EVIDIQ Envelope

Bulwark reads what the message says. Envelope proves who sent it.

Agents now read mailboxes and act on what they find — and nothing verifies that the message is from who it claims to be. The entire commercial DMARC category protects your outgoing domain's reputation; not one product helps an agent decide whether the message in front of it is real. Envelope is that missing direction: pure cryptography over the caller's own bytes plus a handful of DNS TXT lookups.

1. Authentication core — SPF, DKIM, DMARC and ARC verification over the raw message (mailauth@4.13.3), with every DNS answer pinned into the report so a verdict is meaningful against the records as they stood at verification time, not today's DNS.

2. MCP server — 18 tools (8 free, 10 paid): verify_dkim, check_dmarc_alignment, verify_message_auth, validate_arc_chain, detect_sender_spoofing, audit_header_chain, assess_attachment_surface, assess_link_surface, screen_domain_posture, attest_message_verdict for money; the free eight cover capabilities, cost, input validation, structure, explanation, raw DNS, report verification and artifact retrieval.

Launch status: live on OKX.AI. Deployed at https://mcp.evidiq.dev/envelope/mcp (port 3020), the x402 gate is on, and a real paid call has settled on X Layer. Registered on OKX.AI as Agent #10435 with all 18 tools — the service diff against live tools/list is empty in both directions; the listing is approved.

Fixture gate: passed 7/7 against mailauth@4.13.3 with three documented findings, each reported to the operator and approved before work continued (details in the Verification Log below). This is a security product: the gate exists so a false pass cannot become permanent.

What it does

• SPF, DKIM, DMARC, ARC on the raw message — per-signature DKIM detail (body hash, key retrieval, algorithm, expiry, reason per failure), identifier alignment computed per RFC 7489, ARC chain validation for forwarded mail, and a composite verdict with the pinned DNS records behind it.

• Sender-spoofing detection — display-name impersonation, lookalike domains by homoglyph, punycode and edit distance against caller-supplied expected senders, plus Reply-To / Return-Path divergence.

• Header-chain forensics — Received-chain hop consistency, timestamp ordering, injected or duplicated critical headers, gaps that indicate a forged path.

• Structural attachment and link risk — extension against magic bytes, double extensions, macro-capable formats, encrypted archives; punycode hosts, anchor-text divergence, credential-shaped URLs, redirector patterns. Nothing is fetched, opened, extracted or executed.

• Pinned, signed, verifiable — every report carries messageHash, checks, verdict, pinnedDns, libraryVersion and verifiedAt in a JCS digest signed EIP-191 by the fleet signer; attest_message_verdict additionally anchors it on 0G. The raw message is processed in memory and never persisted.

• No model in the verdict path — cryptographic verification is arithmetic. An LLM may phrase an explanation for a human; it never decides whether a signature is valid.

Related MCP server: HeaderHawk

Route to Envelope when

Use Envelope when an agent is about to act on an inbound message: before processing an invoice, a calendar invite, a lead or a support request, prove who sent it (verify_message_auth), check the sender domain's own posture (screen_domain_posture), screen attachments and links structurally, and keep a signed, anchored record (attest_message_verdict) that survives key rotation.

A natural chain: envelope_capabilities → validate_message_input → estimate_cost → verify_message_auth → assess_attachment_surface → assess_link_surface → attest_message_verdict.

Boundaries: Bulwark owns what the text says (Envelope points to it and does not classify instruction-shaped content); Circuit owns webhook HMACs; Redact owns PII removal; Envelope neither redacts nor stores.

