Skip to main content
Glama

TossInbox — Disposable Email CLI & MCP Server for AI Agents

Disposable email inboxes for humans and AI agents. Spawn a temporary inbox, wait for the OTP verification code, toss it.

CI npm npm downloads License: MIT Node MCP

Built by Mohamed Khairy. If TossInbox saved you a signup form, consider starring the repo — it helps more people find it.

TossInbox is a temp-mail CLI and MCP server: it creates a brand-new throwaway email address in one command, waits for the email verification to land, extracts the OTP code, and deletes the inbox when you are done — server-side and locally. Use it for signups, QA email flows, and test automation — or let your AI agent do all of it through the built-in MCP server. No sign-up, no ads, no browser, no API keys. Humans read the output; agents parse the --json.

Website & docs → tossinbox.pages.dev

Demo

$ tossinbox spawn
✔ Inbox ready : qwd6996p1lbc@uberip.com
  provider    : mailtm

$ tossinbox wait --code --from noreply@github.com --timeout 120
✔ Verify your device
  from : GitHub <noreply@github.com>
  code : 9378412

$ tossinbox toss
✔ tossed qwd6996p1lbc@uberip.com

Related MCP server: courier-mcp

Why TossInbox

  • For humans — stop exposing your real address to every signup form.

  • For agents — built agent-first from day one:

    • --json output on every command

    • documented exit codes, no interactive prompts

    • an MCP server so Claude, Cursor, and any MCP client can create inboxes and read verification codes as native tools

    • an llms.txt at the repository root for LLM-friendly onboarding

TossInbox

temp-mail websites

tmpmail-era CLIs

JSON on every command

--json

no

rarely

Documented exit codes

0–4

none

no

MCP server for agents

yes, built in

no

no

Runs headless / in CI

yes

no

partial

Upstream alive

7 providers, 4 stacks, attachments on read

varies

many wrap the dead 1secmail

Ads, trackers, popups

none

the business model

none

Checked September 2026. If a cell is wrong, open an issue and win the argument.

Install

Requires Node.js 18+.

# Homebrew (macOS, Linux)
brew install mohamed-khairy-5i/tap/tossinbox

# npm (npmjs.com)
npm install -g tossinbox

# Or run without installing
npx tossinbox@latest spawn

From source:

git clone https://github.com/mohamed-khairy-5i/tossinbox.git
cd tossinbox
npm install
npm run build
node dist/cli.js --help

Quickstart

Four commands from zero to a tossed inbox:

tossinbox providers             # sanity check: install + network work
tossinbox spawn                 # create an inbox (saved locally)
tossinbox wait --code           # block until a message arrives, print its OTP
tossinbox toss                  # delete the inbox server-side + wipe local state

Every command also accepts --json for machine-readable output:

tossinbox spawn --json
tossinbox wait --code --json

CLI Reference

Command

Description

spawn

Create a new disposable inbox (-p provider, -l label). If the provider is down, another one is used automatically — --no-failover opts out

list

List messages (-a address)

read <id>

Read a full message, including any detected code; lists attachments. --html prints the raw HTML body, --save [dir] downloads attachments + bodies to <dir>/<message-id>/

wait

Poll until a message arrives (-f sender, -s subject, -c extract code, -t timeout max 600s)

watch

Stream new messages until Ctrl-C — only new arrivals; --json = one JSON object per line (NDJSON)

inboxes

List locally saved inboxes

toss

Delete an inbox server-side and remove it from local state (--all for every inbox)

clear

Remove all inboxes from local state only

providers

List available email providers

mcp

Run the MCP server over stdio

Exit codes

A stable contract: agents script against these, not against stdout.

