# MinuteMail

> Ephemeral mailboxes and a mock OAuth IdP for testing email and auth flows — 39 API-driven tools

- name: io.github.minutemailco/mcp-server
- version: 1.1.3
- connection class: R1 (autonomous)
- trust: 91/100
- quality: 86/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.minutemailco%2Fmcp-server
- tools: https://api.protogrid.dev/v1/servers/io.github.minutemailco%2Fmcp-server/tools

**An agent can connect on its own if it already holds `MINUTEMAILCO_TOKEN`.** Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "minutemailco": {
      "type": "http",
      "url": "https://mcp.minutemail.co/mcp",
      "headers": {
        "Authorization": "Bearer ${MINUTEMAILCO_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${MINUTEMAILCO_TOKEN}`.

## Trust

- hygiene: 100
- liveness: 100
- freshness: 85
- provenance: 80
- drivers: +repository +namespace-matches-repo +reachable +uptime-99% ~updated-57d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 86/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 40 of 40 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 4,137 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 75 (weight 15)

- warn `stability.changes`: 6 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 40, about 4,137 tokens to load them all
- tool set hash: b07fae0b91ec00c2b1157fdd9798b798
- tools last changed: 2026-10-17T03:19:18.841Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.minutemailco/mcp-server.svg)](https://protogrid.dev/servers/io.github.minutemailco/mcp-server)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-17 `archived.reactivate` changed (outputSchema)
- 2026-10-17 `archived.get` changed (outputSchema)
- 2026-10-17 `archived.list` changed (outputSchema)
- 2026-10-17 `mailboxes.get` changed (outputSchema)
- 2026-10-17 `mailboxes.create` changed (outputSchema)
- 2026-10-17 `mailboxes.list` changed (outputSchema)

Full history: https://api.protogrid.dev/v1/servers/io.github.minutemailco%2Fmcp-server/changes

## Remotes

- https://mcp.minutemail.co/mcp (streamable-http, auth api_key ${MINUTEMAILCO_TOKEN}, reachable true, uptime30d 0.9916667)

## Packages

_none_

## Tools (40)

- `archived.delete`: Permanently delete an archived mailbox.
- `archived.get`: Fetch a single archived mailbox by ID.
- `archived.list`: List the tenant's archived (expired but recoverable) mailboxes.
- `archived.reactivate`: Reactivate an archived mailbox back to active state.
- `attachments.add`: Attach a file to a test-injected email (base64 payload).
- `attachments.delete`: Delete a single attachment.
- `attachments.delete_bulk`: Delete several attachments of one email at once.
- `attachments.get`: Download an attachment. The file contents are returned base64-encoded in the JSON "data" field.
- `attachments.list`: List the attachments of an email (metadata only).
- `domains.delete`: Delete a registered custom domain.
- `domains.list`: List the tenant's custom domains with their DNS verification status.
- `domains.register`: Register a new custom domain. DNS records (TXT token + MX) must then be added before verification can succeed.
- `domains.verify`: Trigger DNS verification (TXT + MX) of a registered domain.
- `identities.create`: Create a mock identity bound to a mailbox for OAuth flow testing.
- `identities.delete`: Delete a mock identity.
- `identities.get`: Fetch a single mock identity by ID.
- `identities.list`: List the tenant's mock identities, optionally filtered by OAuth client or mailbox address.
- `identities.update`: Update a mock identity: profile fields, isActive (activate/deactivate), emailVerified, and custom claims merged into the ID token and userinfo.
- `mailboxes.create`: Create a new temporary mailbox. The domain defaults to the tenant's default domain; the owner is always the API key's owner.
- `mailboxes.delete`: Delete a mailbox and its contents by ID.
- `mailboxes.delete_bulk`: Delete several mailboxes at once by ID.
- `mailboxes.get`: Fetch a single mailbox by ID.
- `mailboxes.list`: List the tenant's active mailboxes (owner is derived from the API key). Optionally look up a single mailbox by exact address.
- `mails.delete`: Delete a single email.
- `mails.delete_bulk`: Delete several emails of one mailbox at once.
- `mails.get`: Fetch a single email by ID, including body and attachment metadata.
- `mails.inject`: Inject a simulated inbound email into a mailbox (multipart upload). No external mail is sent; use this to simulate inbound mail for flow testing.
- `mails.list`: List the emails in a mailbox, newest first.
- `oauth.clients.create`: Register an OAuth client for mock identity flows. The plaintext clientSecret is returned once at creation.
- `oauth.clients.delete`: Delete an OAuth client by its public client ID.
- `oauth.clients.get`: Fetch a single OAuth client by its public client ID.
- `oauth.clients.list`: List the tenant's OAuth clients for mock identity testing.
- `oauth.clients.rotate_secret`: Rotate an OAuth client's secret. The new plaintext secret is returned once.
- `team.invitations.create`: Create a team invitation for an email address (SMTP invite is sent by the team service).
- `team.invitations.delete`: Revoke a team invitation.
- `team.invitations.list`: List the tenant's team invitations.
- `team.members.add`: Add a team member directly (no invitation flow).
- `team.members.delete`: Remove a team member.
- `team.members.get`: Fetch a single team member by ID.
- `team.members.list`: List the tenant's team members.