# MinuteMail (remote · mcp.minutemail.co)

Ephemeral mailboxes and a mock OAuth IdP for testing email and auth flows — 39 API-driven tools

- Trust score: 73/100 (medium)
- Change this week: +2
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-27

## Components

- remote · `mcp.minutemail.co`: 73/100 (this document), [markdown](https://verifymcp.io/servers/minutemailco-mcp-server/mcp.md), [page](https://verifymcp.io/servers/minutemailco-mcp-server/mcp)

## Channel facts

- Endpoint: `https://mcp.minutemail.co/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.1.3`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-27.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (mailboxes.delete).
  - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1923 tokens (~48/item across 40 items; 40 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 100/100
  - No destabilizing schema changes in the last 30 days.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 12 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 40 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the MinuteMail MCP server?

MinuteMail is a hosted endpoint at https://mcp.minutemail.co/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http minutemailco-mcp-server 'https://mcp.minutemail.co/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "minutemailco-mcp-server": {
      "url": "https://mcp.minutemail.co/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "minutemailco-mcp-server": {
      "type": "http",
      "url": "https://mcp.minutemail.co/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.minutemailco-mcp-server]
url = "https://mcp.minutemail.co/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "minutemailco-mcp-server": {
      "type": "remote",
      "url": "https://mcp.minutemail.co/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add minutemailco-mcp-server --url 'https://mcp.minutemail.co/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  minutemailco-mcp-server:
    url: "https://mcp.minutemail.co/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "minutemailco-mcp-server": {
      "Transport": "http",
      "Url": "https://mcp.minutemail.co/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add minutemailco-mcp-server -t streamable-http -u 'https://mcp.minutemail.co/mcp'
```

### Other

```json
{
  "mcpServers": {
    "minutemailco-mcp-server": {
      "type": "http",
      "url": "https://mcp.minutemail.co/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-25 (score 73, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-23 (score 73, +1)

- [security] Stability: 0.97 → pass

### 2026-09-21 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-19 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-17 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-15 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-13 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-10 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (40)

### `mailboxes.list` (~61 tokens)

List mailboxes

List the tenant's active mailboxes (owner is derived from the API key). Optionally look up a single mailbox by exact address.

Input parameters:

- `address` (string): Exact mailbox address to look up (e.g. user@minutemail.cc). Optional.

Output parameters:

- `items` (array)

### `mailboxes.create` (~141 tokens)

Create mailbox

Create a new temporary mailbox. The domain defaults to the tenant's default domain; the owner is always the API key's owner.

Input parameters:

- `domain` (string): Mailbox domain. Defaults to the tenant default domain (e.g. minutemail.cc).
- `expiresIn` (integer): Lifetime in minutes, 1-60. Omit for the service default TTL.
- `noExpiration` (boolean): Set true for a permanent mailbox (mutually exclusive with expiresIn).
- `recoverable` (boolean): Set true to keep the mailbox recoverable after expiry (requires tag).
- `tag` (string): Recovery tag, required when recoverable is true.

Output parameters:

- `address` (string): Full mailbox address
- `alias` (string): Local part of the address
- `createdAt` (string): Creation timestamp (RFC 3339)
- `domain` (string): Mailbox domain
- `expiresAt` (string): Expiry timestamp (RFC 3339); null when permanent
- `id` (string): Mailbox ID
- `messageCount` (integer): Number of mails in the mailbox
- `owner` (string): Owner (tenant) ID
- `permanent` (boolean): Whether the mailbox never expires
- `recoverable` (boolean): Whether the mailbox can be recovered after expiry

### `mailboxes.get` (~27 tokens)

Get mailbox

Fetch a single mailbox by ID.

Input parameters:

- `mailboxId` (string, required): Mailbox ID

Output parameters:

- `address` (string): Full mailbox address
- `alias` (string): Local part of the address
- `createdAt` (string): Creation timestamp (RFC 3339)
- `domain` (string): Mailbox domain
- `expiresAt` (string): Expiry timestamp (RFC 3339); null when permanent
- `id` (string): Mailbox ID
- `messageCount` (integer): Number of mails in the mailbox
- `owner` (string): Owner (tenant) ID
- `permanent` (boolean): Whether the mailbox never expires
- `recoverable` (boolean): Whether the mailbox can be recovered after expiry

### `mailboxes.delete` (~29 tokens)

Delete mailbox

Delete a mailbox and its contents by ID.

