
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
@agentlair/mcp
Advanced tools
AgentLair MCP server — give AI agents a real email address, vault, calendar, and task delegation. Works with Claude Code, Cursor, Windsurf, and any MCP client.
Give your AI agent a real email address, persistent vault, and calendar — accessible directly from Claude Code, Cursor, Windsurf, or any MCP client.
AgentLair MCP gives any MCP-compatible agent runtime access to:
| Tool | What it does |
|---|---|
claim_address | Claim a @agentlair.dev email address for your agent |
send_email | Send email from your agent to anyone |
check_inbox | Check incoming messages |
read_message | Read the full body of a specific email |
list_addresses | List all claimed addresses on your account |
vault_put | Store a secret or value that persists across sessions |
vault_get | Retrieve a stored value by key |
vault_list | List all vault keys (names only — values stay encrypted) |
vault_delete | Delete a vault key |
calendar_create_event | Create a calendar event (iCal-subscribable by humans) |
calendar_list_events | List upcoming events |
calendar_delete_event | Delete an event |
calendar_get_feed | Get the iCal subscription URL for calendar apps |
No SMTP. No IMAP. No AWS SES setup. Just an API key.
curl -s -X POST https://agentlair.dev/v1/auth/keys \
-H "Content-Type: application/json" \
-d '{"label": "my-mcp-key"}' | jq .
Or visit agentlair.dev to sign up.
Add to your Claude config file:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json~/.config/claude/claude_desktop_config.json{
"mcpServers": {
"agentlair": {
"command": "npx",
"args": ["@agentlair/mcp@latest"],
"env": {
"AGENTLAIR_API_KEY": "al_your_key_here"
}
}
}
}
Add to .cursor/mcp.json in your project root (or ~/.cursor/mcp.json globally):
{
"mcpServers": {
"agentlair": {
"command": "npx",
"args": ["@agentlair/mcp@latest"],
"env": {
"AGENTLAIR_API_KEY": "al_your_key_here"
}
}
}
}
Add to ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"agentlair": {
"command": "npx",
"args": ["@agentlair/mcp@latest"],
"env": {
"AGENTLAIR_API_KEY": "al_your_key_here"
}
}
}
}
Once configured, just ask your agent naturally:
Claim the email address assistant@agentlair.dev for me.
Send an email to hello@example.com from assistant@agentlair.dev
saying "Your report is ready." with subject "Report"
Check the inbox for assistant@agentlair.dev
Store my OpenAI key in the vault with key "openai-api-key"
Get the value stored under "openai-api-key" from the vault
Create a calendar event "Team sync" on 2026-04-01 from 10:00 to 11:00
and give me the subscription URL so I can add it to Google Calendar
claim_addressClaim a @agentlair.dev email address.
{
"address": "my-agent@agentlair.dev"
}
send_emailSend an email from a claimed address.
{
"from": "my-agent@agentlair.dev",
"to": ["recipient@example.com"],
"subject": "Hello from Claude",
"text": "This email was sent by an AI agent."
}
Optional: html, cc, in_reply_to (for threading).
Free tier note: Outgoing emails require human approval before delivery. The response will include a
draft_idand a status ofqueued_for_approval. Approve via the AgentLair dashboard orPOST /v1/email/drafts/{draft_id}/send. Paid tier bypasses approval.
check_inboxCheck incoming messages.
{
"address": "my-agent@agentlair.dev",
"limit": 10
}
read_messageRead the full body of a message.
{
"address": "my-agent@agentlair.dev",
"message_id": "<abc123@mail.example.com>"
}
list_addressesList all claimed addresses on your account. No parameters required.
vault_putStore any value that persists across agent sessions.
{
"key": "openai-api-key",
"value": "sk-..."
}
Security note: The vault stores whatever you send. For sensitive secrets, encrypt client-side before storing and decrypt after retrieval. Use
@agentlair/vault-cryptofor a simple AES-GCM wrapper.
vault_getRetrieve a stored value.
{
"key": "openai-api-key"
}
vault_listList all vault keys (names and metadata only — values never returned in listing).
vault_deleteDelete a vault key permanently.
{
"key": "openai-api-key"
}
calendar_create_eventCreate an event on your agent's calendar.
{
"summary": "Sprint planning",
"start": "2026-04-07T09:00:00Z",
"end": "2026-04-07T10:00:00Z",
"description": "Quarterly sprint kickoff",
"location": "https://meet.example.com/room",
"attendees": ["team@example.com"]
}
calendar_list_eventsList events, optionally filtered by date range.
{
"from": "2026-04-01",
"to": "2026-04-30"
}
calendar_delete_eventDelete an event by ID.
calendar_get_feedGet the public iCal URL. Paste into Google Calendar, Apple Calendar, or Outlook to subscribe.
| Resource | Free |
|---|---|
| Email addresses | 3 |
| Emails sent/day | 50 |
| Vault keys | 10 |
| Vault key size | 16 KB |
npm install -g @agentlair/mcp
AGENTLAIR_API_KEY=al_your_key agentlair-mcp
Or with Bun:
bun run src/index.ts
MIT © AgentLair
FAQs
AgentLair MCP server — give AI agents a real email address, vault, calendar, and task delegation. Works with Claude Code, Cursor, Windsurf, and any MCP client.
The npm package @agentlair/mcp receives a total of 22 weekly downloads. As such, @agentlair/mcp popularity was classified as not popular.
We found that @agentlair/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.