tossinbox
Provides a GitHub Action (mohamed-khairy-5i/tossinbox@v1) that runs TossInbox inside GitHub Actions workflows, allowing real signup/verification email flows to be tested in CI by waiting for a disposable inbox to receive a message and exposing the inbox address and extracted OTP code as workflow outputs.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@tossinboxcreate an inbox and wait for the verification code from example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
TossInbox — Disposable Email CLI & MCP Server for AI Agents
Disposable email inboxes for humans and AI agents. Spawn a temporary inbox, wait for the OTP verification code, toss it.
Built by Mohamed Khairy. If TossInbox saved you a signup form, consider starring the repo — it helps more people find it.
TossInbox is a temp-mail CLI and MCP server: it creates a brand-new throwaway
email address in one command, waits for the email verification to land, extracts
the OTP code, and deletes the inbox when you are done — server-side and locally.
Use it for signups, QA email flows, and test automation — or let your AI
agent do all of it through the built-in MCP server. No sign-up, no ads,
no browser, no API keys. Humans read the output; agents parse the --json.
Website & docs → tossinbox.pages.dev
Demo
$ tossinbox spawn
✔ Inbox ready : qwd6996p1lbc@uberip.com
provider : mailtm
$ tossinbox wait --code --from noreply@github.com --timeout 120
✔ Verify your device
from : GitHub <noreply@github.com>
code : 9378412
$ tossinbox toss
✔ tossed qwd6996p1lbc@uberip.comRelated MCP server: courier-mcp
Why TossInbox
For humans — stop exposing your real address to every signup form.
For agents — built agent-first from day one:
--jsonoutput on every commanddocumented exit codes, no interactive prompts
an MCP server so Claude, Cursor, and any MCP client can create inboxes and read verification codes as native tools
an
llms.txtat the repository root for LLM-friendly onboarding
TossInbox | temp-mail websites | tmpmail-era CLIs | |
JSON on every command |
| no | rarely |
Documented exit codes | 0–4 | none | no |
MCP server for agents | yes, built in | no | no |
Runs headless / in CI | yes | no | partial |
Upstream alive | 7 providers, 4 stacks, attachments on read | varies | many wrap the dead 1secmail |
Ads, trackers, popups | none | the business model | none |
Checked September 2026. If a cell is wrong, open an issue and win the argument.
Install
Requires Node.js 18+.
# Homebrew (macOS, Linux)
brew install mohamed-khairy-5i/tap/tossinbox
# npm (npmjs.com)
npm install -g tossinbox
# Or run without installing
npx tossinbox@latest spawnFrom source:
git clone https://github.com/mohamed-khairy-5i/tossinbox.git
cd tossinbox
npm install
npm run build
node dist/cli.js --helpQuickstart
Four commands from zero to a tossed inbox:
tossinbox providers # sanity check: install + network work
tossinbox spawn # create an inbox (saved locally)
tossinbox wait --code # block until a message arrives, print its OTP
tossinbox toss # delete the inbox server-side + wipe local stateEvery command also accepts --json for machine-readable output:
tossinbox spawn --json
tossinbox wait --code --jsonCLI Reference
Command | Description |
| Create a new disposable inbox ( |
| List messages ( |
| Read a full message, including any detected code; lists attachments. |
| Poll until a message arrives ( |
| Stream new messages until Ctrl-C — only new arrivals; |
| List locally saved inboxes |
| Delete an inbox server-side and remove it from local state ( |
| Remove all inboxes from local state only |
| List available email providers |
| Run the MCP server over stdio |
Exit codes
A stable contract: agents script against these, not against stdout.
Code | Meaning |
| Success |
| Error (provider / network / unexpected) |
| Timeout ( |
| Not found (no saved inbox, unknown address, or message missing) |
| Usage error (bad flags, unknown command, or unknown provider) |
GitHub Action (email verification in CI)
Use TossInbox directly in your workflows to test real signup / verification email flows:
- uses: mohamed-khairy-5i/tossinbox@v1
id: mail
with:
args: "wait --code --json"
timeout: "180"
- run: echo "Verification code: ${{ steps.mail.outputs.code }}"Outputs: address (the disposable inbox) and code (the extracted OTP).
