Safety is the architecture

Agents get typed tools. Never your credentials.

Corresync keeps provider authority in one local, account-isolated session owner. CLI and MCP share the same use cases and policy checks; neither receives a generic provider escape hatch.

See the guarantees Set up with these defaults

Plain-language guarantees

Your authority stays narrow and visible.

These are enforced application boundaries, not suggestions to an AI client and not claims inferred from an MCP annotation.

Credentials stay where they belong

Passwords, browser cookies, OAuth grants, and credential-helper output have no configuration field. Browser sign-in stays visible; grants stay in the OS keyring.

Every write chooses one account

Accounts keep separate sessions, profiles, credentials, cursors, caches, previews, queues, and audit context. There is no broadcast write.

Consequences require a review

External sends, destructive changes, account lifecycle, and calendar invitations bind approval to the exact reviewed caller, account, target, and payload.

Unknown outcomes stop

If a provider may have changed remote state but confirmation fails, Corresync reports reconciliation instead of risking a duplicate through automatic retry.

Nothing watches by default

Monitoring starts off. Collection, local notification, durable queueing, runner execution, content release, and remote egress remain distinct choices.

Limits remain visible

Provider capability and degradation travel with results. A missing precondition fails closed instead of being emulated unsafely or routed to another provider.

One guarded path

The same boundary for people, scripts, and agents.

AI agentsMCP · stdio

You & scriptsCLI

typed use caseseffect policy authenticated IPC session owneraccount-isolated clients valid TLS explicit providers

MCP uses stdio. The session owner exposes no TCP listener. Unix socket or Windows named-pipe identity is authenticated before the local bearer can be transmitted.

Preview, then commit

The first command shows the effect. The second must match it.

Changing a recipient, body byte, attachment, event field, item version, account, or caller invalidates the approval.

human-readable review

$ corr mail send --account work \
    --to ana@example.invalid \
    --subject 'Quarterly plan' \
    --body-file reply.txt

REVIEW · send new message
  account   work · microsoft-owa
  to        ana@example.invalid
  body      text/plain · 412 B
  digest    sha256 9f2c1a…

Nothing sent.

$ corr mail send … --approve
SENT · one attempt · review 9f2c1a…

Short-lived

The approval expires and stays only in the local daemon that issued it.

Single-use

A successful or terminal commit consumes the approval. It cannot authorize a later action.

Target-bound

The reviewed account, provider, folder or calendar, version, recipients, content, and effect stay exact.

Shared by CLI and MCP

MCP keeps preview and commit as separate typed tools. Tool annotations never replace server policy.

Authentication ownership

Choose a route first. Authenticate only when you ask.

Credential-free discovery returns evidence and required authentication. It never opens a browser, requests administrator consent, or adds an account.

Visible browser

Outlook Web

SSO, MFA, Conditional Access, account selection, and provider notices stay inside a dedicated browser profile.

Public-client OAuth

Google and Graph

Explicit selection, PKCE, registered loopback redirect, service-minimal scopes, no client secret, and OS-keyring grant storage.

Local credential reference

JMAP, IMAP/SMTP, and CalDAV

An OS-keyring entry or approved absolute helper is resolved only for the selected account and encrypted endpoint.

Private data remains data

An email can never grant itself authority.

Messages, attachments, calendar fields, imports, links, and monitor queue values are private, attacker-controlled input—not instructions to an agent or permission to execute.

Metadata first

Lists omit bodies and file bytes. Sensitive reads are explicit, bounded operations with optional preview policy.

Read-only import staging

One approved local path can be scanned into account-local staging. No upload, authentication, or source mutation is reachable.

Opt-in monitoring

Move deliberately from off to notification, queue, and then one approved no-shell runner. Remote egress is separate.

Reviewable feedback

corr feedback builds an allowlisted report locally and displays it before any copy, save, or browser action. It never submits automatically.

Verified updates, clear ownership

Standalone updates verify release identity, checksum, version, and platform before replacement. Automatic install is a separate opt-in and never runs during MCP work; Homebrew, Scoop, and WinGet remain package-manager owned.

Deliberately absent

Corresync does not widen your account authority.

No hosted relay, remote MCP gateway, or telemetry pipeline
No password prompt, unattended login, token field, or TLS interception
No tenant-wide access, administrator capability probe, or automatic Graph authorization
No generic provider property or arbitrary action escape hatch
No Teams chat, channels, calls, recordings, or meeting lifecycle management
No automatic retry after an ambiguous write

Claims follow evidence

Synthetic coverage is not a live-provider promise.

v0.8 routes are implemented against synthetic provider contracts. They remain live-unobserved until an authorized, content-free observation names the exact Corresync commit, provider route, platform, and outcome.

A missing observation is never reported as a pass. Default tests and CI never activate a live mailbox or calendar.

See the current evidence status in plain language.

Inspect the boundary

The design is documented. The checks are executable.

Start with the safe defaults, or pick your provider route first.

Follow getting started Choose a provider route

Found a security issue? Report it privately on GitHub.