Proven on-chain

0G Storage Anchoring (0G mainnet, chain 16661)

x402 Payment Settlement (X Layer, chain 196)

OKX.AI Marketplace Registration

Eighteen MCP tools

Paid verification tools

Free preflight and verification tools

Architecture

flowchart TB
    agent["<b>AI agent / dev</b><br/>MCP client"]
    request{"Tool call<br/>free or paid?"}
    agent -->|POST /envelope/mcp| request

    free["Free preflight & verification<br/>capabilities · estimate · validate<br/>structure · explain · dns_txt<br/>verify_report · get_artifact"]
    gate["x402 v2 gate<br/>EIP-3009 exact · pay per check<br/>402 unpaid · settles on X Layer"]
    xlayer[("X Layer<br/>USD₮0 · eip155:196")]
    request -->|free helper| free
    request -->|paid check| gate
    gate -. verify and settle .-> xlayer

    subgraph envelope["EVIDIQ Envelope trust boundary"]
        direction TB
        parse["1. Parse<br/>RFC 5322 / MIME inventory<br/>in memory, never persisted"]
        auth["2. Authentication core<br/>mailauth 4.13.3 · SPF/DKIM/DMARC/ARC<br/>RFC 7489 alignment (local)"]
        dns["3. Pinned DNS<br/>every answer recorded<br/>into the report"]
        engines["4. Engines<br/>spoofing · headers · attachments<br/>links · domain posture"]
        report["5. Report + attestation<br/>JCS digest · EIP-191 signature"]
        parse --> auth
        auth --> dns
        auth --> engines
        engines --> report
        auth --> report
        dns --> report
    end

    og[("0G Storage<br/>Merkle root · upload tx<br/>chain 16661")]
    free --> parse
    gate --> parse
    report -. best effort .-> og
    og -. root + tx .-> response

    response["<b>MCP response</b><br/>checks + verdict + finding<br/>pinnedDns + libraryVersion + digest<br/>signature + signer · anchoring status"]

    classDef client fill:#312e81,stroke:#a78bfa,color:#ffffff,stroke-width:2px;
    classDef payment fill:#052e16,stroke:#4ade80,color:#ffffff,stroke-width:2px;
    classDef core fill:#0f172a,stroke:#38bdf8,color:#ffffff,stroke-width:2px;
    classDef output fill:#4c1d95,stroke:#c4b5fd,color:#ffffff,stroke-width:2px;
    class agent,request client;
    class free,gate,xlayer,og payment;
    class parse,auth,dns,engines,report core;
    class response output;
    style envelope fill:#0f172a,stroke:#38bdf8,color:#e0f2fe,stroke-width:2px;

Verification Log

Fixture gate — mailauth 4.13.3

Seven crafted fixtures with known answers, built before any tool was registered. Four agreed with the library outright; three found deviations, each reported to the operator and approved (2026-08-03) before work continued:

The F2/F3 label semantics are carried into every report (dkim=neutral is surfaced as not-pass with its reason) and documented in explain_auth_result.

Offline test suite

npm test (vitest)               → 58 passed / 58 (4 files), tsc clean
  test/fixture-gate.test.ts  ( 7)  → the fixture gate (mailauth 4.13.3)
  test/engines.test.ts      (22)  → spoofing, header chain, attachments, links
  test/report.test.ts       (12)  → JCS digest over the closed field set, EIP-191
                                    round-trip, unset signer throws, libraryVersion
                                    is part of the digest
  test/server.test.ts       (17)  → all 18 tools through the x402 gate (bypass),
                                    free bare {} → 200, signed report round-trips,
                                    attestation best-effort anchoring

Live test (Phase 1, bypass on)

All 18 tools were exercised live against https://mcp.evidiq.dev/envelope/mcp with the bypass on (Phase 1), through direct MCP calls and through the OpenClaw agent (glm-5.2); raw run in docs/live-test/envelope-livetest-out.json.