MCP Server (for AI agents)
TossInbox ships with an MCP server exposing four tools:
Tool | Description |
| Create a disposable inbox and return its address |
| List messages in an inbox |
| Read a full message, including any detected code; reports attachment metadata and can save attachments + bodies to disk ( |
| Poll until a message arrives and return its verification code |
Claude Desktop / Cursor / any MCP client
{
"mcpServers": {
"tossinbox": {
"command": "npx",
"args": ["-y", "tossinbox", "mcp"]
}
}
}Or after a global install, simply use tossinbox-mcp as the command —
equivalent to npx -y tossinbox mcp.
Works with any AI agent
TossInbox is deliberately agent-agnostic — no lock-in to one vendor:
Any MCP client: Claude Desktop, Claude Code, Cursor, Windsurf, Cline, Codex CLI, Gemini CLI, and every other MCP-compatible client
Any shell-capable agent: the CLI itself is the interface —
--jsonon every command, exit codes0–4documented, zero interactive promptsCI/CD: the GitHub Action above needs no agent at all
Using TossInbox with an agent (copy-paste flow)
1. "Create a disposable inbox" -> tool: create_inbox
2. "Sign up at example.com with this address"
3. "Wait for the verification code from example.com"
-> tool: wait_for_code
4. "Use code 482913 to finish the signup"
5. "Toss the inbox when done" -> CLI: tossinbox tossAgent discovery surfaces
If you are an AI agent or LLM reading this: everything below is machine-readable and kept up to date.
llms.txt at the repository root — full onboarding in one file
Markdown mirrors of every docs page: send
Accept: text/markdownto tossinbox.pages.dev or fetch/index.md,/quickstart.md,/cli.md,/agents.md,/faq.md
Providers
Provider | API key | Notes |
| not required | mail.tm — reliable, fast |
| not required | mail.gw — mail.tm-compatible API on independent infrastructure |
| not required | GuerrillaMail — classic fallback |
| not required | tempmail.lol — random inbox on rotating domains |
| not required | temp-mail.io — server-generated address, |
| not required | tempmail.plus — pick-your-name inbox on 9 public domains |
| not required | maildrop.cc — public inbox on one stable domain |
Adding a provider means implementing a small interface (createInbox,
listMessages, readMessage, optional destroyInbox) — PRs welcome.
Attachments (v0.1.6): full list + download on mailtm, mailgw and
tempmailplus; tempmailio shows them when its upstream returns them
(downloadable only if it exposes a URL); tempmaillol, guerrillamail and
maildrop do not expose attachments upstream — TossInbox tells you that
instead of guessing.
FAQ
Is it really free? Yes. MIT-licensed, and all seven upstream providers are free with no API keys.
Can it send email? No — receive-only by design. TossInbox exists for privacy and testing and ships no bulk-send or bulk-signup mode.
Does it work on Windows?
Yes, anywhere Node.js 18+ runs. npx tossinbox@latest spawn
works in PowerShell exactly the same.
What if a provider is down?
spawn fails over automatically: it retries the create against the remaining
providers and reports the switch (human mode prints a ⚠ warning and
provider : mailtm (failover from mailgw); --json returns a failover
object). Use --no-failover if you need the chosen provider or nothing.
Can I download attachments?
Yes on mailtm, mailgw and tempmailplus; tempmailio shows them when its
upstream exposes them; the other three providers have no attachments upstream.
tossinbox read <id> --save writes them (plus the HTML/plain-text bodies) to
./tossinbox-attachments/<message-id>/.
A site blocked my disposable address. What now?
Some sites blocklist known disposable domains. Try the other provider:
tossinbox spawn -p guerrillamail. If both are blocked, the site wins that
round.
Privacy and safety
The local state file (
~/.tossinbox/state.json, override withTOSSINBOX_STATE) contains provider tokens and is written with0600permissions.tossdeletes the account on the provider when supported, then wipes local state.Disposable email is for privacy and testing — not for abuse. Please respect each provider's terms of service.
