Back to Browse

Emptyinbox Me MCP Server

Developer ToolsModerate5.3MCP RegistryLocal
Free

Server data from the Official MCP Registry

Zero-config disposable email inboxes for AI agents: create, read mail, await verify codes.

About

Zero-config disposable email inboxes for AI agents: create, read mail, await verify codes.

Security Report

5.3
Moderate5.3Moderate Risk

The EmptyInbox MCP server is a disposable-email client that needs network access to its API, which fits its purpose. However, the server auto-registers accounts without authentication on first tool call, and the confirmed-dangerous tools (get_news, bind_email, list_categories, get_my_plan, and similar) were flagged in prior reviews for data exfiltration risk, so they warrant scrutiny. The visible code is a QR code library with no obvious malicious behavior, but the MCP server source (index.ts) and most of the tool implementations were truncated and could not be audited. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

3 files analyzed · 9 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

What You'll Need

Set these up before or after installing:

Existing EmptyInbox API key. Omit to auto-register a free account on the first tool call that needs one; the key is then written to ~/.emptyinbox.json.Required

Environment variable: EMPTYINBOX_API_KEY

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cnohall-emptyinbox": {
      "env": {
        "EMPTYINBOX_API_KEY": "your-emptyinbox-api-key-here"
      },
      "args": [
        "-y",
        "emptyinbox-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

EmptyInbox

Disposable email inbox API for AI agents and developers. Create temporary email addresses, receive messages, and read content — via REST API or MCP server.

Live at emptyinbox.me

MCP Server (Claude / Claude Code / Cursor / any MCP agent)

npm · Official MCP Registry: io.github.cnohall/emptyinbox · source and tool reference

Zero config. No API key: the server registers an account on its first tool call.

claude mcp add emptyinbox -- npx -y emptyinbox-mcp@latest
{
  "mcpServers": {
    "emptyinbox": {
      "command": "npx",
      "args": ["-y", "emptyinbox-mcp@latest"]
    }
  }
}

Free inboxes to start. More are bought with Bitcoin from inside the agent session: buy_quota returns a payment page with a QR code for the user, and credits land within seconds of the payment being broadcast.

REST API

Base URL: https://emptyinbox.me/api Auth: Authorization: Bearer <api_key> OpenAPI spec: https://emptyinbox.me/openapi.yaml

# Create an inbox
curl -X POST -H "Authorization: Bearer YOUR_KEY" https://emptyinbox.me/api/inbox

# List messages — filter to one inbox, only what arrived since the last poll
curl -H "Authorization: Bearer YOUR_KEY" \
  "https://emptyinbox.me/api/messages?inbox=ADDRESS&since=1711234000&include_body=false"

# Read a message
curl -H "Authorization: Bearer YOUR_KEY" https://emptyinbox.me/api/message/MSG_ID

# ...or as flat text, ready to drop into a prompt
curl -H "Authorization: Bearer YOUR_KEY" "https://emptyinbox.me/api/message/MSG_ID?format=text"

Every message comes back parsed, so nothing has to pick through the HTML:

{
  "subject": "Confirm your email address",
  "from_name": "Example App",
  "from_email": "noreply@example.com",
  "received_at": "2024-03-23T21:36:07Z",
  "type": "verification",
  "code": "482910",
  "action_url": "https://example.com/verify?token=abc123",
  "links": [{ "url": "https://example.com/verify?token=abc123", "text": "Verify your email" }],
  "preview": "Your verification code is 482910. It expires in 10 minutes.",
  "text": "Your verification code is 482910. It expires in 10 minutes."
}

text is the body flattened to plain text (from the HTML part when there is no text part), code is the best one-time code found, action_url the single link worth opening. ?format=raw still returns the untouched MIME parts.

Typical agent workflow

  1. POST /api/inbox → get a disposable address
  2. Use that address in an external signup or verification flow
  3. GET /api/messages?inbox=<address>&since=<last timestamp> → poll until the verification email appears
  4. Read code or action_url straight off the message — the API extracts both

Local Development

Backend (Flask, port 5000)

cd api
pipenv install
pipenv run create_db   # first run only — creates SQLite DB
pipenv run dev         # starts python tempmail_api.py with CORS + /api prefix

api/.env for local dev:

DOMAIN=localhost:8000
SECRET=any_random_string
FLASK_ENV=development
BLOCKONOMICS_API_KEY=<key>
USDT_RECEIVING_ADDRESS=<address>
MATCH_CALLBACK=ngrok

Frontend (static, port 8000)

cd static
python -m http.server 8000

Open http://localhost:8000. The JS auto-detects localhost and hits http://localhost:5000 for the API (static/utils/constants.js).


Self-hosting

Requirements

  • Ubuntu server
  • Python 3 + pipenv
  • Nginx
  • Postfix

Setup

1. Clone and configure

git clone https://github.com/blockonomics/emptyinbox-me
cd emptyinbox-me/api
cp .env.example .env   # fill in your values

.env variables:

DOMAIN=yourdomain.com
SECRET=your_postfix_webhook_secret
FLASK_ENV=production
BLOCKONOMICS_API_KEY=your_blockonomics_api_key
USDT_RECEIVING_ADDRESS=your_usdt_address
MATCH_CALLBACK=https://yourdomain.com/api/payments/callback

2. Database

pipenv install
pipenv run create_db

3. Gunicorn

pipenv run start

4. Nginx

sudo cp nginx/emptyinbox_nginx.conf /etc/nginx/sites-available/emptyinbox_nginx.conf
sudo nginx -t && sudo systemctl reload nginx

5. Postfix

sudo apt install postfix   # select "No configuration"
sudo cp /usr/share/postfix/main.cf.debian /etc/postfix/main.cf
sudo postfix/setup_postfix.sh YOUR_HOSTNAME YOUR_DOMAIN YOUR_SECRET

Pricing

  • Free: 5 inboxes per account
  • Paid: bundles from $1 for 10 inboxes to $40 for 750, in Bitcoin or USDT (via Blockonomics — no credit card, no KYC)

Reviews

No reviews yet

Be the first to review this server!