Input parameters:

- `mailboxId` (string, required): Mailbox ID

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `mailboxes.delete_bulk` (~31 tokens)

Bulk delete mailboxes

Delete several mailboxes at once by ID.

Input parameters:

- `ids` (array, required): Mailbox IDs to delete

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `mails.list` (~29 tokens)

List mails

List the emails in a mailbox, newest first.

Input parameters:

- `mailboxId` (string, required): Mailbox ID

Output parameters:

- `items` (array)

### `mails.inject` (~104 tokens)

Inject test mail

Inject a simulated inbound email into a mailbox (multipart upload). No external mail is sent; use this to simulate inbound mail for flow testing.

Input parameters:

- `attachments` (array): Attachments to include
- `body` (string, required): Plain-text body
- `expiresIn` (integer): Mail lifetime in minutes (>=1). Optional.
- `mailboxId` (string, required): Mailbox ID
- `sender` (string, required): Sender email address
- `subject` (string, required): Email subject

Output parameters:

- `body` (string): Plain-text body (present on single-mail fetches)
- `expiresAt` (string): Expiry timestamp (RFC 3339)
- `id` (string): Mail ID
- `receivedAt` (string): Received timestamp (RFC 3339)
- `sender` (string): Sender email address
- `subject` (string): Email subject

### `mails.get` (~42 tokens)

Get mail

Fetch a single email by ID, including body and attachment metadata.

Input parameters:

- `mailId` (string, required): Mail ID
- `mailboxId` (string, required): Mailbox ID

Output parameters:

- `body` (string): Plain-text body (present on single-mail fetches)
- `expiresAt` (string): Expiry timestamp (RFC 3339)
- `id` (string): Mail ID
- `receivedAt` (string): Received timestamp (RFC 3339)
- `sender` (string): Sender email address
- `subject` (string): Email subject

### `mails.delete` (~34 tokens)

Delete mail

Delete a single email.

Input parameters:

- `mailId` (string, required): Mail ID
- `mailboxId` (string, required): Mailbox ID

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `mails.delete_bulk` (~40 tokens)

Bulk delete mails

Delete several emails of one mailbox at once.

Input parameters:

- `ids` (array, required): Mail IDs to delete
- `mailboxId` (string, required): Mailbox ID

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `attachments.list` (~39 tokens)

List attachments

List the attachments of an email (metadata only).

Input parameters:

- `mailId` (string, required): Mail ID
- `mailboxId` (string, required): Mailbox ID

Output parameters:

- `items` (array)

### `attachments.add` (~121 tokens)

Add attachment

Attach a file to a test-injected email (base64 payload).

Input parameters:

- `contentType` (string): MIME type, defaults to application/octet-stream
- `data` (string, required): File contents, standard base64
- `expiresIn` (integer): Attachment lifetime in minutes (>=1). Optional.
- `filename` (string, required): Attachment file name
- `mailId` (string, required): Mail ID
- `mailboxId` (string, required): Mailbox ID
- `sizeBytes` (integer): Expected size in bytes. Optional; validated against the decoded data when set.

Output parameters:

- `contentType` (string): MIME type
- `expiresAt` (string): Expiry timestamp (RFC 3339)
- `filename` (string): Attachment file name
- `id` (string): Attachment ID
- `sizeBytes` (integer): Size in bytes

### `attachments.get` (~60 tokens)

Get attachment

Download an attachment. The file contents are returned base64-encoded in the JSON "data" field.

Input parameters:

- `attachmentId` (string, required): Attachment ID
- `mailId` (string, required): Mail ID
- `mailboxId` (string, required): Mailbox ID

Output parameters:

- `contentType` (string): MIME type
- `data` (string): File contents, standard base64
- `expiresAt` (string): Expiry timestamp (RFC 3339)
- `filename` (string): Attachment file name
- `id` (string): Attachment ID
- `sizeBytes` (integer): Size in bytes

### `attachments.delete` (~44 tokens)

Delete attachment

Delete a single attachment.

Input parameters:

- `attachmentId` (string, required): Attachment ID
- `mailId` (string, required): Mail ID
- `mailboxId` (string, required): Mailbox ID

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `attachments.delete_bulk` (~50 tokens)

Bulk delete attachments

Delete several attachments of one email at once.

