Skip to content
Sign in Start trapping
MCP ready · Email & HTTP

The capture sandbox your agent can drive.

Catch email and webhooks in dev, then let Claude Code or Cursor block on wait_for_email, pull the OTP, and assert — over a hosted MCP server. The web UI is for the humans watching.

Start trapping Sign in

No card. No SDK. No config to babysit.

Works with
Claude CodeCursorWindsurfZedany MCP client 
# ephemeral sandbox → OTP, one agent loop
> create_sandbox { "ephemeral": true }
← { "smtpUsername": "<sandbox-id>", "smtpPassword": "…" }

> wait_for_email { "timeout": 30 }
← "Verify your account" · 1.4s

> extract_otp
← { "otp": "482913" }
The trap

Somewhere for your dev traffic to land.

Sign-up mail, OTPs, provider webhooks, service-to-service calls — point them at a sandbox and every payload is kept, parsed, and ready to read.

What your stack emits
Outbound email

Sign-ups, OTPs, magic links, receipts — anything your app hands to SMTP.

Inbound HTTP

Provider webhooks, callbacks, and your own services calling each other.

Where it lands
A sandbox you throw away

One sandbox, two ways in: an SMTP credential for the mail, and a capture URL for the requests, which it answers with the mock you set. Same dashboard, same API, same permissions.

Messages Requests Ephemeral or permanent
How you read it back
Web UI

Newest-first list, sandboxed preview, pretty JSON.

REST API

Cursor-paginated, trap_ keys, your CI's favourite.

MCP

Blocking waits and extraction for agents.

What you get

What's inside every sandbox.

The same feature set whether you made it in the dashboard or your agent minted it thirty seconds ago.

Full-MIME email capture

HTML and text parts, headers, and attachments kept as sent. Unknown recipients are refused at RCPT, so the list stays yours.

Safe HTML preview

See the mail the way the recipient would, rendered in a sandboxed frame where tracking pixels and remote loads go nowhere.

Request capture, any shape

Any method, path, query, or body. Headers, source IP, and arrival time recorded, with JSON and form payloads parsed for you.

Mock responses you control

Set the status, headers, and body your caller should see. Template in {{uuid}}, {{now}}, or any value from the request body.

Extraction built in

OTPs, magic links, and body paths come back as values you can assert on — no regex against a MIME blob in your test file.

Ephemeral sandboxes

Mint one per test run and let it expire with everything it caught. Parallel runs stop stepping on each other's captures.

Built for agents

Your test loop already knows what to do.

Point Claude Code, Cursor, or any MCP client at the hosted server and the loop drives TrapIt itself: mint a sandbox, block until the mail or request lands, pull the value it needs, assert, move on.

create_sandbox wait_for_email get_latest_email extract_otp extract_magic_link assert_email set_mock_response wait_for_request get_latest_request extract_from_body assert_request
// one webhook test, start to finish
→ create_sandbox { ephemeral: true }
→ set_mock_response { status: 202 }
… agent triggers the app under test
→ wait_for_request { timeout: 30 }
← POST /hooks/stripe · 0.9s
→ extract_from_body { path: "data.id" }
← "pi_3QxL8k"
→ assert_request { method: "POST" }
← pass · sandbox expires in 60m
How it works

Three steps, however you drive it.

The dashboard, the REST API, and MCP do the same three things — you or your agent can take either route.

01
Create a sandbox

Click New sandbox, call the API, or let your agent mint an ephemeral one mid-test. Keep it around for a shared staging env, or let it expire with the run.

dashboard · POST https://trapit.dev/api/v1/sandboxes · create_sandbox

02
Change one line of config

Swap SMTP_HOST in your staging env file, or paste the capture URL into the webhook config. That is the whole integration — no SDK, no code change, and it reverts as easily as it went in.

.env · appsettings.json · provider webhook URL

03
Read it back

Open it in the UI, pull it over the API, or block on wait_for_* from your agent and get the OTP, link, or body value straight out.

GET https://trapit.dev/api/v1/sandboxes/{id}/messages · wait_for_email

Pricing

Free until you're big.

One product, no feature gates — MCP, the REST API, mock responses and ephemeral sandboxes are in the free tier. The limits exist so we know when to talk, not to meter your test loop.

Free
$0
no card, no trial clock

Enough headroom that most teams never leave it:

100 sandboxes, permanent or ephemeral
1,000,000 captures, email and HTTP together
a busy test suite ≈ 40k 1,000,000
Email & HTTP capture, full MIME kept
Hosted MCP server, whole tool set
REST API, mock responses, extraction
Start trapping live in about a minute
Scale
Let's talk
priced to your volume

The same product with the ceiling lifted:

100+ sandboxes, as many as you need
1,000,000+ captures, at any rate you run
past 1,000,000 no ceiling
Longer retention on every capture
More seats for the whole team
Everything in Free, same API and MCP
Email sales@trapit.io usually answered the same day

Coming up on either number? Mail sales@trapit.io and we'll work out what fits — sandboxes and captures are counted per organisation.

Give your test loop somewhere to aim.

Create a sandbox, point one env var at it, and watch the captures land.

Start trapping Read the quickstart

No card. No SDK. No config to babysit.