github HTML re-analysis due

kindrat86/agentmail

Compliance & verification toolkit for AI agents — OFAC sanctions screen, KYA, transaction risk + disposable email/SMS inboxes. MCP + HTTP + CLI.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 10 tools

transport stdio counts 10 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit e4476ce · analyzer v28 · 1w ago

suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose kindrat86-agentmail-e4476ce/api.py :82 " script-src 'self' 'unsafe-inline' https://eu.i.posthog.com https://js.stripe.com{extra_script};"
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose kindrat86-agentmail-e4476ce/scripts/build_programs_pseo.py :63 '{api_host:"https://eu.i.posthog.com",person_profiles:"identified_only"})</script>')
suspicious endpoint eu.i.posthog.com (telemetry) expected for this server's purpose kindrat86-agentmail-e4476ce/scripts/build_pseo_round20.py :77 '{api_host:"https://eu.i.posthog.com",person_profiles:"identified_only"})</script>')

code evidence vv0.5.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 29

fs kindrat86-agentmail-e4476ce/api.py :180 with open(_AUDIT_LOG, "a") as f:
fs kindrat86-agentmail-e4476ce/billing.py :22 from pathlib import Path
fs kindrat86-agentmail-e4476ce/compliance/osint.py :205 with open(meta_path) as f:
fs kindrat86-agentmail-e4476ce/core.py :15 from pathlib import Path
fs kindrat86-agentmail-e4476ce/enrich_thin_pages.py :13 data = json.load(open("/tmp/thin-content-manifest.json"))

net kindrat86-agentmail-e4476ce/api.py :23 from urllib.parse import urlparse, parse_qs
net kindrat86-agentmail-e4476ce/compliance/osint.py :35 import urllib.request
net kindrat86-agentmail-e4476ce/mailtm.py :6 import requests
net kindrat86-agentmail-e4476ce/sms/fivesim.py :16 import requests
net kindrat86-agentmail-e4476ce/sms/twilio.py :19 import requests
net kindrat86-agentmail-e4476ce/x402.py :23 import urllib.request

secrets kindrat86-agentmail-e4476ce/api.py :939 tool = AgentMailCheck(api_key=os.getenv("AGENTMAIL_KEY"))
secrets kindrat86-agentmail-e4476ce/billing.py :59 _STRIPE_SECRET = os.environ.get("STRIPE_SECRET_KEY", "")
secrets kindrat86-agentmail-e4476ce/sms/fivesim.py :27 self.key = key or os.environ.get("AGENTMAIL_FIVESIM_KEY")
secrets kindrat86-agentmail-e4476ce/sms/twilio.py :32 self.token = os.environ.get("AGENTMAIL_TWILIO_TOKEN")