Skip to content
IndSec Temp Mail

MCP

A temporary inbox your AI agent can actually use.

The same operations the browser inbox uses, exposed over the Model Context Protocol. Your agent creates an address, waits for the verification mail, and reads the code — without you copying anything by hand.

Start here

Endpoint

One stateless URL. No session, no server to keep warm.

URL

https://tempmail.indsec.info/mcp

Required header

X-API-Key: tmk_<64 hex characters>

An API key is required. There is no anonymous MCP access — an unauthenticated endpoint that creates mailboxes would be an open relay.

How to get a key

The free plan has no API key. There are two ways to get one today:

  1. Delegate your own domain. Point a domain's nameservers at this service and verify it, and you are issued a 20,000 requests/day key for free. See Custom domains.
  2. Join the waitlist for a paid plan. Paid tiers include a key with a larger quota. Billing is not live yet. See plans.

Six operations

Tools

  • create_inbox

    Create a disposable inbox. Returns the inbox id and access token. Optionally takes a prefix and a domain.

  • list_emails

    List the messages in an inbox, newest first, with the verification codes detected in each one.

  • read_email

    Read one message in full, including its plain text, HTML body, and any extracted codes or links.

  • wait_for_email

    Long-poll for the next message, up to 25 seconds. Costs one request instead of a polling loop, which matters against a request budget.

  • get_verification_link

    Return the most likely confirmation link from a message. It is returned, never opened: fetching an emailed URL server-side would be a request-forgery vector.

  • delete_email

    Delete a single message from an inbox.

Every tool takes the inbox id and token returned by create_inbox. The token is shown once, so the agent must keep it — there is no way to recover it.

Connecting a client

Claude Desktop
Settings → Connectors → Add custom connector, paste the endpoint below, and add the header shown above.
Any MCP client using Streamable HTTP
Point the client at the endpoint URL and send X-API-Key on every request. The transport is stateless, so no session affinity is needed.
curl
POST a JSON-RPC body to the endpoint with the tools/list method to see the live schema.

The transport is stateless: every tool reads and writes the database directly, so there is no session to resume and no Durable Object behind it. Streaming responses and OAuth-based MCP authorisation are not implemented — only the request/response transport and API-key authentication.