MailSlurp is an established email API for developers and testers, and it has grown into a wide platform: disposable and permanent inboxes, SMS and phone numbers, device previews, inbox placement tests, sender warm-up, AI extraction, and a hosted MCP server for agents. Lumbox is much narrower. It gives an agent an email address, parses what arrives, and lets the agent reply. Which one you want depends mostly on how much of that width you will use.
The MailSlurp details here come from its docs and pricing page as I read them in September 2026. The Lumbox details come from the API source.
Waiting for an email
Both products handle the timing problem the same way: an HTTP call that stays open until a matching message arrives. MailSlurp's wait methods (waitForLatestEmail, waitForMatchingFirstEmail and several count-based variants) take a timeout in milliseconds, return immediately if a matching message is already there, and can filter on subject, sender, recipients and headers. There is also an AI wait endpoint that picks the message using a prompt and returns extracted data alongside it.
Lumbox has GET /v1/inboxes/:id/wait with a timeout in seconds (default 30, maximum 120) and filters for sender, subject, category and has_otp. By default it only returns mail that arrives after the call starts, so a stale message from an earlier run cannot satisfy it. The server checks for new mail once a second, which puts an upper bound of about a second on the added delay.
GET /v1/inboxes/inb_XXXXXXXXXXXXXXXXXXXX/wait?timeout=60&has_otp=true
X-API-Key: ak_...
{
"id": "eml_XXXXXXXXXXXXXXXXXXXX",
"subject": "Your sign-in code",
"from": { "name": "Acme", "address": "no-reply@acme.dev" },
"parsed": {
"otp_codes": ["482913"],
"verification_links": [],
"magic_links": [],
"category": "verification",
"code_expiry": null
},
"received_at": "2026-09-29T10:14:03.000Z"
}That response is trimmed; the full object also carries the bodies, recipients, spam score and labels.
Getting the code out
This is where the two differ most. MailSlurp's documented extraction is a set of calls you make after the wait. getEmailContentMatch runs a regex pattern you supply and returns the matches, getEmailLinks returns the links in the body, and AI extraction turns messages into structured fields against a monthly allowance of weighted tokens. The pricing page lists usage beyond the allowance at $1.00 per 10,000 weighted tokens on Pro and Growth.
Lumbox runs its parser on every message as it arrives, and the result is part of the email object: parsed.otp_codes, parsed.verification_links, parsed.magic_links and parsed.category. You pay nothing extra and supply no pattern, because it is a fixed set of regular expressions. That is also its limit. On received mail it looks for 4 to 8 digit codes in the subject and plain-text body, so an alphanumeric code, or a code that only exists in the HTML part, will not be found. MailSlurp's approach, where you write the regex, handles those shapes as long as you know them in advance.
For the common "your code is 482913" email, the Lumbox parser returns the code with no work on your side, and anything unusual sends you back to the body text with your own pattern. MailSlurp asks for the pattern every time and in return handles whatever shape you describe.
Agents and MCP
MailSlurp's MCP server runs at https://api.mailslurp.com/mcp over Streamable HTTP, with OAuth discovery so Claude Code, Cursor, Codex and similar clients can connect without anyone pasting a key. Each connection becomes a named agent with a role (read only, draft only, responder, support) and a set of inboxes it may see, and a workspace in the dashboard shows the drafts and activity for humans to review. That permission model is the strongest part of MailSlurp's agent story.
Lumbox also has a hosted MCP endpoint, https://mcp.lumbox.co/mcp, with OAuth 2.1 and dynamic client registration, plus a stdio package, @lumbox/mcp-server. Together they expose more than 80 tools covering inboxes, OTP waits, sending, threads, domains and webhooks. What Lumbox does not have is MailSlurp's per-connection roles. Its isolation unit is the project: a project key only sees that project's inboxes, but there is nothing like a read-only or draft-only role for a single agent.
Sending on the free tier
MailSlurp's free plan includes 1,000 "sandbox sends" a month, which go to inboxes inside your own MailSlurp account. External sending starts on Pro, at 500 a month, and custom domains and phone numbers also require Pro. Lumbox's free plan sends to outside addresses: 100 emails a month, 3 a minute, and a ramp of 5 sends in the first hour for a new account without a verified domain. An agent that has to reply to a real person during a trial can do it on the Lumbox free plan and cannot on MailSlurp's.
Side by side
| MailSlurp | Lumbox | |
|---|---|---|
| Wait for email | waitFor methods, timeout in ms, field matching, AI wait | /wait and /otp, up to 120 seconds |
| Codes and links | Regex you supply, link list, token-metered AI extraction | Parsed on arrival into parsed.* |
| MCP | Hosted, OAuth, per-agent roles and inbox scope | Hosted (OAuth 2.1) and npm stdio, no per-agent roles |
| Webhooks | Signed, retried for up to 24 hours | HMAC-SHA256 signed, not retried |
| SMS and phone numbers | Pro and above, billed separately | None |
| Previews, placement tests, warm-up | Yes | None |
| External sends on free plan | No, sandbox sends only | 100 a month |
| Custom domains | Pro and above | Starter and above, per the pricing page |
| Inbox lifetime | Temporary inboxes expire; retained inboxes stay | Stays until you delete it |
Choosing
MailSlurp is the stronger product if email is one part of a testing program. It covers SMS codes, rendering on real mail clients, inbox placement, several people reviewing agent drafts, or the ability to connect existing Gmail and Outlook inboxes, and its agent permissions are ahead of Lumbox's. Its webhook retries are also more forgiving: a Lumbox webhook that fails is logged in the delivery history and not sent again, so a consumer should reconcile against the email list after downtime.
Lumbox fits the narrower job of an agent that signs up somewhere, reads a code, and replies, on small fixed plans (free, then $9, $29 and $99 a month) with parsed codes on every email and no patterns to write. An agent can even create its own account, since POST /v1/orgs with a name returns an API key once and asks for no card.
The MCP docs list the Lumbox tools and connection options, this post on OTP extraction covers the patterns worth writing yourself when a code is not caught, and the plan limits are on the pricing page.