Test-inbox API for email and SMS: create inboxes, long-poll messages, extract OTPs and links.
Scored across 41 tools
Every tool targets a distinct resource-action pair (domain, inbox, hook, webhook, key, phone number, message, SMS, link, OTP, etc.), and the verbs clearly separate create/list/get/wait/clear/delete/follow/verify operations. There is no overlap or ambiguity between tools.
The overwhelming majority of tools follow a consistent verb_noun pattern (create_inbox, list_messages, wait_for_otp, etc.), but 'webhook_deliveries' is a noun phrase rather than a verb_noun command, which is a minor deviation.
With 41 tools, the server exceeds the 25+ threshold for 'too many' tools. While each tool is justifiable for the comprehensive email/SMS/webhook testing domain, the sheer number makes the surface feel heavy and harder to navigate.
The tool set covers full lifecycles for all major resources—create, list, get, wait, clear, delete—and includes specialized operations like verify_domain, follow_link, and webhook_deliveries. There are no obvious gaps or dead ends for the stated purpose of testing email, SMS, and webhooks.
Delete a hook's captured requests but keep the hook and its ingest URL — rerun hygiene between test runs.
Inputs: hook_id (required).
Delete all messages in an inbox but keep the address receiving. Use to reset state between test steps that reuse one inbox.
Inputs: inbox_id (required).
Register a custom domain for receiving test mail. Returns the DNS records (TXT challenge + MX) to publish; the domain accepts mail only after verify_domain passes.
Inputs: fqdn (required).
Create a capture hook: a public HTTPS URL that records every HTTP request sent to it (webhook capture). Point the app under test's webhook config at the returned ingest_url, then call wait_for_hook_request. Receive-only: mailfixture answers a fixed 200 and never forwards or replays. Returns {id, token, ingest_url, label, ttl_expires_at}.
Inputs: label, ttl_seconds.
Create a programmatic email inbox and get its address. Call this at the start of a test flow, then drive the app under test with the returned email_address. Use one inbox per test for isolation.
Inputs: domain, local_part, ttl_seconds.
Create a new API key. The raw key is in this response ONLY — it is stored hashed and can never be shown again. Handle it as a secret.
Inputs: label.
Provision a dedicated US phone number for receiving SMS (paid plans only; numbers are receive-only — mailfixture never sends). Returns {id, phone_number, status}. If status is 'pending', call list_phone_numbers until it becomes 'active' before using the number in the flow under test; then call wait_for_sms_otp.
Inputs: no named parameters.
Create a webhook endpoint (paid plans) receiving signed message.received and domain.verified events. The signing secret is in this response ONLY. Message bodies are never delivered over webhooks.
Inputs: url (required), description.
Delete a custom domain and every inbox and message on it. Irreversible.
Inputs: domain_id (required).
Delete a capture hook and all its captured requests. The ingest URL answers 404 afterwards. Irreversible.
Inputs: hook_id (required).
Delete an inbox and all its messages. Mail to the address is rejected afterwards. Use as test teardown.
Inputs: inbox_id (required).
Delete a webhook endpoint. Pending deliveries to it are dropped.
Inputs: webhook_id (required).
Re-enable a webhook endpoint that was auto-disabled after repeated failed deliveries.
Inputs: webhook_id (required).
Follow (server-side GET) a link extracted from a message — the 'click the verification link' step without leaving the conversation. Defaults to the first verify-classed link; pass class, index, or an exact url to pick another. Redirects are followed (SSRF-guarded, https-only, max 5). Returns {requested_url, final_url, status, redirects, ok} — the target's response body is never returned.
Inputs: message_id (required), url, class, index.
Follow (server-side GET) a link extracted from an SMS — same semantics as the email follow_link tool: defaults to the first verify-classed link, accepts class/index/exact url, SSRF-guarded, https-only, max 5 redirects. Returns {requested_url, final_url, status, redirects, ok}.
Inputs: sms_id (required), url, class, index.
One attachment's decoded bytes, base64-encoded (up to 1 MiB — larger files must be fetched from GET /v1/messages/{id}/attachments/{index}). Index against the attachments array on get_message.
Inputs: index (required), message_id (required).
Full detail of one captured request: method, path, headers (names lowercased; same-name duplicates keep their order, cross-name order not preserved), body as text (body_base64 rides along only when the raw bytes were not valid UTF-8 — signature checks need exact bytes), remote_ip, expiry.
Inputs: request_id (required).
All links extracted from one message, each with anchor text and a class guess (verify | reset | unsubscribe | other). If you are still waiting for the email, prefer wait_for_link.
