MinuteMail

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Ephemeral mailboxes and a mock OAuth IdP for testing email and auth flows — 39 API-driven tools

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "MinuteMail": {
      "url": "https://mcp.minutemail.co/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (40)

• mailboxes.list read-only

  List the tenant's active mailboxes (owner is derived from the API key). Optionally look up a single mailbox by exact address.

  Parameters:

  • address — string — Exact mailbox address to look up (e.g. [email protected]). Optional.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• mailboxes.create

  Create a new temporary mailbox. The domain defaults to the tenant's default domain; the owner is always the API key's owner.

  Parameters:

  • tag — string — Recovery tag, required when recoverable is true.
  • domain — string — Mailbox domain. Defaults to the tenant default domain (e.g. minutemail.cc).
  • expiresIn — integer — Lifetime in minutes, 1-60. Omit for the service default TTL.
  • recoverable — boolean — Set true to keep the mailbox recoverable after expiry (requires tag).
  • noExpiration — boolean — Set true for a permanent mailbox (mutually exclusive with expiresIn).

  Hints: read-only no · destructive no · idempotent no · open-world no

• mailboxes.get read-only

  Fetch a single mailbox by ID.

  Parameters:

  • mailboxId (required) — string — Mailbox ID

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• mailboxes.delete destructive

  Delete a mailbox and its contents by ID.

  Parameters:

  • mailboxId (required) — string — Mailbox ID

  Hints: read-only no · destructive yes · idempotent no · open-world no

• mailboxes.delete_bulk destructive

  Delete several mailboxes at once by ID.

  Parameters:

  • ids (required) — array — Mailbox IDs to delete

  Hints: read-only no · destructive yes · idempotent no · open-world no

• mails.list read-only

  List the emails in a mailbox, newest first.

  Parameters:

  • mailboxId (required) — string — Mailbox ID

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• mails.inject

  Inject a simulated inbound email into a mailbox (multipart upload). No external mail is sent; use this to simulate inbound mail for flow testing.

  Parameters:

  • mailboxId (required) — string — Mailbox ID
  • sender (required) — string — Sender email address
  • subject (required) — string — Email subject
  • body (required) — string — Plain-text body
  • expiresIn — integer — Mail lifetime in minutes (>=1). Optional.
  • attachments — array — Attachments to include

  Hints: read-only no · destructive no · idempotent no · open-world no

• mails.get read-only

  Fetch a single email by ID, including body and attachment metadata.

  Parameters:

  • mailboxId (required) — string — Mailbox ID
  • mailId (required) — string — Mail ID

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• mails.delete destructive

  Delete a single email.

  Parameters:

  • mailboxId (required) — string — Mailbox ID
  • mailId (required) — string — Mail ID

  Hints: read-only no · destructive yes · idempotent no · open-world no

• mails.delete_bulk destructive

  Delete several emails of one mailbox at once.

  Parameters:

  • mailboxId (required) — string — Mailbox ID
  • ids (required) — array — Mail IDs to delete

  Hints: read-only no · destructive yes · idempotent no · open-world no

• attachments.list read-only

  List the attachments of an email (metadata only).

  Parameters:

  • mailboxId (required) — string — Mailbox ID
  • mailId (required) — string — Mail ID

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• attachments.add

  Attach a file to a test-injected email (base64 payload).

  Parameters:

  • mailboxId (required) — string — Mailbox ID
  • mailId (required) — string — Mail ID
  • filename (required) — string — Attachment file name
  • data (required) — string — File contents, standard base64
  • expiresIn — integer — Attachment lifetime in minutes (>=1). Optional.
  • sizeBytes — integer — Expected size in bytes. Optional; validated against the decoded data when set.
  • contentType — string — MIME type, defaults to application/octet-stream

  Hints: read-only no · destructive no · idempotent no · open-world no

• attachments.get read-only

  Download an attachment. The file contents are returned base64-encoded in the JSON "data" field.

  Parameters:

  • mailboxId (required) — string — Mailbox ID
  • mailId (required) — string — Mail ID
  • attachmentId (required) — string — Attachment ID

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• attachments.delete destructive

  Delete a single attachment.

  Parameters:

  • mailboxId (required) — string — Mailbox ID
  • mailId (required) — string — Mail ID
  • attachmentId (required) — string — Attachment ID

  Hints: read-only no · destructive yes · idempotent no · open-world no

• attachments.delete_bulk destructive

  Delete several attachments of one email at once.

  Parameters:

  • mailboxId (required) — string — Mailbox ID
  • mailId (required) — string — Mail ID
  • ids (required) — array — Attachment IDs to delete

  Hints: read-only no · destructive yes · idempotent no · open-world no

• archived.list read-only

  List the tenant's archived (expired but recoverable) mailboxes.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• archived.get read-only

  Fetch a single archived mailbox by ID.

  Parameters:

  • mailboxId (required) — string — Archived mailbox ID

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• archived.delete destructive

  Permanently delete an archived mailbox.

  Parameters:

  • mailboxId (required) — string — Archived mailbox ID

  Hints: read-only no · destructive yes · idempotent no · open-world no

• archived.reactivate

  Reactivate an archived mailbox back to active state.

