MCP server

Read test email from AI agents with the MailBots MCP server

The MailBots MCP server lets a coding agent fetch the verification code that your app just sent, so it can finish a signup or login flow on its own. It runs at api.mailbots.top, uses your existing API key and can only read.

Connect

Start the free trial or choose a plan, then open Dashboard → Developer and create an API key. A key with messages:read and domains:read covers every tool.
Add the server to your MCP client with the URL and header below.
Ask the agent to sign up with a fresh address on your hostname and read the code.

Server URL: https://api.mailbots.top/v1/mcp
Transport: Streamable HTTP
Header: Authorization: Bearer mb_live_…

In Claude Code:

claude mcp add --transport http mailbots https://api.mailbots.top/v1/mcp --header "Authorization: Bearer mb_live_REPLACE_ME"

In Cursor, add this to .cursor/mcp.json:

{
  "mcpServers": {
    "mailbots": {
      "url": "https://api.mailbots.top/v1/mcp",
      "headers": { "Authorization": "Bearer mb_live_REPLACE_ME" }
    }
  }
}

Tools

Tool	What it returns
`list_domains`	Hostnames the key can receive mail on. Any address at an active hostname reaches the inbox
`get_latest_otp`	The newest message sent to one address and its extracted code, or found: false while nothing has arrived
`list_messages`	Recent messages, newest first, optionally for one address: sender, subject, code and times
`get_message`	One message with its plain-text body, for magic links or anything the code field misses

Each tool needs the matching key scope: domains:read for list_domains and messages:read for the other three. Nothing can be sent, changed or deleted through MCP.

Example prompt

Note

Sign up on http://localhost:3000/signup with the address signup-run-17@x7f3k2q9ab.trial.mailbots.top, then use get_latest_otp for that address to read the verification code and enter it. If no message has arrived, wait five seconds and try again.

Use a new address for every run so an old message can never be mistaken for the new one. You can also pass since, the time the run started, to get_latest_otp.

Limits and safe use

The server reads the same mail as the REST API, within your plan's retention: 24 hours on the trial, 72 hours on Starter and Pro.
Delivery usually takes a few seconds. The server does not hold a request open while it waits, so the agent retries instead.
Treat the API key like a password. Keep it in the client's configuration, not in a prompt or a repository, and revoke it from the dashboard if it leaks.
Only test applications you own or are authorized to test. The acceptable use policy applies to agents as it does to people.