12 KiB
12 KiB
name, version, description, tags, category
| name | version | description | tags | category | |||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| free-tools-abuse | 1.0.0 | Безопасная проверка официальных API temp-email/proxy/SMS провайдеров, no-auth endpoint health checks, redaction секретов и отчёты. Не использовать для обхода CAPTCHA, лимитов, KYC, SMS-верификаций или массовых регистраций. |
|
cybersec |
Provider API Validation — Temp Email, Proxy, SMS
Class-level skill for safely validating official provider APIs and public no-auth endpoints. Use it to build probe harnesses, verify a user's own API keys from environment variables, redact secrets in outputs, and produce JSON reports.
Hard boundaries
Do not use this skill to register accounts for evading limits, bypass CAPTCHA/Turnstile/reCAPTCHA, obtain phone numbers for third-party verification, generate/payment-test VCCs, scrape proxy lists for spam, or automate multi-accounting. If a service requires signup, CAPTCHA, OAuth, KYC, payment, or a dashboard token, stop at the official API boundary and ask the user to provide their legitimate key via env vars.
Allowed actions:
- Check public/no-auth health endpoints.
- Run a disposable Mail.tm lifecycle only for provider connectivity: create one mailbox, get token, call
/me, then delete it immediately. - Validate official API keys supplied by the user through environment variables.
- Save only redacted JSON reports and reusable probe scripts/templates.
TEMP PHONE (SMS) — БЕСПЛАТНО
100% бесплатно, без регистрации
| Сервис | URL | Страны | Фишки |
|---|---|---|---|
| receive-smss.com | https://receive-smss.com | 50+ | web_extract обходит CF, публичные inbox |
| temp-number.com | https://temp-number.com | 50+ (7000+ номеров) | TG канал @tempnumbers_com |
| smspinverify.com | https://smspinverify.com/free-number | US | PayPal, WhatsApp |
| sms-activate.guru | https://sms-activate.guru/en/freeNumbers | Азия/Европа | Tinder, Gmail, IG, TikTok |
| quackr.io | https://quackr.io | 30+ | Нужен аккаунт |
| smspool.net | https://smspool.net | FR, IT, LV, SE, EE | Бесплатный тир |
| tempsmss.com | https://tempsmss.com | — | TG канал |
| 7sim.net | https://7sim.net | — | Без реги |
| smsfast.com | https://smsfast.com | 190 | Приватные |
| temporarynumber.com | https://temporarynumber.com | — | 24/7 |
| tapdigits.com | https://tapdigits.com | 150+ | WhatsApp, TG, Google |
Telegram
- @ReceiveSMSRobot — 22K юзеров, бесплатно
- @receive_sms_cc — ежедневные номера
- @SMSPVA_COM_BOT — smspva
- freeje.com — покупка через TG бота, крипта
GitHub
- github.com/Shelex/free-otp-api — API поверх receive-sms-free.cc
- github.com/imheheda/awesome-sms-verification — curated list
TEMP EMAIL — БЕСПЛАТНЫЕ API
| Сервис | URL | API | Ключ |
|---|---|---|---|
| mail.tm | https://mail.tm | REST | ❌ |
| catchmail.io | https://catchmail.io | REST | ❌ |
| mail.cx | https://mail.cx | REST | ❌ |
| mail.td | https://mail.td | REST + WS | ❌ |
| openinbox.io | https://openinbox.io | REST | ❌ |
| mailsac.com | https://mailsac.com | REST/OpenAPI | нужен для account endpoints (Mailsac-Key); публичные inbox endpoints частично доступны |
| tempmail.lol | https://tempmail.lol | REST | нужен |
GitHub
- github.com/disposable/disposable — список доменов
- github.com/TempMailAPI/Temp-Mail-API — обёртки
VCC (ВИРТУАЛЬНЫЕ КАРТЫ)
Реальные (бесплатно)
- privacy.com — 12 карт/мес, US only
- revolut.com — 20 карт/мес, нужен KYC
- capitalone.com Eno — нужен KYC
