ZeroDrop

dev.zerodropPublished by zerodrop.devv0.4.0Updated Nov 7, 2026

Disposable email inboxes for AI agents — OTPs and magic links auto-extracted. No signup to try.

The publisher's own server: drop.media

Overview

ZeroDrop's local MCP server, published by zerodrop.dev; no sign-in required; STDIO; 3 tools.

No AI overview yet: these facts come from the registry entry and the server itself.

Publisher
zerodrop.dev

Installation

In SourceWeft

  1. Open ZeroDrop in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

zerodrop-mcp

[npm] [CI] [license]

Email verification for AI agents — an MCP server that gives Claude, Cursor, Claude Code, and any MCP client disposable email inboxes with auto-extracted OTPs and magic links.

Your agent tests your app's signup. The app sends a verification code. Without an inbox it can read, the agent is stuck. With zerodrop-mcp:

Agent: generate_inbox()  → [email protected]
Agent: [fills the signup form with that address]
Agent: wait_for_email(inbox, require_otp: true)  → { "otp": "847291", "subject": "Verify your email", ... }
Agent: [enters 847291 — flow complete]

No Docker. No SMTP. No signup to try: without an API key, one sender can reach 5 different inboxes a day. A free key lifts that.

Install

Claude Code

bash
claude mcp add zerodrop -- npx -y zerodrop-mcp

Claude Desktop

Add to claude_desktop_config.json:

json
{  "mcpServers": {    "zerodrop": {      "command": "npx",      "args": ["-y", "zerodrop-mcp"]    }  }}

Cursor

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

json
{  "mcpServers": {    "zerodrop": {      "command": "npx",      "args": ["-y", "zerodrop-mcp"]    }  }}

Tools

generate_inbox

Creates a disposable email address. Local and instant — no network request.

ParamTypeDescription
prefixstring, optionalPrefix for the inbox name, e.g. your app name

Returns the inbox address. With a key from zerodrop.dev/keys in ZERODROP_API_KEY, the name starts with your key's prefix (k7x2-myapp-swift-x7k29ab) and only your key can read it. Without one, a prefix whose part before the first hyphen is four letters and digits, at least one of each (app1, app1-web), goes after the adjective instead (swift-app1-web-x7k29ab), so the inbox can't fall under someone's account.

wait_for_email

Blocks until a matching email arrives, then returns it with the OTP and magic link already extracted — the agent never parses HTML or regexes a body.

ParamTypeDescription
inboxstringAddress from generate_inbox
timeout_secondsnumber, optionalDefault 30, max 120
from_containsstring, optionalFilter by sender
subject_containsstring, optionalFilter by subject
require_otpboolean, optionalOnly match emails with an OTP
require_magic_linkboolean, optionalOnly match emails with a magic link

Returns:

json
{  "from": "[email protected]",  "subject": "Your verification code",  "received_at": "2026-07-18T12:34:56Z",  "otp": "847291",  "magic_link": null,  "body_preview": "Your code is: 847291..."}

Without an API key, one sender can reach 5 different inboxes a day. If ZeroDrop held the email because its sender passed that, wait_for_email returns at once (0.3.0 or later) with an error instead of waiting for the timeout:

json
{ "error": "held", "message": "ZeroDrop held an email from yourapp.com to this inbox. The email was not stored. …" }

check_inbox

Non-blocking snapshot of the inbox — recent emails with extracted fields, or an empty list. A notice that ZeroDrop held an email appears as { "held": true, "received_at": "…", "message": "…" }.

What agents use this for

  • Testing auth flows end to end — signup → OTP → verified, driven entirely by the agent
  • QA automation — Claude Code writing and running Playwright tests that need real inboxes
  • Development — "sign up for my own app and tell me if the verification email works"

How it works

Emails sent to a generated inbox are caught at Cloudflare's edge by ZeroDrop's open-source worker. OTPs and magic links are extracted at the edge before your agent reads them. On the free tier, an inbox is deleted 30 minutes after its latest email.

Configuration

Environment variables (set in your MCP client config):

VariableDefaultDescription
ZERODROP_API_KEY—Free key from zerodrop.dev/keys. Inbox names then start with your key's prefix, only your key can read them, and mail to them isn't limited. Without it, inboxes are public and one sender can reach 5 different inboxes a day; past that, the inbox gets a notice from [email protected] instead of the email.
ZERODROP_DOMAINzerodrop-sandbox.onlineYour Workspace's own domain, such as yourcompany-qa.com. Generated inboxes use it, and every inbox on it can be read only with your key, so set ZERODROP_API_KEY too. An address named by hand on it ([email protected]) is read from your key's prefix, where ZeroDrop files it. 0.4.0 or later
ZERODROP_BASE_URLhttps://zerodrop.devSelf-hosted instance URL
json
{  "mcpServers": {    "zerodrop": {      "command": "npx",      "args": ["-y", "zerodrop-mcp"],      "env": { "ZERODROP_API_KEY": "your-key" }    }  }}

Writing tests instead?

If you're generating test code rather than driving flows live, use the SDKs directly:

npm · PyPI · Go · RubyGems · Packagist · JitPack · GitHub Action

AI coding assistant context: docs.zerodrop.dev/ai-coding

Security

  • The server makes requests only to ZERODROP_BASE_URL (zerodrop.dev by default) — nothing else
  • Inbox generation is fully local
  • Two runtime dependencies: the official MCP SDK and zod
  • Report issues: [email protected]

License

MIT — zerodrop.dev

Source: README.md at commit f0126f3

Tools

3

generate_inbox

Generate a disposable email inbox for testing signups, OTP verification, magic links, and password resets. Instant and local — no network request. Use the returned address wherever an email is required, then call wait_for_email to read what arrives. Free tier: 30-minute retention, no signup needed. With a key from zerodrop.dev/keys in ZERODROP_API_KEY, the name starts with the key's prefix and only that key can read the inbox.

Parametersprefix

wait_for_email

Wait for an email to arrive in a ZeroDrop inbox and return it with the OTP and magic link already extracted — no parsing needed. Blocks until an email matching the filters arrives or the timeout is reached. If ZeroDrop held the email instead (without an API key, one sender can reach only a few different inboxes a day), returns at once with error "held" and the reason. Use after triggering a signup, login, or password-reset flow.

Parametersinboxrequiredrequire_otpfrom_containstimeout_secondssubject_containsrequire_magic_link

check_inbox

Check a ZeroDrop inbox right now without waiting. Returns the most recent emails with OTPs and magic links already extracted, or an empty list if nothing has arrived yet. A notice that ZeroDrop held an email is listed as { held: true, message }.

Parametersinboxrequired

Version history

4
  1. v0.4.0LatestNov 4, 2026
  2. v0.3.0Oct 24, 2026
  3. v0.2.0Oct 22, 2026
  4. v0.1.2Sep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Drop integrations