MinuteMail
by minutemailco · remote · no sign-in to list tools · v1.1.3 · published by GitHub user minutemailco
Ephemeral mailboxes and a mock OAuth IdP for testing email and auth flows — 39 API-driven tools
Deletes · 12Changes · 12
40 tools: 12 can delete or cancel things, 12 change things and 16 only read.
Scanned Oct 21, 2026
- Deletes or cancels12Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things12Claude Code: ask: see these tools
- Only reads16Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http minutemailco https://mcp.minutemail.co/mcp --header 'Authorization: <your-authorization>'Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
40 tools
Deletes or cancels 12Claude Code: deny
archived.deletePermanently delete an archived mailbox.No findings
Why it is in this group
- The name "archived.delete" says "delete": a word for removing or ending something.
- The description says "Permanently delete".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Permanently delete an archived mailbox.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Delete archived mailbox
attachments.deleteDelete a single attachment.No findings
Why it is in this group
- The name "attachments.delete" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Delete a single attachment.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Delete attachment
attachments.delete_bulkDelete several attachments of one email at once.No findings
Why it is in this group
- The name "attachments.delete_bulk" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Delete several attachments of one email at once.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Bulk delete attachments
domains.deleteDelete a registered custom domain.No findings
Why it is in this group
- The name "domains.delete" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Delete a registered custom domain.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Delete domain
identities.deleteDelete a mock identity.No findings
Why it is in this group
- The name "identities.delete" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Delete a mock identity.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Delete identity
mailboxes.deleteDelete a mailbox and its contents by ID.No findings
Why it is in this group
- The name "mailboxes.delete" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Delete a mailbox and its contents by ID.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Delete mailbox
mailboxes.delete_bulkDelete several mailboxes at once by ID.No findings
Why it is in this group
- The name "mailboxes.delete_bulk" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Delete several mailboxes at once by ID.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Bulk delete mailboxes
mails.deleteDelete a single email.No findings
Why it is in this group
- The name "mails.delete" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Delete a single email.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Delete mail
mails.delete_bulkDelete several emails of one mailbox at once.No findings
Why it is in this group
- The name "mails.delete_bulk" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Delete several emails of one mailbox at once.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Bulk delete mails
oauth.clients.deleteDelete an OAuth client by its public client ID.No findings
Why it is in this group
- The name "oauth.clients.delete" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Delete an OAuth client by its public client ID.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Delete OAuth client
team.invitations.deleteRevoke a team invitation.No findings
Why it is in this group
- The name "team.invitations.delete" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Revoke a team invitation.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Delete invitation
team.members.deleteRemove a team member.No findings
Why it is in this group
- The name "team.members.delete" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Remove a team member.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Delete team member
Changes things 12Claude Code: ask
archived.reactivateReactivate an archived mailbox back to active state.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Reactivate an archived mailbox back to active state.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Reactivate archived mailbox
attachments.addAttach a file to a test-injected email (base64 payload).No findings
Why it is in this group
- The name "attachments.add" says "add": a word for a change.
Description, as the server wrote it Attach a file to a test-injected email (base64 payload).
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Add attachment
domains.registerRegister a new custom domain.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Register a new custom domain. DNS records (TXT token + MX) must then be added before verification can succeed.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Register domain
domains.verifyTrigger DNS verification (TXT + MX) of a registered domain.No findings
Why it is in this group
- The description's first verb is "trigger": a word for a change.
Description, as the server wrote it Trigger DNS verification (TXT + MX) of a registered domain.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Verify domain
identities.createCreate a mock identity bound to a mailbox for OAuth flow testing.No findings
Why it is in this group
- The name "identities.create" says "create": a word for a change.
Description, as the server wrote it Create a mock identity bound to a mailbox for OAuth flow testing.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Create identity
identities.updateUpdate a mock identity: profile fields, isActive (activate/deactivate), emailVerified, and custom claims merged into the ID token and userinfo.No findings
Why it is in this group
- The name "identities.update" says "update": a word for a change.
Description, as the server wrote it Update a mock identity: profile fields, isActive (activate/deactivate), emailVerified, and custom claims merged into the ID token and userinfo.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Update identity
mailboxes.createCreate a new temporary mailbox.No findings
Why it is in this group
- The name "mailboxes.create" says "create": a word for a change.
Description, as the server wrote it Create a new temporary mailbox. The domain defaults to the tenant's default domain; the owner is always the API key's owner.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Create mailbox
mails.injectInject a simulated inbound email into a mailbox (multipart upload).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Inject a simulated inbound email into a mailbox (multipart upload). No external mail is sent; use this to simulate inbound mail for flow testing.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Inject test mail
oauth.clients.createRegister an OAuth client for mock identity flows.No findings
Why it is in this group
- The name "oauth.clients.create" says "create": a word for a change.
Description, as the server wrote it Register an OAuth client for mock identity flows. The plaintext clientSecret is returned once at creation.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Create OAuth client
oauth.clients.rotate_secretRotate an OAuth client's secret.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Rotate an OAuth client's secret. The new plaintext secret is returned once.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Rotate client secret
team.invitations.createCreate a team invitation for an email address (SMTP invite is sent by the team service).No findings
Why it is in this group
- The name "team.invitations.create" says "create": a word for a change.
Description, as the server wrote it Create a team invitation for an email address (SMTP invite is sent by the team service).
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Create invitation
team.members.addAdd a team member directly (no invitation flow).No findings
Why it is in this group
- The name "team.members.add" says "add": a word for a change.
Description, as the server wrote it Add a team member directly (no invitation flow).
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Add team member
Only reads 16Claude Code: allow
archived.getFetch a single archived mailbox by ID.No findings
Why it is in this group
- The name "archived.get" says "get": a word for reading.