Inputs: message_id (required).
Full detail of one message: text/html bodies, headers, extracted OTP candidates and classified links, attachment metadata.
Inputs: message_id (required).
The OTP/verification code extracted from one message: best candidate plus ranked alternatives. If you are still waiting for the email, prefer wait_for_otp.
Inputs: message_id (required).
Full detail of one SMS: text, sender, extracted OTP candidates and classified links, expiry.
Inputs: sms_id (required).
List the account's domains (custom ones with verification state and pending DNS setup records, plus the shared domains).
Inputs: no named parameters.
List requests captured by a hook (id, method, path, content_type, body_size, received_at per request; bodies stay on get_hook_request). Set wait to long-poll for new requests; use since as a cursor.
Inputs: hook_id (required), wait, match, since.
List the account's capture hooks with id, ingest_url, label, ttl_expires_at, created_at.
Inputs: no named parameters.
List the account's active inboxes with their addresses and message counts.
Inputs: no named parameters.
List the account's API keys (metadata only — never the key material).
Inputs: no named parameters.
List messages in an inbox (id, from, subject, received_at, tls per message). Set wait to long-poll for new mail; use since as a cursor to skip messages you already processed. Returns summaries — call get_message for bodies and extracted data.
Inputs: inbox_id (required), wait, match, since.
List the account's active phone numbers with id, phone_number (E.164), status, created_at, and release_after (non-null when a plan downgrade scheduled the number for auto-release; upgrading before that date keeps it).
Inputs: no named parameters.
List SMS received on a phone number (id, from_number, text, received_at per message — the text rides in the summary). Set wait to long-poll for new messages; use since as a cursor.
Inputs: phone_number_id (required), wait, match, since.
List the account's webhook endpoints (secrets masked to a hint).
Inputs: no named parameters.
Release a phone number back to the provider and delete its messages. Irreversible — the number returns to the provider pool and may be assigned elsewhere.
Inputs: phone_number_id (required).
Revoke an API key immediately. Revoking the key this session authenticated with locks this MCP connection out.
Inputs: key_id (required).
Queue a test event to a webhook endpoint to confirm it receives and verifies signed deliveries.
Inputs: webhook_id (required).
Run the TXT + MX DNS checks for a pending custom domain right now and return the result. Call after publishing the records from create_domain.
Inputs: domain_id (required).
Block until a matching HTTP request is captured by the hook (or timeout_seconds elapses), then return its full detail. The one-call answer to 'trigger the flow under test, then assert its webhook fired'.
Inputs: hook_id (required), match, since, timeout_seconds.
Block until a message containing an extracted link arrives, then return that link (optionally only a given class: verify | reset | unsubscribe | other). The one-call answer to 'trigger the email, get the magic/verification link'. Returns {message_id, link, links}.
Inputs: inbox_id (required), class, match, since, +1 more.
Block until a matching message arrives in the inbox (or timeout_seconds elapses), then return its full detail. Call this right after triggering an email flow in the app under test.
Inputs: inbox_id (required), match, since, timeout_seconds.
Block until a message with an extracted OTP/verification code arrives, then return the code. The one-call answer to 'trigger signup, read the OTP, type it in'. Returns {message_id, best, candidates}.
Inputs: inbox_id (required), match, since, timeout_seconds.
Block until a matching SMS arrives on the phone number (or timeout_seconds elapses), then return its full detail including extracted data. Call this right after triggering an SMS flow in the app under test.
Inputs: phone_number_id (required), match, since, timeout_seconds.
Block until an SMS with an extracted OTP/verification code arrives on the phone number, then return the code. The one-call answer to 'trigger SMS verification, read the code, type it in'. Returns {sms_id, best, candidates}.
Inputs: phone_number_id (required), match, since, timeout_seconds.
Recent delivery attempts for one webhook endpoint (status, attempts, last error) — the first place to look when events aren't arriving.
Inputs: webhook_id (required), limit.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Disposable email addresses for tests and agents: register, wait for mail, extract codes and links.
Test inboxes for AI agents testing your app: block until the OTP or magic link arrives.
Disposable, receive-only email inboxes for AI agents. Create an address, wait for the verification email, and get the one-time code or magic link back as structured fields. Long-polling wait_for_email with sender and subject filters, attachments, sanitised HTML, and restore for later password resets. OAuth 2.1, hosted in the EU, cannot send email.
Disposable email inboxes for AI agents: create an address, wait for mail, read OTP codes and links.
Add one secure layer between your agents and this server.
