SecureMyTechnology · Personal Gmail Agent

Your inbox, cleaned by AI.
Your data, never leaving your desk.

A local-first Gmail cleanup agent that pairs a local LLM with an identity-gated security perimeter, so bulk cleanup is fast, automated, recoverable, and private. Built for people who use AI heavily and trust it exactly as far as it can be verified.

Do not ask the model to behave. Make misbehavior impossible.

100% local reasoning $0 inference cost 0 permanent deletes, by construction 30-day recovery on everything 1 tap phone approval on sensitive mail
The problem

60,000 emails, and no safe way to let an agent near them

Inboxes decay by default: promotions, expired verification codes, dead calendar invites, drafts you abandoned on your phone. The tooling to fix it at scale has been stuck between two bad options.

Cloud AI wants everything

Hosted assistants need full mailbox access, and your mail becomes someone else's context window. Statements, medical mail, family threads: all of it leaves the machine.

Models hallucinate; inboxes are forever

LLMs invent outcomes and misread instructions. Give one delete authority and a single confident mistake becomes unrecoverable data loss.

No management, no automation

Manual cleanup does not scale and does not repeat. Nothing watches the piles that rebuild every week, and nothing tells you what is actually safe to clear right now.

The inbox dashboard: one card per built-in cleanup with a truthful ready count, a Preview cleanup button, and a Run automatically toggle
Open the app and the dashboard already knows: what is safe to clear, exactly how many, and which cleanups you want watched on a schedule.
The answer

Four walls, and a model that never holds the keys

🔒

Private by architecture

Reasoning runs on a local LLM (Ollama, Qwen 3). Mailbox content never reaches a hosted model, and once the laptop is on your desk, the intelligence is free. Cloud brains are optional, never required.

🛡

Safe by construction

The Google credential holds gmail.modify and nothing more, so permanent deletion is structurally impossible. Every action is two-phase: the model proposes a preview, a human confirms, and only then does a one-time token execute. A build-failing test guards the structure.

🔑

Identity-gated

IBM Verify fronts the app: OIDC with PKCE, token introspection on every call, and DPoP sender-constrained tokens (RFC 9449) bound to a private key that stays on the laptop. A stolen token is useless without the key. Sensitive cleanups require a push approval on your phone, and a suspicious tap fires a kill switch that revokes the Google grant and tears down every session.

⚙

Managed and automated

A dashboard of built-in cleanups shows truthful ready counts (starred and protected mail already excluded, so a number never overpromises). Toggle any cleanup to run automatically, daily or weekly, and it surfaces what is ready every time you open the app. Every action lands in an activity log with one-click Undo.

Animated architecture: you chat with a local model, the agent proposes, the MCP server holds all authority, IBM Verify approves on your phone, Gmail only ever sees a trash-only credential
The request path, animated: the model reasons locally, a custom MCP server holds all real authority, identity decides, and Gmail only ever sees a trash-only credential.
What it does

Everything an inbox needs, nothing an attacker wants

✓Chat-driven bulk cleanup. Ask in plain language; get a preview card with counts, top senders, and samples before anything moves.
✓Trash, archive, or label. Every preview offers dispositions; labeling is non-destructive and touches everything, archive never needs approval.
✓Keep-the-latest sweeps. Clear a sender's backlog while automatically keeping the newest message from each.
✓One-click Undo, 30 days. Every executed cleanup is reversible from the activity log for Gmail's full Trash window.
✓Deterministic sensitivity tiers. Server-side rules, never the model, decide what counts as financial or personal. Tier 3 requires phone approval.
✓Protected senders and contacts. Config lists plus opt-in Google contacts protection; excluded before a cleanup is even proposed, re-checked at execute.
✓Starred means keep. Always. A starred email is never trashed or archived: excluded structurally at preview and re-checked live at execute. No toggle, no exceptions.
✓Truthful dashboard counts. "N ready" already excludes starred and protected mail, so the number you see is the number that moves.
✓Scheduled routines. Any built-in cleanup runs automatically, daily or weekly, still fully human-confirmed.
✓Unsubscribe surfaced, never sent. List-Unsubscribe links are shown for you to click. The agent has no send capability at all.
✓Batched at any scale. Six thousand matches? It pages through in safe batches with a structural guarantee the cycle terminates.
✓Kill switch. A "suspicious" tap on the phone, or repeated denies, revokes the Google grant and destroys every session tenant-wide.
A Tier-3 confirmation card: 356 messages to trash, 88 kept as protected, 4 kept starred, five flagged financial, phone approval required
The two-phase-commit moment: 356 proposed, 88 kept as protected, 4 kept because they are starred, financial mail flagged, and the phone gets the last word.
"The model lied to me. It did not matter."
A hallucinating model cannot delete, cannot skip preview, cannot mint approvals, and cannot invent tools. The walls were designed for the moments any model is wrong.
Where it goes next

The roadmap moves authority further from the model

Verify policy

Policy-evaluated step-up via IBM Verify Token Exchange (RFC 8693). Today the tier engine gates sensitive actions in code and fires the push directly. Next, every sensitive execute is fronted by a real token exchange evaluated by a Verify access policy: an auditable, centrally managed decision the agent cannot see, influence, or bypass. No hallucination and no compromised prompt gets past policy, because the model was never part of the decision.

Signals

SSF/CAEP transmitter. The kill switch becomes a shared-signals emitter, so a revocation here propagates as a standard continuous-access event to everything else that trusts the session.

Reach

Nudges when the app is closed. A background launchd agent and native macOS notifications, so "448 ready to clear" can find you without the app open. Same rule as everything else: it can tell you, it cannot act.

Insight

Analytic cleanups. Cadence detection for daily digests (keep today's, clear the backlog), high-volume rarely-opened senders, and unsubscribe candidates ranked by noise.

Voice

An LLM-written health read. The daily summary gets a natural-language voice over the same deterministic counts. The model narrates numbers; it still never produces them, and it still never decides an action.