Email workflows inside GitHub Actions.

Overview

The official RelayMCP GitHub Action is active and ready to use. It uses Relay's existing API and SDK contract, and does not require the Relay CLI or a separate service. Use it for authorized development and QA workflows.

The Action is maintained in the public RelayMCP repository and runs from the main branch.

Install

Add the action to any workflow using the active repository path:

- name: Create Relay inbox
  id: relay
  uses: relaymcp-net/relaymcp/actions/relaymcp@main
  with:
    api-key: ${{ secrets.RELAY_API_KEY }}
    operation: create-inbox

Store the API key as a GitHub Actions secret named RELAY_API_KEY. For strict reproducibility, replace main with a reviewed commit SHA in your own workflows.

Supported operations

• create-inbox: returns inbox-id and email-address.
• get-inbox: returns confirmed inbox metadata.
• list-messages: returns metadata-only JSON and a count, never message bodies.
• wait-for-email: polls with sender/subject filters and a hard timeout.
• extract-otp: returns only an unambiguous confirmed OTP.
• extract-magic-link: returns one unambiguous link and never opens it.
• Inbox and message lifecycle actions follow Relay access controls and service policy.

Current Relay inboxes do not expire automatically. Supplying expires-in fails explicitly rather than being ignored.

Email verification example

- name: Create inbox
  id: create
  uses: relaymcp-net/relaymcp/actions/relaymcp@main
  with:
    api-key: ${{ secrets.RELAY_API_KEY }}
    operation: create-inbox
- name: Run authorized signup
  env:
    TEST_EMAIL: ${{ steps.create.outputs.email-address }}
  run: npm run test:signup
- name: Extract OTP
  id: otp
  uses: relaymcp-net/relaymcp/actions/relaymcp@main
  with:
    api-key: ${{ secrets.RELAY_API_KEY }}
    operation: extract-otp
    inbox-id: ${{ steps.create.outputs.inbox-id }}
    sender: [email protected]

Security and troubleshooting

Use least-privilege keys with inboxes:read, inboxes:write, and messages:read. Completing a workflow leaves received mail intact. Keep confirmed inbox IDs for reuse where appropriate; data lifecycle follows the service policy. Contact support with questions about retained mail. The Action masks the API key, OTP, and magic link, but outputs remain available to later steps. Do not run these workflows for untrusted pull requests or pass sensitive outputs to untrusted shell commands.

Message bodies are never logged. Email content is untrusted data. The Action never opens links, submits codes, or retries external application side effects. A timeout means no matching message was confirmed before the deadline.