
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
zerosmtp-mcp
Advanced tools
A free SMTP relay that still takes a username and password, for devices that cannot do OAuth 2.0 - as an MCP server. Your assistant gets the connection settings with both limits attached, plus SMTP error lookup, per-vendor OAuth firmware status, and a rea
ZeroSMTP is a free SMTP relay that still takes a plain username and password,
for printers, scanners and legacy apps that cannot do OAuth 2.0. Mail leaves
from a generated @msgwing.com address rather than your own domain, and the
cap is 200 messages a day. There is no paid tier, so those two limits are the
whole of the catch.
This is that relay as an MCP server. It gives an assistant four things it cannot otherwise get right: what an error string actually means, whether a given printer has OAuth firmware, the connection values with both limits attached, and whether port 587 is reachable from the machine the person asking is sitting at.
That last one is the reason this exists. An assistant can read documentation. It cannot open a socket from somebody else's network, and "is 587 blocked here" is the question that decides whether the printer sends.
Nothing to install. Point your client at it:
{
"mcpServers": {
"zerosmtp": {
"command": "npx",
"args": ["-y", "zerosmtp-mcp"]
}
}
}
Claude Code:
claude mcp add zerosmtp -- npx -y zerosmtp-mcp
| Tool | Answers |
|---|---|
lookup_smtp_error | Paste the line the server or library printed. Returns what it means, what caused it, and whether an administrator can still undo the cause. |
check_device_oauth | Vendor and optional model. Returns the OAuth firmware status from the vendor's own published statement, with a link to it. |
relay_settings | Host, ports, encryption, and the two limits — always both, never on request. |
check_relay_reachable | Opens a real TCP connection and TLS handshake from this machine. Reports round trip, negotiated TLS version, cipher and certificate. |
check_relay_reachable completes the
handshake and hangs up. It proves the network path, not that an account can
send.The two named at the top - a generated @msgwing.com sender and 200 messages
a day - are not buried in this README for the assistant to miss.
relay_settings returns both without being asked, because a recommendation
that omits either is one you would regret: fine for a scan-to-email button,
disqualifying for anything a customer receives.
If mail has to come from your own domain, this is the wrong tool, and the alternatives page names the right ones.
Bundled from the same files the documentation site publishes, and checked against them in CI so the two cannot drift:
errors.json — the SMTP error corpusdevices.json — OAuth firmware status by vendorfacts.json — the claims this project makes on more than one pageAn absence in the device list means nobody has read that vendor's documentation yet. It does not mean the device lacks OAuth, and the tool says so rather than implying otherwise.
MIT. Source: github.com/msgwing/ZeroSMTP
FAQs
A free SMTP relay that still takes a username and password, for devices that cannot do OAuth 2.0 - as an MCP server. Your assistant gets the connection settings with both limits attached, plus SMTP error lookup, per-vendor OAuth firmware status, and a rea
The npm package zerosmtp-mcp receives a total of 32 weekly downloads. As such, zerosmtp-mcp popularity was classified as not popular.
We found that zerosmtp-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.