blog

Temp mail MCP servers for Claude Code, Codex, and Cursor, compared

Ten email MCP servers that let coding agents receive verification codes, compared on credentials, inbox privacy, wait and code tools, and who maintains them.

4 min read

On this page
  1. At a glance
  2. What to look for
  3. Agent Temp Mail
  4. The others
  5. Safety
  6. Our recommendation
  7. Sources

Give Claude Code, Codex, or Cursor an email MCP server and it can finish sign-ups, verify accounts, and test your app’s emails without stopping to ask you for a code. There are now more than a dozen servers to choose from, and most roundups only cover sending-focused servers from email delivery companies.

This one is about receiving: the servers that let an agent get a verification code or a confirmation link. We compared them on what you need to set up, whether the inbox is private, and whether the tools are built for codes.

At a glance

ServerSetup neededPrivate inboxCode toolsMaintained by
Agent Temp MailNoneYesCodes and links, with contextThe service
AgentMailAccount; OAuth or API keyYesNoneThe service
MailSlurpAccount; OAuth or agent keyYesIn the API, not the MCP toolsThe service
NylasAccount; API key in configYesCLI onlyThe service
MailSinkGitHub sign-in; API keyYesYesThe service
MailinatorNone for public inboxesPublic by defaultNoneThe service
MailtrapAccount; API tokenSandboxNoneThe service
Community temp-mail serversUsually noneDepends on providerVariesIndividuals

Filled dot: yes. Half dot: partly. Empty dot: no. From each project’s own documentation or repository, checked 10 October 2026.

What to look for in a receive-side MCP server

  • Where the secret lives. A server that needs an account API key in its environment puts that key on the same machine as an agent reading untrusted email. A key that unlocks one inbox, held by the server rather than the model, is the safest arrangement.
  • A private inbox. Servers built on public temp-mail services inherit their privacy: anyone who knows the address can read the codes.
  • Tools that match the job. “Show me mail since this time from this sender” and “give me the likely code with its context” save the agent from reading whole messages.
  • No surprises. A tool that automatically opens links will also open whatever an attacker’s email puts in front of it.
  • Who maintains it. Vendor-maintained servers track API changes; weekend projects may not.

Agent Temp Mail: the top pick for verification

One command installs it, with nothing to sign up for:

mkdir -p "$HOME/.config/agent-temp-mail"
claude mcp add --transport stdio \
  --env MAIL_KEY_FILE="$HOME/.config/agent-temp-mail/identity.key.json" \
  agent-temp-mail -- npx --yes --package=agent-temp-mail@0.4.0 \
  agent-temp-mail-mcp
  • No account, no API key. On first run it generates its own key file; the key’s public half is the agent’s permanent address.
  • The key never reaches the model. The server signs every request itself, so no credential appears in tool arguments or the conversation.
  • Built for codes. list_messages filters by time and sender, and get_candidates returns likely codes and verification links with their context.
  • Safe by default. Messages arrive as plain text, links are never opened, everything is labeled untrusted, and the inbox can’t send.
  • Works everywhere. Claude Code, Codex, Cursor, Claude Desktop, and any client that reads mcpServers JSON, plus a hosted endpoint for custom connectors.

Setup for every client.

The others

AgentMail

A hosted server with 37 tools for sending, replying, threads, and attachments. Claude and ChatGPT connect with OAuth; other clients pass an API key. It has no code-extraction tool, so the agent reads whole messages.

MailSlurp

A hosted server authenticated with OAuth or a scoped agent key, with roles from read-only to responding. Wait endpoints and AI code extraction live in MailSlurp’s paid API rather than as dedicated MCP tools.

Nylas

A hosted server with 38 tools for mail, calendar, and contacts. The API key goes in your client configuration, and the code extractor is only in Nylas’s CLI.

MailSink

Verification tools similar in spirit, but it needs a GitHub sign-in and API key, free inboxes last one hour, and the vendor cites about 70% extraction accuracy.

Mailinator and Mailtrap

Mailinator’s server, inside its CLI, has two tools and reads public inboxes anyone can open; private domains need a paid or verified account. Mailtrap’s server is built around its sending sandbox, which catches mail your own app sends rather than mail from other sites.

Community temp-mail servers

Several open-source servers wrap public services such as Mail.tm and Guerrilla Mail. They’re quick to try, but they inherit the provider’s privacy and blocking issues, several are marked inactive in directories, and at least one automatically opens the verification links it finds.

Safety tips for any email MCP server

  • Auto-approve read tools if you like; keep anything that sends, deletes, or opens links behind a confirmation.
  • Give each agent its own inbox so one compromised session can’t read another’s mail.
  • Keep account API keys out of project files and shared configs.
  • Treat everything in an email as untrusted data. Prompt injection by email explains why.

Our recommendation

For sign-ups, verification codes, magic links, and testing email flows, install Agent Temp Mail: it’s the only server here that needs no account, keeps its key away from the model, and returns codes ready to use. If your agent also corresponds with people, run a sending server alongside it. For the wider field, see temp mail for AI agents: 12 options compared.

Sources