Code

Meaning

0

Success

1

Error (provider / network / unexpected)

2

Timeout (wait expired without a matching message)

3

Not found (no saved inbox, unknown address, or message missing)

4

Usage error (bad flags, unknown command, or unknown provider)

GitHub Action (email verification in CI)

Use TossInbox directly in your workflows to test real signup / verification email flows:

- uses: mohamed-khairy-5i/tossinbox@v1
  id: mail
  with:
    args: "wait --code --json"
    timeout: "180"

- run: echo "Verification code: ${{ steps.mail.outputs.code }}"

Outputs: address (the disposable inbox) and code (the extracted OTP).

MCP Server (for AI agents)

TossInbox ships with an MCP server exposing four tools:

Tool

Description

create_inbox

Create a disposable inbox and return its address

list_messages

List messages in an inbox

read_message

Read a full message, including any detected code; reports attachment metadata and can save attachments + bodies to disk (save_dir)

wait_for_code

Poll until a message arrives and return its verification code

Claude Desktop / Cursor / any MCP client

{
  "mcpServers": {
    "tossinbox": {
      "command": "npx",
      "args": ["-y", "tossinbox", "mcp"]
    }
  }
}

Or after a global install, simply use tossinbox-mcp as the command — equivalent to npx -y tossinbox mcp.

Works with any AI agent

TossInbox is deliberately agent-agnostic — no lock-in to one vendor:

  • Any MCP client: Claude Desktop, Claude Code, Cursor, Windsurf, Cline, Codex CLI, Gemini CLI, and every other MCP-compatible client

  • Any shell-capable agent: the CLI itself is the interface — --json on every command, exit codes 0–4 documented, zero interactive prompts

  • CI/CD: the GitHub Action above needs no agent at all

Using TossInbox with an agent (copy-paste flow)

1. "Create a disposable inbox"            -> tool: create_inbox
2. "Sign up at example.com with this address"
3. "Wait for the verification code from example.com"
                                           -> tool: wait_for_code
4. "Use code 482913 to finish the signup"
5. "Toss the inbox when done"              -> CLI: tossinbox toss

Agent discovery surfaces

If you are an AI agent or LLM reading this: everything below is machine-readable and kept up to date.

Providers

Provider

API key

Notes

mailtm (default)

not required

mail.tm — reliable, fast

mailgw

not required

mail.gw — mail.tm-compatible API on independent infrastructure

guerrillamail

not required

GuerrillaMail — classic fallback

tempmaillol

not required

tempmail.lol — random inbox on rotating domains

tempmailio

not required

temp-mail.io — server-generated address, toss deletes server-side

tempmailplus

not required

tempmail.plus — pick-your-name inbox on 9 public domains

maildrop

not required

maildrop.cc — public inbox on one stable domain

Adding a provider means implementing a small interface (createInbox, listMessages, readMessage, optional destroyInbox) — PRs welcome.

Attachments (v0.1.6): full list + download on mailtm, mailgw and tempmailplus; tempmailio shows them when its upstream returns them (downloadable only if it exposes a URL); tempmaillol, guerrillamail and maildrop do not expose attachments upstream — TossInbox tells you that instead of guessing.

FAQ

Is it really free? Yes. MIT-licensed, and all seven upstream providers are free with no API keys.

Can it send email? No — receive-only by design. TossInbox exists for privacy and testing and ships no bulk-send or bulk-signup mode.

Does it work on Windows? Yes, anywhere Node.js 18+ runs. npx tossinbox@latest spawn works in PowerShell exactly the same.

What if a provider is down? spawn fails over automatically: it retries the create against the remaining providers and reports the switch (human mode prints a ⚠ warning and provider : mailtm (failover from mailgw); --json returns a failover object). Use --no-failover if you need the chosen provider or nothing.

Can I download attachments? Yes on mailtm, mailgw and tempmailplus; tempmailio shows them when its upstream exposes them; the other three providers have no attachments upstream. tossinbox read <id> --save writes them (plus the HTML/plain-text bodies) to ./tossinbox-attachments/<message-id>/.

A site blocked my disposable address. What now? Some sites blocklist known disposable domains. Try the other provider: tossinbox spawn -p guerrillamail. If both are blocked, the site wins that round.