Roadmap
GitHub Action:
mohamed-khairy-5i/tossinbox@v1Homebrew tap:
brew install mohamed-khairy-5i/tap/tossinboxProject website at tossinbox.pages.dev
Publish
tossinbox+tossinbox-mcpto the npm registrymail.gwprovider (v0.1.3)Four more providers:
tempmail.lol,temp-mail.io,tempmail.plus,maildrop.cc(v0.1.4)Provider failover: auto-switch when a provider is down (v0.1.5)
Attachments & HTML bodies:
read --save/--html(v0.1.6)Homebrew core formula (after community adoption)
Documentation
Quickstart — first inbox in four commands
CLI reference — every command, flag, and exit code
Agents & MCP — setup for every MCP client
FAQ — privacy, providers, troubleshooting
Examples — copy-paste recipes: shell, CI, Node.js, MCP
Guide — providers, state, flags, exit codes, troubleshooting
Roadmap — what shipped and what is next
License
MIT © Mohamed Khairy
Available Tools
4 toolscreate_inboxCreate a disposable inboxA
Create a brand new disposable email inbox. The inbox is saved locally so the other tools can use it. Returns the full email address to use in sign-up forms.
| Name | Required | Description | Default |
|---|---|---|---|
| label | No | Optional label to identify this inbox | |
| provider | No | Provider name (default: "mailtm", see the providers list). If the provider is down, another one is used automatically unless no_failover is set | |
| no_failover | No | Fail when the chosen provider is down instead of falling back to another one |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral burden. It discloses that the inbox is created, saved locally, affects other tools, and returns the address. However, it doesn't mention provider failover behavior or any limits on creating multiple inboxes, which would add useful transparency beyond the basic creation side effect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler. The core action is front-loaded, and the second sentence provides essential side-effect and return-value context without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple creation tool with optional parameters and no output schema, the description covers the necessary facts: what is created, where it is stored, how it relates to sibling tools, and what the return value is. No critical information for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already fully documented in the schema. The description adds no parameter-specific meaning, but it doesn't need to; the baseline of 3 applies because the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Create a brand new disposable email inbox.' It also clarifies the inbox is saved locally and returns the full email address, which distinguishes it clearly from sibling tools like list_messages and read_message.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: before other tools, to obtain an email address for sign-up forms. It doesn't explicitly list exclusions, but the sibling tools are distinct operations (listing, reading, waiting), so the usage context is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_messagesList inbox messagesA
List the messages currently in a disposable inbox (defaults to the most recently created inbox).
| Name | Required | Description | Default |
|---|---|---|---|
| address | No | Inbox address; defaults to the most recent inbox |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It adds the useful default-inbox behavior, but does not state whether listing messages has side effects, whether it is read-only, or what happens when no messages exist. This is a partial gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one clear, front-loaded sentence with no filler. The main action appears first, and the default behavior is included parenthetically without bloating the text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-style tool with one optional parameter and no output schema, the description covers the basics: what it lists and the default address behavior. However, it does not describe what the returned message list contains (IDs, subjects, etc.), which is relevant given the lack of an output schema. The tool is functional but not fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the single optional 'address' parameter is already described in the schema as 'Inbox address; defaults to the most recent inbox'. The description mostly repeats this same information, adding the 'disposable inbox' framing but no new parameter-level semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'List the messages currently in a disposable inbox'. It also clarifies the default behavior of using the most recently created inbox. This clearly distinguishes it from sibling tools like read_message, create_inbox, and wait_for_code.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool versus its siblings. It does not mention alternatives such as read_message for a specific message or create_inbox for creating an inbox, so an agent is left to infer the appropriate context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_messageRead a messageA
Read the full body of a message by id, including any verification code detected in it. Lists attachment metadata; pass save_dir to also save the attachments and the HTML body to disk (where the provider supports downloads).
