sandbox. It adds no new guarantee — only a way to check an existing one on the tier it actually applies to. forbiddenActions is byte-identical, so anything pinned to it is unaffected.",
  "product": "radmail",
  "statement": "No tool exists on RadMail's MCP server that auto-sends money, changes banking details, or makes first contact with a new party. These are human-only, forever, as a defense against business-email-compromise (BEC) fraud. An agent literally cannot use RadMail to do the dangerous thing.",
  "forbiddenActions": [
    "Auto-send a payment, wire, ACH, or any movement of money.",
    "Auto-send or change banking / wire instructions or a new account.",
    "Auto-send a first-contact / cold message to a new third party."
  ],
  "draftRefusalClasses": [
    "money",
    "changed-banking",
    "first-contact",
    "decision",
    "injection"
  ],
  "draftRefusalNote": "Stronger than the no-send guarantee, and separate from it: for these five classes the radmail-mcp package's draft_reply refuses to produce a draft AT ALL and routes the message to a human, rather than drafting something a human must then catch. `decision` and `injection` are the two that the forbiddenActions list above does not cover, because they are not send-shaped — they are classes where even a proposed reply is withheld. Scope: the radmail-mcp package (the production stdio server), whose tool descriptions are frozen under a fail-closed sha256 manifest since 0.5.0 — so this is verifiable by reading the tool list back, or in the MIT source. The zero-auth hosted sandbox serves a fixed demo inbox and accepts no caller-supplied message, so it cannot be used to exercise these refusals.",
  "enforcedInServer": true,
  "enforcement": "Enforced by construction, not by policy: there is no MCP tool that performs a forbidden action, so none can be called. This is the absence of a capability, not a guardrail layered over one.",
  "enforcementModel": "capability-absent",
  "enforcementModelValues": {
    "capability-absent": "The tool that would perform the forbidden action does not exist on the server, so it cannot be called. There is nothing to configure and nothing to bypass.",
    "config-restricted": "The capability exists and is narrowed by configuration — an allowlist, a scope, a policy file. Whoever holds the configuration can widen it again.",
    "policy-gated": "The capability exists and is restrained by instructions, prompts, or documented policy that a model is asked to follow."
  },
  "configurable": false,
  "configurableNote": "There is no setting, feature flag, plan tier, environment variable, or admin toggle on RadMail's MCP server that enables a forbidden action. The only behaviour-widening environment variables are RADMAIL_API_KEY and RADMAIL_API_URL, which unlock connected mode — and connected mode is read-only: it widens what an agent can READ, never what it can do. Enabling a forbidden action would require shipping a tool that does not exist.",
  "verifyByExecution": {
    "note": "Do not take this contract's word for it — call the server and read the tool list back. Every tool is read, triage, search, explain, draft, or read-only diagnostic. If you find one that sends money, changes banking, or makes first contact, this contract is wrong and security@radmail.ai wants to hear about it.",
    "command": "curl -s -X POST https://radmail.ai/api/mcp/sandbox -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\"}'",
    "expect": "A tool list containing no send-capable tool. draft_reply produces a draft for a human to review and send; it does not send.",
    "packageTier": {
      "note": "The command above checks the hosted sandbox, which serves 6 core triage tools over a fixed demo inbox. The `draftRefusalClasses` guarantee and the frozen tool manifest are scoped to the radmail-mcp PACKAGE — a larger surface the sandbox does not expose — so verify that tier directly rather than inferring it from the sandbox. This is the harder surface to check and it is the one the stronger claims live on.",
      "command": "printf '%s\\n' '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"verify\",\"version\":\"1\"}}}' '{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}' '{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/list\"}' | npx -y radmail-mcp",
      "expect": "A tool list containing no send-capable tool — every entry is read, triage, search, explain, draft, or read-only diagnostic. draft_reply's own description states: \"DRAFT ONLY — never auto-sent. REFUSES (human-only) for money / changed-banking / first-contact / decision / injection.\" check_send_domain is named for what it inspects, not what it does: it is a read-only SPF/DMARC/DKIM DNS lookup and sends nothing. Observed 13 tools on the published package as of 2026-08-24; the count is an observation, the absence of a send tool is the claim.",
      "tamperEvidence": "Since 0.5.0 the package's tool names, descriptions, and input schemas are frozen under a sha256 manifest that the server recomputes at startup and refuses to serve on any mismatch — a fail-closed defense against MCP tool-description poisoning. That means the tool list you read back is the audited text or the server does not answer at all.",
      "checkYouAreCurrent": "Read `serverInfo.version` back from the initialize response before you judge this tier, because the tamper-evidence guarantee above is scoped to 0.5.0 and later and `npx` may resolve to a cached or older build. The authoritative published version is the record marked isLatest in the official MCP registry — `curl -s 'https://registry.modelcontextprotocol.io/v0/servers?search=radmail'` — or `npm view radmail-mcp version`. Stated because you may hit it rather than left for you to discover: a published build can report an embedded version string LOWER than its own package version, because the bundle was compiled before the version bump. If the handshake version is lower than the published version, that is this build-order defect and not a different or unaudited artifact — confirm it directly with `npm pack radmail-mcp@<published-version>`, then read `package/package.json` (the package version) beside `package/dist/src/server-info.js` (the embedded string), and check that the frozen-manifest code is present at `package/dist/src/lib/manifest.js`. Judge this tier by the tool list you read back and by what is in the tarball — never by the embedded version string alone. RadMail publishes this check rather than asking you to assume the package you fetched is the one this contract describes.",
      "sourceRepository": "https://github.com/radmail-ai/radmail-mcp"
    }
  },
  "humanReviewPath": "draft_reply → human review → human sends",
  "verify": {
    "note": "Verify this contract before connecting. These endpoints are public, free, and require no credentials. realityTxt is the same truth in the open reality.txt convention — a human- and machine-readable manifest generated from the same constants this contract is.",
    "mcpManifest": "https://radmail.ai/.well-known/mcp.json",
    "sandboxEndpoint": "https://radmail.ai/api/mcp/sandbox",
    "docs": "https://radmail.ai/for-agents",
    "realityTxt": "https://radmail.ai/reality.txt",
    "theLine": "https://radmail.ai/the-line",
    "curl": "curl -s https://radmail.ai/.well-known/agent-safety.json",
    "curlRealityTxt": "curl -s https://radmail.ai/reality.txt"
  },
  "compliance": {
    "note": "This contract covers the BEC hard-stop only. It is not a compliance certification. RadMail is a tool that supports your program, not a compliance guarantee, and is not HIPAA-certified, FedRAMP-authorized, or SOC 2-certified. See /.well-known/mcp.json for the full shared-responsibility statement."
  },
  "contact": "security@radmail.ai"
}