Input parameters:

- `ids` (array, required): Attachment IDs to delete
- `mailId` (string, required): Mail ID
- `mailboxId` (string, required): Mailbox ID

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `archived.list` (~22 tokens)

List archived mailboxes

List the tenant's archived (expired but recoverable) mailboxes.

Output parameters:

- `items` (array)

### `archived.get` (~27 tokens)

Get archived mailbox

Fetch a single archived mailbox by ID.

Input parameters:

- `mailboxId` (string, required): Archived mailbox ID

Output parameters:

- `address` (string): Full mailbox address
- `alias` (string): Local part of the address
- `createdAt` (string): Creation timestamp (RFC 3339)
- `domain` (string): Mailbox domain
- `expiresAt` (string): Expiry timestamp (RFC 3339); null when permanent
- `id` (string): Mailbox ID
- `messageCount` (integer): Number of mails in the mailbox
- `owner` (string): Owner (tenant) ID
- `permanent` (boolean): Whether the mailbox never expires
- `recoverable` (boolean): Whether the mailbox can be recovered after expiry

### `archived.delete` (~26 tokens)

Delete archived mailbox

Permanently delete an archived mailbox.

Input parameters:

- `mailboxId` (string, required): Archived mailbox ID

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `archived.reactivate` (~49 tokens)

Reactivate archived mailbox

Reactivate an archived mailbox back to active state.

Input parameters:

- `expiresIn` (integer): New lifetime in minutes, 1-60. Optional.
- `mailboxId` (string, required): Archived mailbox ID

Output parameters:

- `address` (string): Full mailbox address
- `alias` (string): Local part of the address
- `createdAt` (string): Creation timestamp (RFC 3339)
- `domain` (string): Mailbox domain
- `expiresAt` (string): Expiry timestamp (RFC 3339); null when permanent
- `id` (string): Mailbox ID
- `messageCount` (integer): Number of mails in the mailbox
- `owner` (string): Owner (tenant) ID
- `permanent` (boolean): Whether the mailbox never expires
- `recoverable` (boolean): Whether the mailbox can be recovered after expiry

### `domains.list` (~20 tokens)

List domains

List the tenant's custom domains with their DNS verification status.

Output parameters:

- `items` (array)

### `domains.register` (~47 tokens)

Register domain

Register a new custom domain. DNS records (TXT token + MX) must then be added before verification can succeed.

Input parameters:

- `name` (string, required): Domain name, e.g. mail.example.com

Output parameters:

- `createdAt` (string): Creation timestamp (RFC 3339)
- `id` (string): Domain ID
- `mxTarget` (string): MX target to add to the domain's DNS before verification
- `name` (string): Domain name
- `status` (string): DNS verification status
- `txtToken` (string): TXT token to add to the domain's DNS before verification

### `domains.verify` (~31 tokens)

Verify domain

Trigger DNS verification (TXT + MX) of a registered domain.

Input parameters:

- `domainId` (string, required): Domain ID

Output parameters:

- `createdAt` (string): Creation timestamp (RFC 3339)
- `id` (string): Domain ID
- `mxTarget` (string): MX target to add to the domain's DNS before verification
- `name` (string): Domain name
- `status` (string): DNS verification status
- `txtToken` (string): TXT token to add to the domain's DNS before verification

### `domains.delete` (~24 tokens)

Delete domain

Delete a registered custom domain.

Input parameters:

- `domainId` (string, required): Domain ID

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `team.members.list` (~16 tokens)

List team members

List the tenant's team members.

Output parameters:

- `items` (array)

### `team.members.add` (~62 tokens)

Add team member

Add a team member directly (no invitation flow).

Input parameters:

- `email` (string, required): Member email address
- `status` (string, required): Member status, conventionally ACTIVE
- `user_id` (string, required): Member user ID
- `username` (string, required): Member username

Output parameters:

- `createdAt` (string): Creation timestamp (RFC 3339)
- `email` (string): Member email address
- `id` (string): Member ID
- `status` (string): Member status (e.g. ACTIVE)
- `user_id` (string): Member user ID
- `username` (string): Member username

### `team.members.get` (~27 tokens)

Get team member

Fetch a single team member by ID.

