anon.li

Add a new recipient email address that aliases can forward to. anon.li sends a verification email to that address; the recipient cannot be used for aliases until the link in it is clicked. Fails with CONFLICT if the address is already a recipient.

Create a new email alias. Pass local_part for a custom address (format defaults to "custom" when it is given), or omit it to auto-generate a random local part. Labels and notes cannot be set here (they are vault-encrypted client-side); the user can edit them from the anon.li web UI.

Permanently delete an alias. This cannot be undone — future mail to the address is rejected. Accepts either the alias ID or the full email address. This tool is flagged destructive (annotations.destructiveHint): MCP clients request user approval before executing it, and fail the call with 'No approval received' — without contacting this server — if approval is denied or unavailable (e.g. headless sessions). Nothing is deleted in that case; approve the client's permission prompt, or allowlist this tool in the client's permissions for unattended use.

Permanently delete a drop and all its files. Reclaims the storage quota. This cannot be undone. Only standalone drops from list_drops are accepted; form attachments are deleted with their form submission. This tool is flagged destructive (annotations.destructiveHint): MCP clients request user approval before executing it, and fail the call with 'No approval received' — without contacting this server — if approval is denied or unavailable (e.g. headless sessions). Nothing is deleted in that case; approve the client's permission prompt, or allowlist this tool in the client's permissions for unattended use.

Permanently delete a form along with all its submissions and any attached file drops. This cannot be undone. This tool is flagged destructive (annotations.destructiveHint): MCP clients request user approval before executing it, and fail the call with 'No approval received' — without contacting this server — if approval is denied or unavailable (e.g. headless sessions). Nothing is deleted in that case; approve the client's permission prompt, or allowlist this tool in the client's permissions for unattended use.

List the email aliases owned by the authenticated user, newest first. Returns one page of aliases with id, email, active state, received/blocked counters, and timestamps, plus total (the number of aliases on the account) — page with offset while offset + returned < total. Labels and notes are omitted because they are vault-encrypted client-side and cannot be read by a third-party client.

List the user's encrypted file drops, newest first, with metadata (file count, total size in bytes as a decimal string, expiry, download counts, state). Returns one page plus total — page with offset while offset + returned < total. File contents and filenames are end-to-end encrypted and cannot be read through this API. Use the web UI or CLI with the user's vault key to access content.

List the user's end-to-end encrypted forms, newest first, with metadata (title, submission counts, state, close date). Returns one page plus total — page with offset while offset + returned < total. Submission contents are E2EE and cannot be read through this API — decrypt them in the web UI after unlocking the vault.

List recipient email addresses that aliases can forward to. Only verified recipients can be used as alias destinations.

Set whether an alias forwards mail: active: true forwards, active: false silently discards incoming mail. Sets the given state (it does not flip), so repeating a call is safe. Returns the resulting state. Accepts either the alias ID or the full email address. Re-activating an alias an administrator took down fails with FORBIDDEN.

Disable or re-enable a drop: disabled: true rejects all downloads, disabled: false restores access. Sets the given state (it does not flip), so repeating a call is safe. Returns the resulting state. Only standalone drops from list_drops are accepted; form attachments are managed with their form.

Disable or re-enable a form: disabled: true rejects all new submissions, disabled: false accepts them again. Sets the given state (it does not flip), so repeating a call is safe; the result mirrors disabled_by_user from list_forms. Returns the resulting state.