  Parameters:

  • mailboxId (required) — string — Archived mailbox ID
  • expiresIn — integer — New lifetime in minutes, 1-60. Optional.

  Hints: read-only no · destructive no · idempotent no · open-world no

• domains.list read-only

  List the tenant's custom domains with their DNS verification status.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• domains.register

  Register a new custom domain. DNS records (TXT token + MX) must then be added before verification can succeed.

  Parameters:

  • name (required) — string — Domain name, e.g. mail.example.com

  Hints: read-only no · destructive no · idempotent no · open-world no

• domains.verify

  Trigger DNS verification (TXT + MX) of a registered domain.

  Parameters:

  • domainId (required) — string — Domain ID

  Hints: read-only no · destructive no · idempotent no · open-world no

• domains.delete destructive

  Delete a registered custom domain.

  Parameters:

  • domainId (required) — string — Domain ID

  Hints: read-only no · destructive yes · idempotent no · open-world no

• team.members.list read-only

  List the tenant's team members.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• team.members.add

  Add a team member directly (no invitation flow).

  Parameters:

  • user_id (required) — string — Member user ID
  • username (required) — string — Member username
  • email (required) — string — Member email address
  • status (required) — string — Member status, conventionally ACTIVE

  Hints: read-only no · destructive no · idempotent no · open-world no

• team.members.get read-only

  Fetch a single team member by ID.

  Parameters:

  • memberId (required) — string — Member ID

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• team.members.delete destructive

  Remove a team member.

  Parameters:

  • memberId (required) — string — Member ID

  Hints: read-only no · destructive yes · idempotent no · open-world no

• team.invitations.create

  Create a team invitation for an email address (SMTP invite is sent by the team service).

  Parameters:

  • email (required) — string — Invitee email address

  Hints: read-only no · destructive no · idempotent no · open-world no

• team.invitations.list read-only

  List the tenant's team invitations.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• team.invitations.delete destructive

  Revoke a team invitation.

  Parameters:

  • invitationId (required) — string — Invitation ID

  Hints: read-only no · destructive yes · idempotent no · open-world no

• identities.list read-only

  List the tenant's mock identities, optionally filtered by OAuth client or mailbox address.

  Parameters:

  • clientId — string — Filter by OAuth client ID. Optional.
  • mailboxAddress — string — Filter by mailbox address. Optional.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• identities.create

  Create a mock identity bound to a mailbox for OAuth flow testing.

  Parameters:

  • clientId (required) — string — OAuth client ID the identity belongs to
  • mailboxAddress (required) — string — Mailbox address the identity is linked to (must exist)
  • name — string — Display name. Optional.
  • claims — object — Custom claims (e.g. role, plan) merged into the ID token and userinfo. Custom-provider clients only — rejected for google/github/apple/facebook. Optional.
  • username — string — Identity username. Optional.
  • avatarUrl — string — Avatar URL. Optional.
  • emailVerified — boolean — Value of the email_verified claim issued for this identity. Optional.

  Hints: read-only no · destructive no · idempotent no · open-world no

• identities.get read-only

  Fetch a single mock identity by ID.

  Parameters:

  • identityId (required) — string — Identity ID

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• identities.update

  Update a mock identity: profile fields, isActive (activate/deactivate), emailVerified, and custom claims merged into the ID token and userinfo.

  Parameters:

  • identityId (required) — string — Identity ID
  • name — string — Display name. Optional.
  • claims — object — Custom claims (e.g. role, plan) merged into the ID token and userinfo. Replaces existing claims. Reserved claim names are rejected. Optional.
  • isActive — boolean — Whether the identity can be used in OAuth flows. Optional.
  • username — string — Identity username. Optional.
  • avatarUrl — string — Avatar URL. Optional.
  • emailVerified — boolean — Value of the email_verified claim issued for this identity. Optional.

  Hints: read-only no · destructive no · idempotent no · open-world no

• identities.delete destructive

  Delete a mock identity.

  Parameters:

  • identityId (required) — string — Identity ID

  Hints: read-only no · destructive yes · idempotent no · open-world no

• oauth.clients.list read-only

  List the tenant's OAuth clients for mock identity testing.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• oauth.clients.create

  Register an OAuth client for mock identity flows. The plaintext clientSecret is returned once at creation.

  Parameters:

  • name (required) — string — Client display name
  • redirectUris (required) — array — Allowed redirect URIs (at least one)
  • providerType — string — Identity provider type
  • providerLabel — string — Custom provider label. Required when providerType is custom.

  Hints: read-only no · destructive no · idempotent no · open-world no

• oauth.clients.get read-only

  Fetch a single OAuth client by its public client ID.

  Parameters:

  • clientId (required) — string — Public OAuth client ID

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• oauth.clients.delete destructive

  Delete an OAuth client by its public client ID.

  Parameters:

  • clientId (required) — string — Public OAuth client ID

  Hints: read-only no · destructive yes · idempotent no · open-world no

• oauth.clients.rotate_secret

  Rotate an OAuth client's secret. The new plaintext secret is returned once.

  Parameters:

  • clientId (required) — string — Public OAuth client ID

  Hints: read-only no · destructive no · idempotent no · open-world no

Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.