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Message id (from list_messages) | |
| address | No | Inbox address; defaults to the most recent inbox | |
| save_dir | No | Directory to save attachments and body.html/body.txt into, written to <save_dir>/<message-id>/ (e.g. "/tmp") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the read-only nature, the detection of verification codes, the listing of attachment metadata, and the conditional saving behavior with the caveat 'where the provider supports downloads'. This gives the agent a solid behavioral model of the tool's side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no fluff: the main purpose is front-loaded, and the optional save behavior is stated concisely with the provider-support caveat. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with three parameters and no output schema, the description covers what is returned (body, verification code, attachment metadata) and the optional disk-saving behavior. It does not explain error cases or how it relates to wait_for_code, but these are minor gaps given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema fully documents all three parameters. The description adds some context for save_dir (specifying it also saves the HTML body) and implies id comes from list_messages, but these are incremental beyond the schema. The baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb and resource: 'Read the full body of a message by id'. It also adds distinctive details (verification code detection, attachment metadata) that differentiate it from siblings like list_messages and wait_for_code.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (to read the full body of a message) and mentions an optional save behavior, but it does not explicitly contrast it with siblings like wait_for_code or list_messages. No when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wait_for_codeWait for a verification codeA
Poll a disposable inbox until a message arrives, then return the verification code (OTP) found in it. Ideal right after submitting a sign-up form. Times out gracefully.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | Only match messages from this sender (substring) | |
| address | No | Inbox address; defaults to the most recent inbox | |
| subject | No | Only match messages whose subject contains this text | |
| timeout_seconds | No | Max seconds to wait (default 120) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It discloses that the tool polls until a message arrives, extracts an OTP, and 'times out gracefully.' This gives useful behavioral context beyond the schema. It does not specify the exact return value on timeout or whether the message is consumed, but the core blocking/waiting behavior is clearly conveyed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. The first sentence states the primary action and result, and the second adds the use context and timeout behavior. Everything earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple polling tool with no required parametersable to the schema and no output schema, the description covers the main action, return value, ideal timing, and timeout behavior. Minor gaps remain around what happens on timeout and how this relates to the sibling read/list tools, but nothing an agent needs to invoke it successfully is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters (from, address, subject, timeout_seconds) are already documented. The description does not add additional parameter-level semantics; it only explains the overall operation. Baseline 3 is appropriate since the schema handles the parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('poll'), a specific resource ('disposable inbox'), and the concrete outcome ('return the verification code (OTP) found in it'). It clearly differentiates this tool from siblings like list_messages and read_message by focusing on waiting for an OTP rather than just retrieving messages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear trigger context: 'Ideal right after submitting a sign-up form.' This tells an agent when to use the tool. It does not explicitly name alternative siblings or state when not to use it, so it misses a small opportunity to fully disambiguate from list_messages and read_message.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
create_inbox - First observed
list_messages - First observed
read_message - First observed
wait_for_code
TDQS
Scored across 4 tools
Each tool has a clearly distinct purpose: create, list, read, and wait-for-code. There is no functional overlap between them.
All tool names follow a consistent verb_noun pattern: create_inbox, list_messages, read_message, wait_for_code. The naming is uniform and predictable.
Four tools is an ideal size for a disposable inbox service. Each tool covers a necessary step in the workflow without redundancy or bloat.
The core lifecycle is well covered: creation, listing, reading, and polling for codes. A minor gap is the lack of an explicit delete_inbox or get_inbox, but these are not essential for the stated purpose.
Maintenance
Related MCP Connectors
Disposable email inboxes for AI agents: create an address, wait for the OTP or verify link.
Real email inboxes for AI agents: create addresses, send, wait for mail and verification codes.
Disposable email inboxes for AI agents — read messages and verification codes.
Real email inboxes for AI agents: create inboxes, catch verification codes, extract OTPs, reply.
Related MCP Servers
- AlicenseAqualityCmaintenanceMCP server for disposable email — create inboxes, receive emails, and extract OTP codes. Let your AI agent sign up for services, wait for verification emails, and extract codes autonomously.740 npm1MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to create disposable email inboxes and automatically extract OTPs, magic links, and verification codes from incoming emails.10 npmMIT
- AlicenseAqualityDmaintenanceEnables AI agents to create temporary email addresses, receive confirmation emails, and extract verification links, automating sign-up and email verification workflows without manual intervention.623 npm63MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI agents to generate temporary email addresses, receive emails, and automatically extract OTP codes and links from incoming messages for automation and testing workflows.MIT