Description, as the server wrote it Fetch a single archived mailbox by ID.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get archived mailbox
archived.listList the tenant's archived (expired but recoverable) mailboxes.No findings
Why it is in this group
- The name "archived.list" says "list": a word for reading.
Description, as the server wrote it List the tenant's archived (expired but recoverable) mailboxes.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List archived mailboxes
attachments.getDownload an attachment.No findings
Why it is in this group
- The name "attachments.get" says "get": a word for reading.
Description, as the server wrote it Download an attachment. The file contents are returned base64-encoded in the JSON "data" field.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get attachment
attachments.listList the attachments of an email (metadata only).No findings
Why it is in this group
- The name "attachments.list" says "list": a word for reading.
Description, as the server wrote it List the attachments of an email (metadata only).
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List attachments
domains.listList the tenant's custom domains with their DNS verification status.No findings
Why it is in this group
- The name "domains.list" says "list": a word for reading.
Description, as the server wrote it List the tenant's custom domains with their DNS verification status.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List domains
identities.getFetch a single mock identity by ID.No findings
Why it is in this group
- The name "identities.get" says "get": a word for reading.
Description, as the server wrote it Fetch a single mock identity by ID.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get identity
identities.listList the tenant's mock identities, optionally filtered by OAuth client or mailbox address.No findings
Why it is in this group
- The name "identities.list" says "list": a word for reading.
Description, as the server wrote it List the tenant's mock identities, optionally filtered by OAuth client or mailbox address.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List identities
mailboxes.getFetch a single mailbox by ID.No findings
Why it is in this group
- The name "mailboxes.get" says "get": a word for reading.
Description, as the server wrote it Fetch a single mailbox by ID.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get mailbox
mailboxes.listList the tenant's active mailboxes (owner is derived from the API key).No findings
Why it is in this group
- The name "mailboxes.list" says "list": a word for reading.
Description, as the server wrote it List the tenant's active mailboxes (owner is derived from the API key). Optionally look up a single mailbox by exact address.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List mailboxes
mails.getFetch a single email by ID, including body and attachment metadata.No findings
Why it is in this group
- The name "mails.get" says "get": a word for reading.
Description, as the server wrote it Fetch a single email by ID, including body and attachment metadata.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get mail
mails.listList the emails in a mailbox, newest first.No findings
Why it is in this group
- The name "mails.list" says "list": a word for reading.
Description, as the server wrote it List the emails in a mailbox, newest first.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List mails
oauth.clients.getFetch a single OAuth client by its public client ID.No findings
Why it is in this group
- The name "oauth.clients.get" says "get": a word for reading.
Description, as the server wrote it Fetch a single OAuth client by its public client ID.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get OAuth client
oauth.clients.listList the tenant's OAuth clients for mock identity testing.No findings
Why it is in this group
- The name "oauth.clients.list" says "list": a word for reading.
Description, as the server wrote it List the tenant's OAuth clients for mock identity testing.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List OAuth clients
team.invitations.listList the tenant's team invitations.No findings
Why it is in this group
- The name "team.invitations.list" says "list": a word for reading.
Description, as the server wrote it List the tenant's team invitations.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List invitations
team.members.getFetch a single team member by ID.No findings
Why it is in this group
- The name "team.members.get" says "get": a word for reading.
Description, as the server wrote it Fetch a single team member by ID.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get team member
team.members.listList the tenant's team members.No findings
Why it is in this group
- The name "team.members.list" says "list": a word for reading.
Description, as the server wrote it List the tenant's team members.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List team members
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.1.3. Values in angle brackets are yours to fill in.
claude mcp add --transport http minutemailco https://mcp.minutemail.co/mcp --header 'Authorization: <your-authorization>'Run in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__minutemailco__mailboxes_list",
"mcp__minutemailco__mailboxes_get",
"mcp__minutemailco__mails_list",
"mcp__minutemailco__mails_get",
"mcp__minutemailco__attachments_list",
"mcp__minutemailco__attachments_get",
"mcp__minutemailco__archived_list",
"mcp__minutemailco__archived_get",
"mcp__minutemailco__domains_list",
"mcp__minutemailco__team_members_list",
"mcp__minutemailco__team_members_get",
"mcp__minutemailco__team_invitations_list",
"mcp__minutemailco__identities_list",
"mcp__minutemailco__identities_get",
"mcp__minutemailco__oauth_clients_list",
"mcp__minutemailco__oauth_clients_get"
],
"ask": [
"mcp__minutemailco__mailboxes_create",
"mcp__minutemailco__mails_inject",
"mcp__minutemailco__attachments_add",
"mcp__minutemailco__archived_reactivate",
"mcp__minutemailco__domains_register",
"mcp__minutemailco__domains_verify",
"mcp__minutemailco__team_members_add",
"mcp__minutemailco__team_invitations_create",
"mcp__minutemailco__identities_create",
"mcp__minutemailco__identities_update",
"mcp__minutemailco__oauth_clients_create",
"mcp__minutemailco__oauth_clients_rotate_secret"
],
"deny": [
"mcp__minutemailco__mailboxes_delete",
"mcp__minutemailco__mailboxes_delete_bulk",
"mcp__minutemailco__mails_delete",
"mcp__minutemailco__mails_delete_bulk",
"mcp__minutemailco__attachments_delete",
"mcp__minutemailco__attachments_delete_bulk",
"mcp__minutemailco__archived_delete",
"mcp__minutemailco__domains_delete",
"mcp__minutemailco__team_members_delete",
"mcp__minutemailco__team_invitations_delete",
"mcp__minutemailco__identities_delete",
"mcp__minutemailco__oauth_clients_delete"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as minutemailco. Review it before you use it.