
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
emptyinbox-mcp
Advanced tools
MCP server for EmptyInbox — disposable email inboxes for AI agents. Zero config: auto-registers on first use, no API key needed. Buy more inboxes with Bitcoin.
MCP server for EmptyInbox — create disposable email inboxes and read messages from AI agents.
Listed in the official MCP Registry as io.github.cnohall/emptyinbox.
Claude Code:
claude mcp add emptyinbox -- npx -y emptyinbox-mcp
Any other MCP client — add to its config:
{
"mcpServers": {
"emptyinbox": {
"command": "npx",
"args": ["-y", "emptyinbox-mcp"]
}
}
}
No setup: the first tool call that needs an account registers one automatically and saves the key to ~/.emptyinbox.json for future sessions. Starting the server on its own (as MCP hosts do to list tools) creates nothing.
Bring your own account (optional — to reuse an existing key):
{
"mcpServers": {
"emptyinbox": {
"command": "npx",
"args": ["-y", "emptyinbox-mcp"],
"env": {
"EMPTYINBOX_API_KEY": "your_api_key_here"
}
}
}
}
Get an API key at https://emptyinbox.me/settings.html
| Tool | Description |
|---|---|
create_inbox | Create a new disposable email address |
list_inboxes | List all inboxes on your account |
list_messages | List received messages, each with its extracted code, action link and text preview |
get_message | Get one message parsed (code, links, plain text), or format="text" for a flat rendering |
wait_for_message | Block until an email arrives — perfect for signup/OTP flows; returns the extracted code with it |
get_quota | Credits remaining on the account |
list_bundles | List quota bundles and prices |
buy_quota | Quote a Bitcoin payment; returns a pay_url for the user plus address, amount and BIP21 URI |
check_payment | Check whether a payment landed and quota was credited |
1. create_inbox → "clever.sunny.butterfly@emptyinbox.me"
2. [agent signs up to some service using that address]
3. wait_for_message(inbox="clever.sunny.butterfly@emptyinbox.me", timeout_seconds=60)
4. → returns the verification email with code/link
Every account starts with free inboxes. When they run out, create_inbox returns
the prices and the agent can close the purchase without leaving the session:
buy_quota returns a pay_url — a page with a QR code, the exact amount and
live status — plus the raw address, amount and BIP21 URIcheck_payment with wait_seconds confirms the credit, usually within seconds of broadcastbuy_quota takes either a bundle id from list_bundles or a custom whole-dollar
usd amount from $1 to $100, for an agent spending down whatever a wallet holds.
A custom amount is priced at the best bundle rate it qualifies for. The network
fee the payer adds on top is the same whatever the size of the payment, so it
eats a far larger share of a dollar-sized top-up.
Quota is granted as soon as the payment is seen on the network, so there is no waiting for confirmations. Humans can also buy at https://emptyinbox.me/inboxes.html
FAQs
MCP server for EmptyInbox — disposable email inboxes for AI agents. Zero config: auto-registers on first use, no API key needed. Buy more inboxes with Bitcoin.
We found that emptyinbox-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.