An agent can connect on its own if it already holds X_API_KEY, X_API_KEY.Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.
tools.schemasevery tool has an object input schema
fail
tools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: find_email (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_job (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); verify_emails (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
pass
tools.token_costabout 942 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump
stability100 · weight 15
pass
stability.changesno tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name
dependencies50 · weight 15
warn
deps.known_vulns1 advisory of lower severity or without a published fix: GHSA-5r4p-p66f-jhc7 in [email protected] (indirect, fixed in 4.13.11)
fail
deps.mcp_sdk_version@modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
GHSA-6prh-2h8m-c8cwMCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.
Endpoints
remote
auth
reachable
uptime 30d
p50
protocol
last ok
https://mcp.verifox.ai/mcpstreamable-http
api_key ${X_API_KEY}
yes
94%
491 ms
2025-11-25
2026-10-20
package
registry
version
runtime
secrets
verifox-mcp
npm
1.2.1
–
VERIFOX_API_KEY
Tools (6)
find_email
Find ONE person's business email from their name and company domain. Generates ~50 permutations and SMTP-verifies each, waits for the result, and returns the best match (or not_found). Charges 10 Fox Credits per find.
find_emails
Bulk-find business emails for a LIST of contacts (name + company domain each). Submits the list, waits for completion, and returns the found email per contact. Up to 1000 contacts. Charges 10 Fox Credits per contact. Large lists that don't finish quickly return a jobId to poll with get_job.
get_credits
Get the current Fox Credit balance for the Verifox account tied to the API key. Free — no credits charged. Use it to check remaining balance before a big verify/find run (verify = 1 credit/email, find = 10 credits/contact).
get_job
Check an async job started by verify_emails, find_email, or find_emails. Returns results if finished, otherwise the current status. Use the type shown in the submitting tool's response.
verify_email
Verify whether ONE email address is deliverable. Checks syntax, MX, SMTP, catch-all, disposable, free-provider and role detection, and returns a 0-100 quality score. Charges 1 Fox Credit per uncached email.
verify_emails
Bulk-verify a LIST of email addresses. Submits the whole list, waits for completion, and returns one result per email (same fields as verify_email). Best for cleaning lead lists. Charges 1 Fox Credit per email. Large lists that don't finish quickly return a jobId to poll with get_job.