Overview
Flowproof tests every email your app sends: signup and password reset, and the invites, notifications, receipts, failed payments and reminders after them. Your AI coding agent does the testing with throwaway users, Flowproof grades what arrives, and every test account is deleted when the run ends.
You don’t need to write tests or code to use it. You connect Flowproof to your coding agent once, then ask the agent in plain English to test your emails. The agent does the clicking; Flowproof gives it the test inboxes, grades what arrives, and tidies up.
Two ways in
Start from where your app is. Each door has a first prompt to paste once Flowproof is connected.
My app is built
Test the emails it already sends, and find the ones it forgot.
Use Flowproof to test my app’s signup and password reset emails. Map every email my app sends first. Clean up the test users when you’re done, then show me the report.Then: The email map, how a test run works and cleanup.
I’m building my app
Plan the emails it needs from day one, then build and test each one as you go.
Use Flowproof to plan the emails my app needs (it’s a SaaS with teams and Stripe billing), save them to the email map, then help me build and test each one as we go. Add Flowproof’s email rules to CLAUDE.md.Then: Planning the emails of an app you’re still building, sender setup, the email templates and the email rules for CLAUDE.md.
How it works, in four steps
01 · Map
Your agent lists your app’s emails
It reads your code (or plans with you, if the app is still being built) and saves every email the app can send to the email map, with who gets each one.
02 · Test
It tests them like a real user
Claude Code, Cursor, Codex or another agent signs up with throwaway addresses from Flowproof, triggers each email, and uses the link or code in it. One address per person when an email goes to someone else.
03 · Grade
Flowproof grades every email
How fast it arrived, SPF, DKIM and DMARC, broken links, leaked merge tags, what each kind of email has to say, and emails that should exist but never came.
04 · Clean up
The test users are deleted
When the run ends, Flowproof removes the test accounts from the systems you connected (your database, Stripe, WordPress) and gives you a receipt.
Flowproof is a remote MCP server: a set of tools your agent can call, with the testing rules written into the tools themselves. Once it’s connected, your agent already knows to use a test address instead of a real inbox, to check that each link actually works, and to clean up when it’s done.
What “a run” is
A run is one test session. Your agent opens it, does the testing, and closes it. Everything in between belongs to that run: the test addresses it made, the emails that arrived, the steps it took, the graded report, and the cleanup receipt.
Every run shows up on the Runs page of your dashboard. Plans count runs (the Free plan includes 10 a month), but a limit is only ever checked when a run starts: nothing stops a run halfway, and nothing ever stops its cleanup. See Plans and limits.
The safety promise
On top of that, cleanup is switched off for a system until it has passed a connection test and a dry run that changes nothing, and you have armed it. Cleanup explains each layer.
Why we built it
We’re The Sky Floor, a small web agency. We look after WordPress and WooCommerce sites and web apps for clients, and their signup, verification and password-reset emails kept breaking without anyone noticing: a plugin update, a DNS or SMTP change, an expired API key. Checking by hand meant fake accounts piling up in real databases. So we built the tool we wanted our own coding agent to use, and it found a real bug on its first run: a password reset that never told the account owner their password had changed.
Find your way around
- QuickstartSign up, create an API key, connect Claude Code, Cursor or Codex, and run your first email flow test in about five minutes.
- The email mapEvery email your app sends, found in its code and tested one by one, including the ones one person’s action sends to another.
- How a test run worksSessions, test addresses, steps and latency, waiting for email, recording what the app did, and how the report is graded.
- CleanupHow Flowproof deletes the test users a run created, why it can only ever touch addresses it minted, and how to connect and arm a system.
- Email templatesLaunch-ready drafts of every email an app sends, from the welcome and invite to receipts, failed payments and security notices, as email HTML or React Email.
- Sender setupSPF, DKIM and DMARC in plain words, a one-prompt check of your sending domain, and the exact DNS records for Resend, Postmark, SendGrid, SES, Mailgun and Brevo.
- Testing scheduled emailsTrial-ending, digest and day-30 emails, tested now instead of in days: a small endpoint in your app that acts only for Flowproof’s live test users.
- Flow WatchRecord a passing flow once and Flowproof replays it on a schedule, alerting you when its email breaks, slows down or changes.
- Pull request checksRun a watch against every pull request’s preview deploy on Vercel, Netlify or Cloudflare Pages, with the email grade posted on the pull request.
- Plans and limitsFree, Flow Pass, Flow Watch and Agency: runs, projects, AI wording reviews and how long data is kept. Cleanup is on every plan.
Just want to see what your emails look like to Flowproof, with no account? Try the free Email Flow Grader.