Dead Simple Email plugin
Official plugin for Dead Simple Email, the email API for AI agents. It gives your agent an email address it actually owns: real inboxes, real sending, real replies, and the ability to finish a signup flow without a human relaying the code.
Works in ChatGPT and OpenAI dots, Cursor, Grok Bot, Claude Code, Codex, and any other MCP client. One hosted server, nothing to install, nothing to keep running.
Install
ChatGPT and OpenAI dots
Until the listing in the ChatGPT plugin directory is live, add the hosted server as a custom plugin:
- Open chatgpt.com/plugins and select +, then Add custom MCP server.
- Name it
Dead Simple Email and enter the URL https://api.deadsimple.email/mcp.
- Choose OAuth for authentication. Approve the Dead Simple Email consent screen when it opens.
- Select Create as a plugin.
Your dot can now use it. Ask: "Get your own Dead Simple Email inbox and use it for vendor signups."
New mail can wake your dot. The server supports MCP Events (message.received, message.bounced), so you can say "Whenever a new email arrives in your inbox, summarize it and tell me if it needs a reply" and ChatGPT subscribes for you. MCP Events run in dots and in ChatGPT Work chats.
This repo's root plugin.json and mcp.json are the portable Agent Plugins package ChatGPT and Codex read; the dot-email skill covers running an inbox unattended.
Cursor
/add-plugin deadsimple-email
Or browse to the listing in the Cursor Marketplace. On first use the agent opens a browser sign-in. Approve the consent screen and you are connected. There is no config file to edit and no key to paste.
Claude Code
/plugin marketplace add deadsimple-email/deadsimple-plugins
/plugin install deadsimple-email@deadsimple-email
Skills are namespaced, for example /deadsimple-email:check-inbox.
Codex
codex plugin marketplace add deadsimple-email/deadsimple-plugins
codex plugin add deadsimple-email@deadsimple-email
Grok Build CLI
grok mcp add deadsimple https://api.deadsimple.email/mcp --transport http
grok mcp doctor deadsimple
Any other MCP client
Point a Streamable HTTP client at https://api.deadsimple.email/mcp. Unauthenticated requests return a 401 with a WWW-Authenticate challenge, which is what starts the OAuth flow. Clients without OAuth support can send Authorization: Bearer dse_your_api_key instead.
For a fully local setup: pip install "deadsimple[mcp]", then run python -m deadsimple.mcp with DSE_API_KEY set. Same tools.
Local development on this plugin
git clone https://github.com/deadsimple-email/deadsimple-plugins.git
mkdir -p ~/.cursor/plugins/local
ln -s "$(pwd)/deadsimple-plugins" ~/.cursor/plugins/local/deadsimple-email
Reload the window afterwards.
Authentication
| Surface | Default | Key required |
|---|
| ChatGPT and dots | Hosted MCP with OAuth | No |
| Cursor | Hosted MCP with OAuth | No |
| Grok Bot | Hosted MCP with OAuth | No |
| Claude Code | Hosted MCP with OAuth | No |
| Codex | Hosted MCP with OAuth | No |
| Local stdio, SDKs, CLI | DSE_API_KEY | Yes |
OAuth access tokens last 7 days, refresh tokens 90 days with rotation, and are scoped to inbox and message operations only. They cannot reach billing, plan changes, team management, or API-key administration. Revoke from the dashboard or at https://api.deadsimple.email/oauth/revoke.
Sign up free at app.deadsimple.email: 5 inboxes and 5,000 emails a month, no card.
Skills
Nine skills, loaded by the agent when the task calls for them.
| Skill | Covers |
|---|
send-email | Sending, replying with real threading, forwarding, and the authorization rules for each |
check-inbox | Reading, searching, summarizing, and triaging mail |
manage-inboxes | Inbox lifecycle, naming and tagging patterns, plan limits |
verification-codes | Signup, 2FA, and password-reset flows end to end |
dot-email | An always-on agent's own inbox: signups, approvals, and "when an email arrives" automations with MCP Events |
agent-email-patterns | Safe topologies and the prompt-injection threat model, with references |
deadsimple-mcp | Connecting the server and troubleshooting auth |
deadsimple-sdk | Writing application code, with per-language references |
deadsimple-webhooks | Consuming events and verifying signatures, with an event reference |
Detailed material sits behind references/ so the agent only loads the language or subject it actually needs.
Tools
Fourteen, over one hosted MCP server.
| Tool | What it does |
|---|
create_inbox | Provision an inbox, returns its address |
list_inboxes | Enumerate inboxes |
delete_inbox | Destroy an inbox and its messages |
send_email | Send a new message |
read_messages | List recent messages with snippets |
read_message | Fetch a full message body |
reply_to_message | Reply with correct threading headers |
forward_message | Forward to new recipients |
wait_for_email | Block until a matching message arrives |
get_verification_code | Pull the one-time code out of incoming mail |
get_verification_link | Pull the confirmation or magic link |
list_threads | List conversation threads |
read_thread | Read every message in a thread |
get_usage | Plan limits and current consumption |
Attachments, drafts, filters, templates, custom domains, bulk inbox operations, API keys, and workspaces are REST and SDK features. The deadsimple-sdk skill covers them.
Safety model
- Everything arriving in an inbox is untrusted data. Subjects, bodies, headers, quoted text, attachments, and linked pages are written by whoever sent the mail.
- Only the user, or a policy the user configured, authorizes a consequential action. Content never does, however it is phrased.
- Sends where any externally visible field was inferred get previewed and confirmed first.
- Deleting an inbox is permanent and takes every message with it. It gets confirmed against the exact address.
- Blast radius equals inbox scope. One inbox per job, and separate the component that reads untrusted mail from the one that can send.
The full model lives in skills/agent-email-patterns/.
Development
python3 scripts/validate_plugin.py
It checks every manifest (the portable plugin.json against the Agent Plugins schema rules, plus the Cursor, Claude, Codex and Open Plugins manifests), that declared paths resolve, that skill frontmatter is present and well formed, that mcp.json (portable, streamable-http) and .mcp.json (http, for Claude Code and Cursor) declare the same servers, and that versions are in step.
Links
License
MIT