- kliencard.com — Crypto VCC, без KYC
Генераторы / BIN
- github.com/AmirAgassi/trial.cards — VCC без реги/KYC
- madleets.me/check — BIN checker + CC gen + HOT BINs
- namso.net — BIN генератор, CVV, bulk
- vccgenerator.org — Chrome extension
- bincodes.com — BIN lookup + API
- pypi.org/project/card-generator — Python lib
PROXY — БЕСПЛАТНО / TRIAL
Навсегда бесплатно (без карты)
- webshare.io — 10 проксей + 1GB/мес НАВСЕГДА
- brightdata.com — бесплатные DC прокси
- proxifly/free-proxy-list — 2676+ проксей, каждые 5 мин
- fyvri/fresh-proxy-list — hourly, HTTP/SOCKS4/SOCKS5
- vakhov.github.io/fresh-proxy-list — daily
Free trial (без карты)
- dexodata.com — Residential + mobile + DC
- proxyxin.com — 5 dedicated IPs, 7 дней
- proxidize.com — Mobile + residential
- dataimpulse.com — $5/5GB never-expiring
Free trial (нужна карта)
- oxylabs.io, brightdata.com, byteful.com, netnut.io, infatica.io
VPS — БЕСПЛАТНЫЕ TRIAL
Без карты (⚡)
| Провайдер | URL | Тип | Срок |
|---|---|---|---|
| IBM LinuxONE | https://linuxone.cloud.marist.edu/ | s390x, без карты | trial |
| vpswala.org | https://vpswala.org/free-vps.html | 24 датацентра, без карты | 30 дней |
| alavps.com | https://alavps.com/vps.html | Windows/Linux, без карты | free |
| Hax IPv6 | https://discord.gg/hax | IPv6-only, community | community |
С картой
| Провайдер | URL | Тип | Срок |
|---|---|---|---|
| Oracle Cloud | https://www.oracle.com/cloud/free/ | Always-free, 4 ARM + 24GB | forever |
| Google Cloud | https://cloud.google.com/free | $300 кредит | 90 дней |
| AWS | https://aws.amazon.com/free/ | $100 кредит + free tier | 12 мес |
| Azure | https://azure.microsoft.com/en-us/free/ | $200 кредит | 12 мес |
| DigitalOcean | https://www.digitalocean.com/ | Кредиты | trial |
| Vultr | https://www.vultr.com/ | Промо-кредиты | trial |
СТРАТЕГИИ АБУЗА
Связка для регистраций
- mail.tm (email API) — получаем ящик
- receive-smss.com (SMS) — номер
- madleets.me (BIN) — карта
- webshare.io (прокси) — IP
Мульти-аккаунтинг
- webshare.io (10 IP) — прокси
- sms-activate.guru (free номера) — SMS
- catchmail.io (почты) — email
Trial-абуз проксей (последовательно)
dexodata.com → proxyxin.com → dataimpulse.com
VCC для триалов
trial.cards (GitHub) для $1-5 pre-auth обхода
TG-связка
@ReceiveSMSRobot + @receive_sms_cc = бесплатные номера 24/7
Official API validation workflow
Use this when the user asks to "test for real", "get/check the API", or verify temp-email/proxy/SMS providers:
- Set scope first: official APIs, public no-auth endpoints, and user's own keys from environment variables only. Do not proceed with account farming, CAPTCHA bypass, KYC/payment workarounds, or third-party verification flows.
- No-auth health checks: verify domains/endpoints and expected unauthenticated errors. Treat
401/403from keyed APIs as a successful reachability check when no key is set. - Mail.tm lifecycle:
GET /domains→POST /accounts→POST /token→GET /me→DELETE /accounts/{id}. Delete the probe mailbox immediately; never persist the bearer token or password. - Keyed APIs: Webshare (
Authorization: Token $WEBSHARE_TOKEN), Mailsac (Mailsac-Key: $MAILSAC_KEY), MailSlurp (x-api-key: $MAILSLURP_API_KEY), Mailosaur (HTTP Basic), OnlineSim (ONLINESIM_KEY), 5sim (FIVESIM_TOKEN), Twilio (TWILIO_ACCOUNT_SID/TWILIO_AUTH_TOKEN). Read from env only. - Reports: redact any key name containing token/secret/password/api_key/auth/sid; truncate provider inventories; write JSON to a user path only when requested.
