# AuthStunt

> Self-hosted test identities with real mailboxes, for end-to-end tests that need to read a real
> verification message. Each parallel test worker leases its own address, and every claim binds to
> exactly one message. Written in Go, self-hosted, with a REST API and an MCP server.

Most teams do not need this. If you control your own sending stack and only need to catch the mail,
run mailpit next to your dev server. If your mail goes out through a third party and you want
support behind the inbox, buy Mailosaur or Mailtrap. AuthStunt is for the narrow case left over:
several workers at once, each needing its own identity and its own real message, against a provider
whose test mode is per message rather than per worker.

## Docs

- [Almost every hosted identity provider ships a backdoor for your tests](https://authstunt.com/): The measurement behind the project. 284 public repositories using a hosted identity provider with end-to-end tests; exactly one reads a real verification code out of a real inbox, and 34 build their own login backdoor instead.
- [Source repository and README](https://github.com/ivermin1123/authstunt): Install, quickstart, REST API, MCP server, operations and security.
- [What extraction reads, exactly](https://github.com/ivermin1123/authstunt#what-extraction-reads-exactly): The extraction contract. Defines precisely which parts of a message AuthStunt reads when binding a claim, and what it will not read.
- [What it actually guarantees](https://github.com/ivermin1123/authstunt#what-it-actually-guarantees): The binding guarantee, one claim to one message, and how resend is handled.

## Data

- [Reproduction kit for the post](https://github.com/ivermin1123/authstunt/tree/main/research/post-1-repro-kit): Corpus, measurement scripts, pre-registration, quote ledger and per-case verdicts. Every quotation carries a repository, path, line number and the SHA it was read at.