Untrusted e-mail content in personal agents

[stbenjam]

I have, perhaps quite stupidly, given my *claw of the day (currently Hermes) access to my personal e-mail.

In a fit of paranoia, I thought it would be useful to have some protections around it so I came up with https://github.com/stbenjam/MailGuard-MCP

It only returns content from trusted senders, and makes some attempt to strip various things out. I am fairly happy with this.
I didn't see anything like it and it might align with lobstertrap's ideals. I am curious what your thinking was about how e-mail should be handled for these agents.

I noticed various models, even those on the smaller side like Gemma 4 26 A3B were quite good at resisting my laziest attempts at prompt injection on their own.

I'm also wondering if maybe instead of, or in addition to, I could have e-mail content parsed by a small classifier model or using something like https://github.com/protectai/llm-guard.