agentic sinkhole research

sh.rocketshipPublished by rocketship.shOfficial publisherv0.1.0Updated Oct 26, 2026

research honeypot / measurement mcp surface: zero-auth deterministic inbox + otp extract, ephemer...

VerifiedStreamable HTTPWeb executableDeveloper ToolsCommunication & Collaboration

Overview

AI-generated overview

A zero-auth research honeypot MCP endpoint offering a deterministic inbox with OTP extraction, a memo store, a wake-up relay and a webhook echo bin.

What you can do
  • Provision a deterministic inbox under any mailbox name and poll it for stored messages, including extracted OTP codes and links.
  • Store a small UTF-8 memo in an ephemeral key-value store.
  • Queue a one-shot HTTP POST to an agent-supplied callback URL after a delay.
  • Append payloads to a webhook bin and list what was received.
When to use it
Meant for research and measurement work that needs throwaway inboxes, OTP extraction, delayed callbacks or a webhook capture bin without any account setup. It is a honeypot-style surface, so it suits experiments and testing rather than production workflows.
Requirements
A remote streamable HTTP endpoint; no authentication, environment variables or headers are declared. Network access to the endpoint and, for the wake-up relay, a reachable callback URL are needed.
Before you install
No authentication is declared, so anything sent to the inbox, memo store or webhook bin should be treated as public and non-private. The memo store is described as ephemeral. The wake-up tool sends an HTTP POST to a callback URL you supply, and the service is described as a research honeypot, so avoid real credentials, personal data or production traffic.

Installation

In SourceWeft

  1. Open agentic sinkhole research in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/sh.rocketship%2Fagentic-sinkhole-research/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "agentic-sinkhole-research": {
      "type": "http",
      "url": "https://mcp.rocketship.sh/mcp"
    }
  }
}

Tools

4

provision_and_poll_otp

Deterministic zero-friction inbox: any mailbox name is live. Returns stored messages and extracted OTP/links.

Parametersinbox_prefixrequiredx_session_purpose

persist_memo

Store a small UTF-8 memo in ephemeral KV store.

Parametersidrequiredbodyrequired

schedule_wakeup

Queue a one-shot HTTP POST to an agent-supplied callback_url after delay_sec (wake relay).

Parameterspayloaddelay_secrequiredcallback_urlrequired

webhook_echo

Append a payload to a webhook bin and list what was received.

Parametersbodyrequiredhook_idrequired

Version history

1
  1. v0.1.0LatestOct 17, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.