Email flow testing for AI-built apps

Your agent tests every signup email. Then cleans up after itself.

Flowproof gives Claude Code, Codex, and Cursor throwaway users, catches every email your app sends, grades the whole flow, and deletes the test accounts from your database, Stripe, and anything else you connect when it’s done.

Grade my emails freeGet a Flow Pass, $29 once

No subscription. No junk accounts in your real inbox. No cleanup script at 11pm.

claude code · session s7k2ab · leadertreks-staging
  1. › start_session("signup + password reset")
    session s7k2ab open · addresses lt.s7k2ab.*@flowproof.dev · ttl 24h
  2. › new_address(persona="edge")
    lt.s7k2ab.obrien@flowproof.dev · "Siobhán O'Brien-Nguyen"
  3. › mark_step("submitted signup form")
  4. › wait_for_email(match="verify")
    arrived in 3.8s · verify link extracted · resolves 200
  5. › wait_for_email(match="welcome")
    warning: merge tag leaked · "Hi ," (first_name empty)
  6. › end_session(teardown=true)
    removed 1 WP user, 1 Stripe customer, 1 Supabase row
    report: B+ · 2 fixes · 1 missing email

The most tedious ten minutes of every build

You ship faster than ever with an AI agent. Then you hit the signup flow and it all slows down.

How it works

One loop. Provision, run, grade, clean up.

Temp inboxes already exist. Nobody owns the whole loop, and the loop is the product.

  1. 01 · Provision

    Sessions, not signups

    Open a session and every address on your project subdomain is live instantly. Optional edge-case personas: long names, apostrophes, unicode.

  2. 02 · Run

    Your agent drives the flow

    It signs up, waits for the verify email, extracts the link or OTP, clicks it, and keeps going. Unhappy paths included: expired links, reused tokens, duplicate signups.

  3. 03 · Grade

    A report on the whole flow

    Latency, auth, broken links, merge tags, duplicate sends, missing emails, and copy suggestions ready to paste. Readable by the agent and by you.

  4. 04 · Clean up

    Teardown everywhere they landed

    Test users vanish from WordPress, Supabase, Stripe, and anything behind a webhook. You get an itemized receipt of exactly what was removed.

The report

Not “did it arrive.” Is the flow any good?

Deterministic checks catch the bugs. A critique pass grades the experience. And a lifecycle map flags the emails that should exist but don’t, the ones that are really security gaps.

  • Arrival latency per email, with step-to-email timing
  • SPF, DKIM, DMARC, and From / Reply-To sanity
  • Leaked merge tags, staging URLs, http links, Gmail clipping
  • Token behavior: reset links work once, verify links expire
  • Checks that lack evidence say so, and never lower the grade
  • Shareable report link, with every token and code redacted

Signup + password reset

leadertreks-staging · session s7k2ab · 5 emails in 41s

Flow gradeB+

Timeline

  1. 00:00.0Submitted signup form
  2. 00:03.8Confirm your emailPass
  3. 00:04.1Welcome to LeaderTreksWarn
  4. 00:22.0Requested password reset
  5. 00:41.3Reset your passwordSlow
  6. —Your password was changed (expected, never sent)Missing

Fixes, in order

  1. criticalNo notification when a password changes. Add one to the reset handler so a hijacked account can’t be silently taken over.
  2. warningWelcome email renders “Hi ,” when first_name is empty. Fall back to “Hi there” in the template.
  3. copySubject “Reset your password” is fine. The CTA “Click here” should say “Choose a new password” so the next step is obvious.

Teardown

The cleanup nobody actually does

Every test user is born on your Flowproof domain, and adapters receive the exact list of addresses the session minted. They can act on those and nothing else. Never a pattern delete, never a wildcard, always a dry-run preview and an itemized receipt.

WordPress / WooCommerce

Companion plugin flags test users, hides them from admin lists and Woo reports, and deletes users, orders, and meta on teardown.

Supabase / Postgres

A generated migration sets is_test from the email domain. A cleanup function removes rows and auth.users.

Stripe

Deletes session customers and cancels their subscriptions, in test mode or live.

Generic webhook

We POST the session's addresses to your endpoint. You send back a receipt. Covers anything custom.

Coming next: Clerk, Auth0, Firebase Auth, MailerLite, Mailchimp, Kit, HubSpot, Resend, Postmark.

Teardown receipt · s7k2ab
wordpress · users
3
wordpress · orders
2
stripe · customers
3
stripe · subscriptions
1
supabase · auth.users
3
records outside session
0 touched

Completed 2026-09-19 14:02 · dry run reviewed by agent first

MCP first

The instructions live in the connection

Flowproof is a remote MCP server. The protocol ships inside the tool descriptions, so once it’s connected your agent already knows the rules: never use a real inbox, open a session before creating a user, verify every link, tear down when finished.

Run one command and it writes the config for Claude Code, Codex, and Cursor plus a short block for your CLAUDE.md and AGENTS.md. From then on, any time the agent touches auth or email code, it tests the flow this way without being asked.

$ npx flowproof init
✓ wrote .mcp.json (claude code)
✓ wrote .cursor/mcp.json
✓ wrote AGENTS.md block
✓ appended CLAUDE.md protocol
## Email flow testing
Before creating any user, call flowproof start_session.
Register users only with session addresses.
After each step, wait_for_email and verify the link works.
Test wrong code, expired link, reused reset, duplicate signup.
When done, end_session and read the report back to me.

And the parts that make it worth coming back to

Pricing

Pay for the sprint, not the subscription

You test hard for a few weeks, then you ship. The pricing matches that.

Stop testing signup with your own inbox.

Grade your app’s emails free in ten minutes. Then connect Flowproof to your agent, run the whole flow, and never see a junk user again.

Grade my emails free