Back to Browse

Emptyinbox Me MCP Server

Developer ToolsModerate5.7MCP RegistryLocal
Free

Server data from the Official MCP Registry

Zero-config disposable email inboxes for AI agents: create, read mail, await verify codes.

About

Zero-config disposable email inboxes for AI agents: create, read mail, await verify codes.

Security Report

5.7
Moderate5.7Moderate Risk

EmptyInbox MCP server is a disposable email service with reasonable security practices overall. Authentication is properly implemented with API keys and passkey support, and permissions align well with its purpose (network HTTP, environment variables for credentials). However, there are several code quality and security concerns: loose exception handling that could mask failures, potential origin validation issues in development mode, and a registration flow that lacks rate limiting on the username check endpoint. These are moderate issues that users should be aware of, but the server is not critically broken. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

4 files analyzed · 11 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

database

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Existing EmptyInbox API key. Omit to auto-register a free account on first run; the key is then written to ~/.emptyinbox.json.Required

Environment variable: EMPTYINBOX_API_KEY

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cnohall-emptyinbox": {
      "env": {
        "EMPTYINBOX_API_KEY": "your-emptyinbox-api-key-here"
      },
      "args": [
        "-y",
        "emptyinbox-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

EmptyInbox

Disposable email inbox API for AI agents and developers. Create temporary email addresses, receive messages, and read content — via REST API or MCP server.

Live at emptyinbox.me

MCP Server (Claude / Claude Code / any MCP agent)

{
  "mcpServers": {
    "emptyinbox": {
      "command": "npx",
      "args": ["emptyinbox-mcp"],
      "env": {
        "EMPTYINBOX_API_KEY": "your_api_key_here"
      }
    }
  }
}

Get your API key at https://emptyinbox.me/settings.html

REST API

Base URL: https://emptyinbox.me/api Auth: Authorization: Bearer <api_key> OpenAPI spec: https://emptyinbox.me/openapi.yaml

# Create an inbox
curl -X POST -H "Authorization: Bearer YOUR_KEY" https://emptyinbox.me/api/inbox

# List messages — filter to one inbox, only what arrived since the last poll
curl -H "Authorization: Bearer YOUR_KEY" \
  "https://emptyinbox.me/api/messages?inbox=ADDRESS&since=1711234000&include_body=false"

# Read a message
curl -H "Authorization: Bearer YOUR_KEY" https://emptyinbox.me/api/message/MSG_ID

# ...or as flat text, ready to drop into a prompt
curl -H "Authorization: Bearer YOUR_KEY" "https://emptyinbox.me/api/message/MSG_ID?format=text"

Every message comes back parsed, so nothing has to pick through the HTML:

{
  "subject": "Confirm your email address",
  "from_name": "Example App",
  "from_email": "noreply@example.com",
  "received_at": "2024-03-23T21:36:07Z",
  "type": "verification",
  "code": "482910",
  "action_url": "https://example.com/verify?token=abc123",
  "links": [{ "url": "https://example.com/verify?token=abc123", "text": "Verify your email" }],
  "preview": "Your verification code is 482910. It expires in 10 minutes.",
  "text": "Your verification code is 482910. It expires in 10 minutes."
}

text is the body flattened to plain text (from the HTML part when there is no text part), code is the best one-time code found, action_url the single link worth opening. ?format=raw still returns the untouched MIME parts.

Typical agent workflow

  1. POST /api/inbox → get a disposable address
  2. Use that address in an external signup or verification flow
  3. GET /api/messages?inbox=<address>&since=<last timestamp> → poll until the verification email appears
  4. Read code or action_url straight off the message — the API extracts both

Local Development

Backend (Flask, port 5000)

cd api
pipenv install
pipenv run create_db   # first run only — creates SQLite DB
pipenv run dev         # starts python tempmail_api.py with CORS + /api prefix

api/.env for local dev:

DOMAIN=localhost:8000
SECRET=any_random_string
FLASK_ENV=development
BLOCKONOMICS_API_KEY=<key>
USDT_RECEIVING_ADDRESS=<address>
MATCH_CALLBACK=ngrok

Frontend (static, port 8000)

cd static
python -m http.server 8000

Open http://localhost:8000. The JS auto-detects localhost and hits http://localhost:5000 for the API (static/utils/constants.js).


Self-hosting

Requirements

  • Ubuntu server
  • Python 3 + pipenv
  • Nginx
  • Postfix

Setup

1. Clone and configure

git clone https://github.com/blockonomics/emptyinbox-me
cd emptyinbox-me/api
cp .env.example .env   # fill in your values

.env variables:

DOMAIN=yourdomain.com
SECRET=your_postfix_webhook_secret
FLASK_ENV=production
BLOCKONOMICS_API_KEY=your_blockonomics_api_key
USDT_RECEIVING_ADDRESS=your_usdt_address
MATCH_CALLBACK=https://yourdomain.com/api/payments/callback

2. Database

pipenv install
pipenv run create_db

3. Gunicorn

pipenv run start

4. Nginx

sudo cp nginx/emptyinbox_nginx.conf /etc/nginx/sites-available/emptyinbox_nginx.conf
sudo nginx -t && sudo systemctl reload nginx

5. Postfix

sudo apt install postfix   # select "No configuration"
sudo cp /usr/share/postfix/main.cf.debian /etc/postfix/main.cf
sudo postfix/setup_postfix.sh YOUR_HOSTNAME YOUR_DOMAIN YOUR_SECRET

Pricing

  • Free: 5 inboxes per account
  • Paid: 1 USDT per 10 additional inboxes (via Blockonomics — no credit card, no KYC)

Reviews

No reviews yet

Be the first to review this server!