Smails — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Smails (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Disposable email for humans and AI agents. An instant, anonymous throwaway inbox for sign-ups, one-time codes, and confirmations — with a REST API, a CLI, and an MCP server, so your AI agent can receive verification emails too. No signup, no password.
→ [smails.dev](https://smails.dev) · npx @smails/cli create
Give your agent its own inbox: plug the MCP server into Claude, Cursor, or any MCP client and it can create a mailbox and read incoming mail (verification codes, magic links) on its own.
Visit [smails.dev](https://smails.dev) — an inbox is created for you on first load.
npx @smails/cli create # create a mailbox (token saved to ~/.smails)
npx @smails/cli inbox # list messages
npx @smails/cli read <id> # read a message (id prefix is enough)
npx @smails/cli whoami # show the current address
npx @smails/cli create --force # replace with a fresh mailboxAdd the server to any MCP client (e.g. Claude Desktop, ~/.claude/mcp.json):
{
"mcpServers": {
"smails": { "command": "npx", "args": ["@smails/cli", "mcp"] }
}
}Tools: create_mailbox, list_messages, read_message, delete_message, get_address.
# create a mailbox
curl -X POST https://smails.dev/api/mailbox
# → { "address": "...", "token": "..." }
# list messages with the returned token
curl https://smails.dev/api/mailbox/messages \
-H "Authorization: Bearer <token>"| Method | Path | Description |
|---|---|---|
POST | /api/mailbox | Create a mailbox → { address, token } |
GET | /api/mailbox/messages | List messages |
GET | /api/mailbox/messages/:id | Read a message (full parsed body) |
DELETE | /api/mailbox/messages/:id | Delete a message |
WS | /api/mailbox/connect?token= | Stream new-mail notifications |
Authenticate every request (except create) with Authorization: Bearer <token>.
Inbound mail ──▶ Cloudflare Email Routing (catch-all)
│
▼
Worker email() handler ──┐
▼
Web / CLI / MCP ──REST + WS──▶ Durable Object (one per mailbox)
├─ SQLite (messages)
├─ token auth
└─ 7-day alarm → cleanup{address}.{secret}; the Worker routes by address, the DO verifies the full token.frontend/ React Router SPA (prerendered) — Tailwind v4 + shadcn
worker/ Cloudflare Worker + Durable Objects — Hono routing, postal-mime parsing
cli/ npm package — CLI + MCP server (@smails/cli)Each package is independent (pnpm). Install per package.
# frontend
cd frontend && pnpm install && pnpm dev
# worker (API + Durable Objects)
cd worker && pnpm install && pnpm dev
# cli / mcp
cd cli && pnpm install && pnpm build
SMAILS_API_URL=http://localhost:8787 node dist/index.js createThere are two independent release tracks — pushing to main ships the service, but not the CLI.
Worker + frontend — auto-deployed by Cloudflare Workers Builds on every push to main (the frontend builds to static assets the Worker serves). No manual step. To deploy by hand instead:
cd frontend && pnpm build # → build/client
cd ../worker && pnpm run deploy # wrangler deploy — serves assets + API + DOsCLI (`@smails/cli`) + MCP server — not auto-deployed; publishing is a separate, manual release:
cli/package.json (npm rejects re-publishing an existing version).main.gh release create cli-vX.Y.Z --target main — creating the GitHub Release triggers .github/workflows/publish-cli.yml, which publishes to npm and syncs the MCP registry listing from server.json.server.json'sdescriptionmust be ≤ 100 characters or the MCP registry publish step 422s.
Receiving mail uses Cloudflare Email Routing (catch-all → the Worker's email handler). Configure receiving domains via the DOMAINS var and the route in worker/wrangler.jsonc.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.