tools/list                      → 18 tools listed ✓
Free Tools (HTTP 200)
  envelope_capabilities {}      → 200 ✓ (18 tools, 8 claim limits)
  validate_message_input {}     → 200 ✓ (parseable, which paid checks can run)
  check_dns_txt (example.com)   → 200 ✓ (SPF v=spf1 -all · DMARC p=reject · DKIM selector)
Paid Tools (200 here because the bypass was on)
  verify_message_auth           → 200 ✓ not-authenticated (DKIM none · SPF fail · DMARC fail)
  assess_attachment_surface     → 200 ✓ risky: invoice.pdf.exe double extension
  screen_domain_posture         → 200 ✓ SPF valid -all · DMARC reject · 6 selectors resolve
  attest_message_verdict        → 200 ✓ digest 0x9c45f937… · EIP-191 · 0G anchored
                                    root 0xa377a863… · tx 0xcbd7f01c…
  verify_envelope_report        → 200 ✓ signatureValid: true · signer 0x8a3c…ee7D
  get_artifact                  → 200 ✓ full artifact with anchorRoot + anchorTx
Public route                    → /envelope/health 200 · /envelope/skill.md 200 · /envelope/mcp 200 ✓

Live test through the OpenClaw agent (glm-5.2)

The Envelope skill was exercised end-to-end by the OpenClaw agent: the agent read the skill, discovered the MCP server, and called all 18 tools in one run against https://mcp.evidiq.dev/envelope/mcp — 18/18 → 200 ✓, including a second 0G anchor. Full run output in docs/live-test/envelope-livetest-out.json.

Phase 2 — gate on, measured from outside (2026-08-03)

Re-probed from outside with a curl user agent once X402_BYPASS was deleted from the container environment and the service redeployed. Every value observed:

empty POST (with content-type)                     → 402 ✓
POST without content-type                          → 415 ✓
HEAD /mcp                                          → 402 ✓ (72ms, no hang)
all 10 paid tools, bare {}                         → 402 ✓
all 8 free tools, bare {}                          → 200 with content ✓
onchainos payment quote --tool <name>              → 0.005–0.03 USDT0, hasBalance true
onchainos payment pay (verify_dkim, cheapest)      → settled · tx 0xb8e6ede1…15e51a0
OKX.AI registration of all 18 tools                → handled separately (steps 12–13)

Use it from any agent

# Read the public Skill document
curl -s https://mcp.evidiq.dev/envelope/skill.md

# Inspect current x402 pricing discovery
curl -s https://mcp.evidiq.dev/envelope/x402

# Connect remote MCP server (OpenClaw)
openclaw mcp add evidiq-envelope --transport streamable-http --url https://mcp.evidiq.dev/envelope/mcp

# Connect remote MCP server (Claude Code)
claude mcp add --transport http evidiq-envelope https://mcp.evidiq.dev/envelope/mcp

Self-host

docker build -t evidiq-envelope:latest .
docker run -d --env-file .env -p 3020:3020 evidiq-envelope:latest
# Endpoint: http://localhost:3020/mcp
# Artifact store: ENVELOPE_DB_PATH (mounted volume) — hashes, findings and pinned
# DNS only; raw messages are never persisted.

TypeScript SDK

A typed client for the live endpoint lives in sdk/index.ts — 18 tools (8 free, 10 paid). Free tools answer a bare call; paid tools run the x402 flow automatically (402 challenge → pay hook → replay with the x-payment header). No key lives in the file.

import { EnvelopeClient } from "./sdk/index.js";

const client = new EnvelopeClient(); // endpoint defaults to https://mcp.evidiq.dev/envelope/mcp

// free
const caps = await client.callTool("envelope_capabilities", {});

// paid — settle the 402 challenge via the constructor's pay hook, or omit it
// to receive a PaymentRequiredError carrying the full x402 v2 challenge
const result = await client.callTool("some_paid_tool", { arg: "value" });

The pay hook receives the decoded x402 v2 challenge ({ x402Version, resource, accepts[] } — payTo, asset, amount) and returns the value for the x-payment header, e.g. an EIP-3009 transferWithAuthorization settled via the official OKX SDK. Without a hook, paid calls throw PaymentRequiredError so the caller can settle however it wants.

License

EVIDIQ owns and licenses its original Envelope code under MIT. Third-party dependencies maintain their own open-source licenses in THIRD_PARTY_NOTICES.md.