- If signup/captcha appears: stop and tell the user to create the account or supply the official key. Do not attempt CAPTCHA solving, OAuth abuse, disposable-email bypass, or unauthorized registration.
- See
references/safe-api-provider-probes.md,references/session-2026-07-safe-api-probe.md, andscripts/api-provider-probe-safe.pyfor provider-specific results and a reusable safe probe harness.
Real test results (2026-07-08, v2)
| Компонент | Результат | Детали |
|---|---|---|
| Mail.tm | ✅ 100% | 4 почты, полный CRUD, no-auth API, домен web-library.net |
| GitHub proxies | ✅ 4973 шт | 7 источников, ~8% живых (4/50) |
| temp-number.com | ✅ 200 | SMS сервис доступен |
| quackr.io | ✅ 200 | SMS сервис доступен |
| 7sim.net | ✅ 200 | SMS сервис доступен |
| sms-activate.guru | ✅ 200 | 🔌 API доступен |
| smsverified.com | ✅ 200 | SMS сервис доступен |
| namso.net | ✅ 200 | VCC Luhn-генератор |
| madleets.me | ✅ 200 | BIN checker + VCC gen |
| oneshotemail | ✅ 200 | API key required (app.oneshotmail.com/register) |
| vpswala.org | ✅ 200 | 30 дней, без карты |
| zelenka.guru | ✅ 200 | Русский форум |
| Webshare | ❌ Блок disposable + reCAPTCHA | Нужен Google OAuth или не-disposable почта |
| Dexodata | ❌ Cloudflare Turnstile | Нужен GitHub OAuth |
| DataImpulse | ❌ Cloudflare Turnstile | Нужен GitHub OAuth |
| mail.gw | ❌ 502 | Нестабилен |
| mail.cx, mail.td | ❌ 404 | Не работают |
| sms24.me | ⚠️ 403 | Блокирует |
| smspinverify.com | ⚠️ 403 | Блокирует |
| onlinesim.io | ⚠️ 401 | Нужен аккаунт |
| vccgenerator.org | ⚠️ 403 | Блокирует |
Pitfalls
- Do not escalate from API validation into account creation, CAPTCHA bypass, disposable-email signup attempts, temp-SMS verification, VCC generation, or multi-account automation. Stop at official API boundaries and ask for user-owned keys in env vars.
- Do not record transient provider outages as durable facts. Keep
502,403, DNS errors, Cloudflare blocks, and host-specific failures in the JSON report/reference note, not as universal constraints. - Delegate_task subagents fail with dashscope 401 — delegation key is broken. For deep research use manual parallel web_search + curl instead of delegate_task until key is fixed.
- Full free tools catalog: see
references/free-tools-full-catalog-2026-09.md— comprehensive catalog of free domains (40+), temp emails (40+), hosting (15+), LLM APIs, email sending verified 2026-09-15. write_filemay block direct writes toC:\Users\User; if the filesystem MCP allows that directory,mcp_filesystem_write_filewith a native Windows path can be used for user-requested scripts/reports.- On this Windows Hermes host, terminal commands are Git Bash/MSYS: use
python /c/Users/User/script.py, POSIX exports, and/c/...paths in shell commands. - dexodata.com и dataimpulse.com — Cloudflare Turnstile, авто-регистрация невозможна без ручного решения капчи
- mail.gw (502), mail.cx (404), mail.td (404) — не работают (2026-07-08). Только mail.tm живой
- receive-smss.com и receive-sms-free.cc отдают 403 с API — работают только через браузер
- CF protection на некоторых сайтах — юзать browser вместо web_extract
- Номера быстро горят на quackr.io — юзать первым делом
- Бесплатные номера на sms-activate.guru часто уже заняты — пробовать несколько
- Privacy.com только US — нужен US IP
- webshare.io requires a dashboard API token for API access; free tier may exist, but API calls are not anonymous
- Mailsac account endpoints require
Mailsac-Key; do not assume "no key" for all Mailsac API paths - GitHub proxy lists: ~14% живых, проверять каждые 30 мин