The rule:

tools/list is discovery.
At least one real tools/call through MCP Boundary is runtime proof.

Current Evidence Summary

Area	Status	What it means
Local Email Demo	verified local demo	Simulated read/draft/send-block flow. No provider or real email.
Gmail-like local stdio server	scoped runtime proof	Downstream-managed OAuth path proved read metadata, controlled draft, controlled send, and selected controlled label/archive/trash actions for configured candidates.
Taylor Google Workspace candidate	scoped candidate proof	Downstream-managed stdio OAuth path proved selected Gmail read/draft/send/trash-label actions. Not a full Workspace claim.
Official Gmail MCP endpoint	provider blocked	OAuth and tools/list worked, but real tool execution was blocked by provider permission.
Database examples	scoped smoke	Useful for read/write rule examples and state binding with synthetic data.
GitHub test repo	scoped smoke	Useful for selected repo/test-account behavior. Not full GitHub support.
Microsoft 365 / Outlook	standalone provider smoke	Softeria 0.129.1 authenticated with a dedicated personal Microsoft test mailbox and completed one get-mailbox-settings call outside MCP Boundary. Full MCP Boundary runtime and work/school tenants remain unverified.

Release Artifact Smokes

The current packaged artifacts were not only built. They were unpacked and smoke tested from the release packages.

Artifact	Status	What was tested
Windows ZIP	artifact smoke passed for dashboard/demo/doctor/serve baseline	--version, quickstart email --no-dashboard, connected dashboard quickstart, doctor, serve email-demo, draft allowed, send blocked, no generic secret-marker output.
Linux tarball	artifact smoke passed in a Linux environment for dashboard/demo/doctor/serve baseline plus bounded credential CLI no-leak path	Same baseline release-smoke path as Windows, executed from the Linux tarball; bounded credential CLI credential_store_unavailable / no-leak path with fake values; no fake credential values leaked to smoke files/logs.

This is still artifact-level smoke evidence. It proves the packaged binaries start and the included local email demo works. It is not a claim that every Linux distribution, package manager, shell, or MCP client has been tested.

Linux package smoke also exercises a bounded credential CLI unavailable/no-leak path with fake values and verifies no fake credential values are leaked.

The current Linux credential smoke exercises:

credentials login-url
credentials login
credentials store-secret
doctor with a credential profile, requiring bounded credential_profile and credential_store statuses
fake-value leak checks for access-secret, refresh-secret-value, client-secret-value, Bearer test-token, and password=hunter2

It proves the packaged CLI handles the bounded credential_store_unavailable path and no-leak checks. It does not prove a successful desktop Secret Service/keyring storage path, real-provider OAuth readiness, or production credential security.

On Linux, credential-store/login depends on an OS keyring backend. Minimal or headless environments may return the bounded status credential_store_unavailable.

Safe Claims

Good:

MCP Boundary can run a configured local MCP server through a checked tool-call path.

Good:

A configured downstream-managed local Gmail-like MCP server has scoped read,
draft, send, and selected label/archive/trash evidence.

Bad:

MCP Boundary supports Gmail.

Bad:

MCP Boundary makes email safe.

Not Claimed

MCP Boundary does not claim:

production security
data-loss-prevention guarantees
prompt-injection protection
universal provider support
safe-by-default sending or deletion
full Google Workspace / Gmail / Outlook / GitHub / database support
hosted multi-tenant gateway behavior

A longer evidence document ships inside the downloaded ZIP/tarball at docs/mcpboundary/publish/guides/tested-servers-and-limits.md.