v2.1.1

Docs-only patch: removed the word "tunnel" from the README (auth bullet and security note now say reverse proxy / private network / VPN only). No code or runtime behavior change from v2.1.0.

Image: ghcr.io/cedjey/mailpit-mcp-server:2.1.1 (also :2.1, :2, :latest).

v2.1.0

Security hardening release.

Security & correctness

• Auth timing side channel fixed — the bearer token is now compared with crypto.timingSafeEqual over SHA-256 hashes instead of ===.
• check_links is no longer marked read-only — it performs real GETs and can trigger one-click action links, so MCP clients now gate it instead of auto-approving.
• send_smtp_message egress hardened — the endpoint override is validated (port 1–65535), the link-local/cloud-metadata range (169.254.0.0/16) is blocked, and a new optional MAILPIT_SMTP_ALLOWED_ENDPOINTS allowlist can lock targeting down (the configured endpoint is always allowed).
• delete_messages / set_read_status mailbox-wide guard — the all-messages path now requires an explicit all: true; omitting ids alone is refused, so a stray call can no longer wipe or flip the entire mailbox.

Tests & docs

• CI now asserts a wrong bearer token is rejected (401), not just a missing one.
• mcp-test.js asserts delete_messages refuses an unconfirmed delete-all.
• README: corrected read-only-tool wording and delete_messages row; documented MAILPIT_SMTP_ALLOWED_ENDPOINTS.
• Plugin: removed the localhost:3000 default mcp_url (empty = user must supply); bumped plugin/marketplace/package to 2.1.0.

Image: ghcr.io/cedjey/mailpit-mcp-server:2.1.0 (also :2.1, :2, :latest).

v2.0.0

Breaking: MAILPIT_SMTP_ENDPOINT is now required — the SMTP host:port applications send mail to. The server refuses to start without it, guaranteeing agents can always discover the mailbox's ingestion point via get_mailbox_info (SMTPEndpoint). MAILPIT_SMTP_ADVERTISE (v1.4.0) still works as a deprecated alias.

New tool: send_smtp_message — sends an email over a real SMTP transaction (exactly what applications do), proving the SMTP channel end-to-end; send_message remains for API-level injection. Supports an endpoint override for addresses not reachable from the MCP server's own network.

Migration from 1.x: add MAILPIT_SMTP_ENDPOINT=<host:port> to your environment and switch the image tag to :2.

v1.4.0

New: MAILPIT_SMTP_ADVERTISE — the operator advertises the SMTP host:port applications must send mail to. Exposed to agents as SMTPEndpoint in get_mailbox_info and in the server instructions, so an AI agent can verify that the project under test is actually routed to THIS mailbox before waiting for emails (a mismatch previously looked identical to 'email never sent'). The route-mail-to-mailpit skill now treats the advertised endpoint as authoritative. Plugin bumped to 1.4.0.

v1.3.0

New tool: get_message_links — extracts all URLs from a message's HTML and text bodies without requesting any of them. Safe for auth-protected links and one-click action links (confirmation, password reset, unsubscribe): retrieve the URL via MCP, then open it with your own tooling and session handling.

Also: check_links now documents that it performs real GETs (side-effect risk on action links) and that 302/401/403 on auth-protected links doesn't mean broken. Server instructions, the verify_email prompt and the example skill updated accordingly.

v1.2.0

Built-in agent context:

• Server instructions (MCP initialize): mailbox concept, standard workflows, search syntax, warnings — injected into the model's context by MCP clients automatically
• Tool annotations: readOnlyHint on read-only tools, destructiveHint on delete_messages
• MCP prompts: verify_email and inspect_mailbox, exposed by Claude Code as slash commands
• examples/: a copyable Claude Code skill encoding the full email-verification workflow

v1.1.1

Fixes a race in wait_for_message: a matching email arriving moments before the wait started was missed. New accept_recent_seconds parameter (default 5) accepts just-arrived messages.

v1.1.0

Seven new tools: get_message_source, get_attachment, check_html, check_links, send_message, set_read_status, wait_for_message.

The server now covers the full read/analyze/send/wait loop for email testing. Attachments return images as images and text as text (2MB cap). wait_for_message polls for new matching messages — useful in e2e flows.

Docker image (amd64/arm64): ghcr.io/cedjey/mailpit-mcp-server:1.1.0

v1.0.0

Initial release.

MCP server for Mailpit with:

• Streamable HTTP transport (network service) and stdio transport
• Bearer-token authentication for the HTTP endpoint
• Optional basic-auth credentials for protected Mailpit instances
• Tools: list_messages, search_messages, get_message, get_message_headers, delete_messages, get_mailbox_info

Docker image (amd64/arm64): ghcr.io/cedjey/mailpit-mcp-server:1.0.0