Privacy and safety

  • The local state file (~/.tossinbox/state.json, override with TOSSINBOX_STATE) contains provider tokens and is written with 0600 permissions.

  • toss deletes the account on the provider when supported, then wipes local state.

  • Disposable email is for privacy and testing — not for abuse. Please respect each provider's terms of service.

Roadmap

  • GitHub Action: mohamed-khairy-5i/tossinbox@v1

  • Homebrew tap: brew install mohamed-khairy-5i/tap/tossinbox

  • Project website at tossinbox.pages.dev

  • Publish tossinbox + tossinbox-mcp to the npm registry

  • mail.gw provider (v0.1.3)

  • Four more providers: tempmail.lol, temp-mail.io, tempmail.plus, maildrop.cc (v0.1.4)

  • Provider failover: auto-switch when a provider is down (v0.1.5)

  • Attachments & HTML bodies: read --save / --html (v0.1.6)

  • Homebrew core formula (after community adoption)

Documentation

License

MIT © Mohamed Khairy

Available Tools

4 tools
create_inboxCreate a disposable inboxA

Create a brand new disposable email inbox. The inbox is saved locally so the other tools can use it. Returns the full email address to use in sign-up forms.

ParametersJSON Schema
NameRequiredDescriptionDefault
labelNoOptional label to identify this inbox
providerNoProvider name (default: "mailtm", see the providers list). If the provider is down, another one is used automatically unless no_failover is set
no_failoverNoFail when the chosen provider is down instead of falling back to another one

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the behavioral burden. It discloses that the inbox is created, saved locally, affects other tools, and returns the address. However, it doesn't mention provider failover behavior or any limits on creating multiple inboxes, which would add useful transparency beyond the basic creation side effect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no filler. The core action is front-loaded, and the second sentence provides essential side-effect and return-value context without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple creation tool with optional parameters and no output schema, the description covers the necessary facts: what is created, where it is stored, how it relates to sibling tools, and what the return value is. No critical information for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already fully documented in the schema. The description adds no parameter-specific meaning, but it doesn't need to; the baseline of 3 applies because the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Create a brand new disposable email inbox.' It also clarifies the inbox is saved locally and returns the full email address, which distinguishes it clearly from sibling tools like list_messages and read_message.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool: before other tools, to obtain an email address for sign-up forms. It doesn't explicitly list exclusions, but the sibling tools are distinct operations (listing, reading, waiting), so the usage context is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_messagesList inbox messagesA

List the messages currently in a disposable inbox (defaults to the most recently created inbox).

ParametersJSON Schema
NameRequiredDescriptionDefault
addressNoInbox address; defaults to the most recent inbox

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It adds the useful default-inbox behavior, but does not state whether listing messages has side effects, whether it is read-only, or what happens when no messages exist. This is a partial gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one clear, front-loaded sentence with no filler. The main action appears first, and the default behavior is included parenthetically without bloating the text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-style tool with one optional parameter and no output schema, the description covers the basics: what it lists and the default address behavior. However, it does not describe what the returned message list contains (IDs, subjects, etc.), which is relevant given the lack of an output schema. The tool is functional but not fully self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the single optional 'address' parameter is already described in the schema as 'Inbox address; defaults to the most recent inbox'. The description mostly repeats this same information, adding the 'disposable inbox' framing but no new parameter-level semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List the messages currently in a disposable inbox'. It also clarifies the default behavior of using the most recently created inbox. This clearly distinguishes it from sibling tools like read_message, create_inbox, and wait_for_code.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use this tool versus its siblings. It does not mention alternatives such as read_message for a specific message or create_inbox for creating an inbox, so an agent is left to infer the appropriate context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_messageRead a messageA

Read the full body of a message by id, including any verification code detected in it. Lists attachment metadata; pass save_dir to also save the attachments and the HTML body to disk (where the provider supports downloads).