Input parameters:

- `memberId` (string, required): Member ID

Output parameters:

- `createdAt` (string): Creation timestamp (RFC 3339)
- `email` (string): Member email address
- `id` (string): Member ID
- `status` (string): Member status (e.g. ACTIVE)
- `user_id` (string): Member user ID
- `username` (string): Member username

### `team.members.delete` (~24 tokens)

Delete team member

Remove a team member.

Input parameters:

- `memberId` (string, required): Member ID

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `team.invitations.create` (~40 tokens)

Create invitation

Create a team invitation for an email address (SMTP invite is sent by the team service).

Input parameters:

- `email` (string, required): Invitee email address

Output parameters:

- `createdAt` (string): Creation timestamp (RFC 3339)
- `email` (string): Invitee email address
- `id` (string): Invitation ID
- `status` (string): Invitation status (e.g. PENDING)

### `team.invitations.list` (~18 tokens)

List invitations

List the tenant's team invitations.

Output parameters:

- `items` (array)

### `team.invitations.delete` (~27 tokens)

Delete invitation

Revoke a team invitation.

Input parameters:

- `invitationId` (string, required): Invitation ID

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `identities.list` (~53 tokens)

List identities

List the tenant's mock identities, optionally filtered by OAuth client or mailbox address.

Input parameters:

- `clientId` (string): Filter by OAuth client ID. Optional.
- `mailboxAddress` (string): Filter by mailbox address. Optional.

Output parameters:

- `items` (array)

### `identities.create` (~148 tokens)

Create identity

Create a mock identity bound to a mailbox for OAuth flow testing.

Input parameters:

- `avatarUrl` (string): Avatar URL. Optional.
- `claims` (object): Custom claims (e.g. role, plan) merged into the ID token and userinfo. Custom-provider clients only — rejected for google/github/apple/facebook. Optional.
- `clientId` (string, required): OAuth client ID the identity belongs to
- `emailVerified` (boolean): Value of the email_verified claim issued for this identity. Optional.
- `mailboxAddress` (string, required): Mailbox address the identity is linked to (must exist)
- `name` (string): Display name. Optional.
- `username` (string): Identity username. Optional.

Output parameters:

- `avatarUrl` (string): Avatar URL
- `clientId` (string): OAuth client ID the identity belongs to
- `id` (string): Identity ID
- `mailboxAddress` (string): Mailbox address the identity is linked to
- `name` (string): Display name
- `username` (string): Identity username

### `identities.get` (~26 tokens)

Get identity

Fetch a single mock identity by ID.

Input parameters:

- `identityId` (string, required): Identity ID

Output parameters:

- `avatarUrl` (string): Avatar URL
- `clientId` (string): OAuth client ID the identity belongs to
- `id` (string): Identity ID
- `mailboxAddress` (string): Mailbox address the identity is linked to
- `name` (string): Display name
- `username` (string): Identity username

### `identities.update` (~159 tokens)

Update identity

Update a mock identity: profile fields, isActive (activate/deactivate), emailVerified, and custom claims merged into the ID token and userinfo.

Input parameters:

- `avatarUrl` (string): Avatar URL. Optional.
- `claims` (object): Custom claims (e.g. role, plan) merged into the ID token and userinfo. Replaces existing claims. Reserved claim names are rejected. Optional.
- `emailVerified` (boolean): Value of the email_verified claim issued for this identity. Optional.
- `identityId` (string, required): Identity ID
- `isActive` (boolean): Whether the identity can be used in OAuth flows. Optional.
- `name` (string): Display name. Optional.
- `username` (string): Identity username. Optional.

Output parameters:

- `avatarUrl` (string): Avatar URL
- `clientId` (string): OAuth client ID the identity belongs to
- `id` (string): Identity ID
- `mailboxAddress` (string): Mailbox address the identity is linked to
- `name` (string): Display name
- `username` (string): Identity username

### `identities.delete` (~23 tokens)

Delete identity

Delete a mock identity.

Input parameters:

- `identityId` (string, required): Identity ID

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `oauth.clients.list` (~20 tokens)

List OAuth clients

List the tenant's OAuth clients for mock identity testing.

Output parameters:

- `clients` (array)

### `oauth.clients.create` (~83 tokens)

Create OAuth client

Register an OAuth client for mock identity flows. The plaintext clientSecret is returned once at creation.

