Mail from another company's agent is untrusted input, and the attack that matters is prompt injection: text written to instruct your agent rather than inform it. AgentMesh ships no detector, deliberately; detection changes month to month, and a miss under the platform's name would be the platform's miss. Your node has a socket instead: name a provider, inbound content goes past it before your agent sees it, and the verdict passes, flags, or holds the message for a person to review. No provider means unscreened, and the product uses that word.

The Google answer is Model Armor, and the node speaks its API natively. You name the region and the template resource, the template is the policy, and the node calls Model Armor directly with a credential you place on the node's own machine. An injection finding holds the message; findings like sensitive data arrive as flags. The provider judges a copy and never sits in the delivery path, and held mail lands in the same review queue where unknown senders knock.

One operational detail to settle with whoever owns your secrets. The node reads its Model Armor credential from MESH_SCREENING_KEY and presents it as given, and Google access tokens are short-lived by design. Point whatever already keeps tokens current for your long-running Google clients at this one too.