# ai.verifox/email-verifier

> Verify email deliverability & find business emails (single or bulk) via the Verifox API.

- name: ai.verifox/email-verifier
- version: 1.2.1
- connection class: R1 (autonomous)
- trust: 88/100
- quality: 74/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/ai.verifox%2Femail-verifier
- tools: https://api.protogrid.dev/v1/servers/ai.verifox%2Femail-verifier/tools

**An agent can connect on its own if it already holds `X_API_KEY`, `X_API_KEY`.** Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "email-verifier": {
      "type": "http",
      "url": "https://mcp.verifox.ai/mcp",
      "headers": {
        "x-api-key": "${X_API_KEY}",
        "Authorization": "${X_API_KEY}"
      }
    }
  }
}
```

Placeholders to fill: `${X_API_KEY}`, `${X_API_KEY}`.

## Trust

- hygiene: 100
- liveness: 98
- freshness: 65
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-94% ~updated-91d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 74/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: find_email (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_job (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); verify_emails (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 942 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 50 (weight 15)

- warn `deps.known_vulns`: 1 advisory of lower severity or without a published fix: GHSA-5r4p-p66f-jhc7 in hono@4.13.9 (indirect, fixed in 4.13.11)
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
- pass `deps.resolvable`: verifox-mcp@1.2.1 resolved: 98 packages

- tools: 6, about 942 tokens to load them all
- tool set hash: 15d8a241549207d6c786df05f6015ebb
- badge: [![protogrid quality](https://protogrid.dev/badge/ai.verifox/email-verifier.svg)](https://protogrid.dev/servers/ai.verifox/email-verifier)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm verifox-mcp@1.2.1: resolved, 97 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-22jm-h49p-29qw (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them" https://osv.dev/vulnerability/GHSA-22jm-h49p-29qw
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
  - GHSA-6prh-2h8m-c8cw (moderate) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies" https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw
  - GHSA-5r4p-p66f-jhc7 (moderate) in `` hono@4.13.9 ``, indirect, fixed in `` 4.13.11 ``, advisory summary: "Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths" https://osv.dev/vulnerability/GHSA-5r4p-p66f-jhc7

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://mcp.verifox.ai/mcp (streamable-http, auth api_key ${X_API_KEY}, reachable true, uptime30d 0.9385965)

## Packages

- npm verifox-mcp@1.2.1 secrets: VERIFOX_API_KEY

## Tools (6)

- `find_email`: Find ONE person's business email from their name and company domain. Generates ~50 permutations and SMTP-verifies each, waits for the result, and returns the best match (or not_found). Charges 10 Fox Credits per find.
- `find_emails`: Bulk-find business emails for a LIST of contacts (name + company domain each). Submits the list, waits for completion, and returns the found email per contact. Up to 1000 contacts. Charges 10 Fox Credits per contact. Large lists that don't finish quickly return a jobId to poll with get_job.
- `get_credits`: Get the current Fox Credit balance for the Verifox account tied to the API key. Free — no credits charged. Use it to check remaining balance before a big verify/find run (verify = 1 credit/email, find = 10 credits/contact).
- `get_job`: Check an async job started by verify_emails, find_email, or find_emails. Returns results if finished, otherwise the current status. Use the type shown in the submitting tool's response.
- `verify_email`: Verify whether ONE email address is deliverable. Checks syntax, MX, SMTP, catch-all, disposable, free-provider and role detection, and returns a 0-100 quality score. Charges 1 Fox Credit per uncached email.
- `verify_emails`: Bulk-verify a LIST of email addresses. Submits the whole list, waits for completion, and returns one result per email (same fields as verify_email). Best for cleaning lead lists. Charges 1 Fox Credit per email. Large lists that don't finish quickly return a jobId to poll with get_job.