Input parameters:

- `name` (string, required): Client display name
- `providerLabel` (string): Custom provider label. Required when providerType is custom.
- `providerType` (string): Identity provider type
- `redirectUris` (array, required): Allowed redirect URIs (at least one)

Output parameters:

- `clientId` (string): Public OAuth client ID
- `clientSecret` (string): Plaintext secret — returned once at creation or rotation
- `createdAt` (string): Creation timestamp (RFC 3339)
- `name` (string): Client display name
- `providerLabel` (string): Custom provider label
- `providerType` (string): Identity provider type
- `redirectUris` (array): Allowed redirect URIs

### `oauth.clients.get` (~32 tokens)

Get OAuth client

Fetch a single OAuth client by its public client ID.

Input parameters:

- `clientId` (string, required): Public OAuth client ID

Output parameters:

- `clientId` (string): Public OAuth client ID
- `clientSecret` (string): Plaintext secret — returned once at creation or rotation
- `createdAt` (string): Creation timestamp (RFC 3339)
- `name` (string): Client display name
- `providerLabel` (string): Custom provider label
- `providerType` (string): Identity provider type
- `redirectUris` (array): Allowed redirect URIs

### `oauth.clients.delete` (~31 tokens)

Delete OAuth client

Delete an OAuth client by its public client ID.

Input parameters:

- `clientId` (string, required): Public OAuth client ID

Output parameters:

- `http_status` (integer): HTTP status of the API response
- `status` (string)

### `oauth.clients.rotate_secret` (~36 tokens)

Rotate client secret

Rotate an OAuth client's secret. The new plaintext secret is returned once.

Input parameters:

- `clientId` (string, required): Public OAuth client ID

Output parameters:

- `clientId` (string): Public OAuth client ID
- `clientSecret` (string): Plaintext secret — returned once at creation or rotation
- `createdAt` (string): Creation timestamp (RFC 3339)
- `name` (string): Client display name
- `providerLabel` (string): Custom provider label
- `providerType` (string): Identity provider type
- `redirectUris` (array): Allowed redirect URIs

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/minutemailco-mcp-server/mcp#diagnostics

## Score history

- 2026-09-27: 73
- 2026-09-26: 73
- 2026-09-25: 73
- 2026-09-24: 73
- 2026-09-23: 73
- 2026-09-22: 72
- 2026-09-21: 72
- 2026-09-20: 71
- 2026-09-19: 71
- 2026-09-18: 70
- 2026-09-17: 70
- 2026-09-16: 69
- 2026-09-15: 69
- 2026-09-14: 68
- 2026-09-13: 68
- 2026-09-12: 67
- 2026-09-11: 67
- 2026-09-10: 67
- 2026-09-09: 66
- 2026-09-08: 66
- 2026-09-07: 65
- 2026-09-06: 65
- 2026-09-05: 64
- 2026-09-04: 64
- 2026-09-03: 63
- 2026-09-02: 63
- 2026-09-01: 62
- 2026-08-31: 62
- 2026-08-30: 61
- 2026-08-29: 61

## Common questions

### What is the MinuteMail MCP server?

MinuteMail is an MCP server listed in the public MCP registry as io.github.minutemailco/mcp-server. Ephemeral mailboxes and a mock OAuth IdP for testing email and auth flows, 39 API-driven tools. This page covers its hosted endpoint (https://mcp.minutemail.co/mcp).

### Is the MinuteMail MCP server safe to use?

MinuteMail scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the MinuteMail MCP server expose?

MinuteMail exposes 40 tools: mailboxes.list, mailboxes.create, mailboxes.get, mailboxes.delete, mailboxes.delete_bulk, and 35 more. Their descriptions and schemas cost roughly 1,923 tokens of context every time the server is loaded.

### Does the MinuteMail MCP server require authentication?

No. We connected to MinuteMail without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the MinuteMail MCP server still maintained?

MinuteMail is still listed as active in the MCP registry. We last reached this channel on 27 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://mcp.minutemail.co/mcp
- Authorisation metadata: https://mcp.minutemail.co/.well-known/oauth-protected-resource/mcp
- Repository: https://github.com/minutemailco/mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/minutemailco-mcp-server/mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/minutemailco-mcp-server/mcp.json
- HTML version of this page: https://verifymcp.io/servers/minutemailco-mcp-server/mcp