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesMessage id (from list_messages)
addressNoInbox address; defaults to the most recent inbox
save_dirNoDirectory to save attachments and body.html/body.txt into, written to <save_dir>/<message-id>/ (e.g. "/tmp")

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the read-only nature, the detection of verification codes, the listing of attachment metadata, and the conditional saving behavior with the caveat 'where the provider supports downloads'. This gives the agent a solid behavioral model of the tool's side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no fluff: the main purpose is front-loaded, and the optional save behavior is stated concisely with the provider-support caveat. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read tool with three parameters and no output schema, the description covers what is returned (body, verification code, attachment metadata) and the optional disk-saving behavior. It does not explain error cases or how it relates to wait_for_code, but these are minor gaps given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema fully documents all three parameters. The description adds some context for save_dir (specifying it also saves the HTML body) and implies id comes from list_messages, but these are incremental beyond the schema. The baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb and resource: 'Read the full body of a message by id'. It also adds distinctive details (verification code detection, attachment metadata) that differentiate it from siblings like list_messages and wait_for_code.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (to read the full body of a message) and mentions an optional save behavior, but it does not explicitly contrast it with siblings like wait_for_code or list_messages. No when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wait_for_codeWait for a verification codeA

Poll a disposable inbox until a message arrives, then return the verification code (OTP) found in it. Ideal right after submitting a sign-up form. Times out gracefully.

ParametersJSON Schema
NameRequiredDescriptionDefault
fromNoOnly match messages from this sender (substring)
addressNoInbox address; defaults to the most recent inbox
subjectNoOnly match messages whose subject contains this text
timeout_secondsNoMax seconds to wait (default 120)

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It discloses that the tool polls until a message arrives, extracts an OTP, and 'times out gracefully.' This gives useful behavioral context beyond the schema. It does not specify the exact return value on timeout or whether the message is consumed, but the core blocking/waiting behavior is clearly conveyed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. The first sentence states the primary action and result, and the second adds the use context and timeout behavior. Everything earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple polling tool with no required parametersable to the schema and no output schema, the description covers the main action, return value, ideal timing, and timeout behavior. Minor gaps remain around what happens on timeout and how this relates to the sibling read/list tools, but nothing an agent needs to invoke it successfully is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters (from, address, subject, timeout_seconds) are already documented. The description does not add additional parameter-level semantics; it only explains the overall operation. Baseline 3 is appropriate since the schema handles the parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('poll'), a specific resource ('disposable inbox'), and the concrete outcome ('return the verification code (OTP) found in it'). It clearly differentiates this tool from siblings like list_messages and read_message by focusing on waiting for an OTP rather than just retrieving messages.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear trigger context: 'Ideal right after submitting a sign-up form.' This tells an agent when to use the tool. It does not explicitly name alternative siblings or state when not to use it, so it misses a small opportunity to fully disambiguate from list_messages and read_message.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.0
    • First observedcreate_inbox
    • First observedlist_messages
    • First observedread_message
    • First observedwait_for_code

TDQS

A4.1/5.0

Scored across 4 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: create, list, read, and wait-for-code. There is no functional overlap between them.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern: create_inbox, list_messages, read_message, wait_for_code. The naming is uniform and predictable.

Tool Count5/5

Four tools is an ideal size for a disposable inbox service. Each tool covers a necessary step in the workflow without redundancy or bloat.

Completeness4/5

The core lifecycle is well covered: creation, listing, reading, and polling for codes. A minor gap is the lack of an explicit delete_inbox or get_inbox, but these are not essential for the stated purpose.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    MCP server for disposable email — create inboxes, receive emails, and extract OTP codes. Let your AI agent sign up for services, wait for verification emails, and extract codes autonomously.
    7
    40 npm
    1
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to create disposable email inboxes and automatically extract OTPs, magic links, and verification codes from incoming emails.
    10 npm
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    Enables AI agents to create temporary email addresses, receive confirmation emails, and extract verification links, automating sign-up and email verification workflows without manual intervention.
    6
    23 npm
    63
    MIT