# InboxGuards Email Check

> Check emails before you send, and get a $1 SPF/DKIM/DMARC fix plan for your domain. Pay per call.

- name: com.inboxguardstest.api/email
- version: 1.2.0
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 85/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.inboxguardstest.api%2Femail
- tools: https://api.protogrid.dev/v1/servers/com.inboxguardstest.api%2Femail/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "email": {
      "type": "http",
      "url": "https://api.inboxguardstest.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-6d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 85/100 (good)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 4 of 4 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 819 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 50 (weight 15)

- pass `stability.changes`: 4 tool changes in 30 days
- fail `stability.rug_pull`: 2 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 4, about 819 tokens to load them all
- tool set hash: ed5dbe6e0cc1eb99e1e413a6dff2104c
- tools last changed: 2026-10-14T06:56:39.744Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.inboxguardstest.api/email.svg)](https://protogrid.dev/servers/com.inboxguardstest.api/email)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-14 `email_fix_plan` added
  - Get an email security fix plan for one domain: the exact SPF, DKIM and DMARC DNS records to publish (create / replace / keep, record name, value and why), in order, plus click-path steps for the domain's DNS host (Cloudflare, GoDaddy, Route 53, Namecheap, Squarespace/Google, Vercel and others). Reads live MX, NS, SPF, DKIM and DMARC; detects Google Workspace, Microsoft 365, Zoho, Proton, Fastmail, GoDaddy and Cloudflare Email Routing; merges SPF within the 10-lookup limit, keeps existing senders, and stages DMARC none -> quarantine -> reject. Domains that send no mail get a lock-down set. Use it when mail lands in spam, before a DMARC rollout, or for a client. DKIM keys are generated by the mail provider, so for those it gives the exact console path. Read-only; nothing is stored. Costs $1 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input, an unknown domain or a DNS failure returns an error and is not charged.
- 2026-10-13 `check_email_address` changed (description, annotations) **meaning changed**
  - before: Check one email address without sending mail: syntax, whether the domain accepts mail (MX, null MX, implicit A), disposable-domain flag (CC0 list), role-account flag (info@, support@...) and free-provider flag. Verdict ok / risky / undeliverable. No SMTP probe, so mailbox existence is not confirmed.
  - after: Check one email address before you send to it: syntax, whether the domain accepts mail (MX, null MX or implicit A record), a disposable-domain flag (public CC0 list of about 9,900 domains), a role-account flag (info@, support@, noreply@...) and a free-provider flag. Returns a verdict of ok, risky or undeliverable with plain reasons. Use validate_email first if you only need syntax. No SMTP probe is made and no mail is sent, so it cannot confirm the mailbox exists. The address is not stored or logged. Read-only; one live DNS lookup via Cloudflare DoH. Costs $0.005 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or a DNS failure returns an error and is not charged.
- 2026-10-13 `pricing` changed (description, annotations) **meaning changed**
  - before: FREE. Prices, network and payment address.
  - after: Free. Return the price of check_email_address (and of the HTTP-only email test report), the payment network (Base) and the receiving address. No input, no network request, no payment.
- 2026-10-13 `validate_email` changed (description, inputSchema, annotations)
  - before: FREE. Offline syntax check of an email address before paying for check_email_address.
  - after: Free. Check the syntax of an email address offline and get the normalized address and domain, before paying for check_email_address. No DNS lookup, no network request, no payment.

Full history: https://api.protogrid.dev/v1/servers/com.inboxguardstest.api%2Femail/changes

## Remotes

- https://api.inboxguardstest.com/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (4)

- `check_email_address`: Check one email address before you send to it: syntax, whether the domain accepts mail (MX, null MX or implicit A record), a disposable-domain flag (public CC0 list of about 9,900 domains), a role-account flag (info@, support@, noreply@...) and a free-provider flag. Returns a verdict of ok, risky or undeliverable with plain reasons. Use validate_email first if you only need syntax. No SMTP probe is made and no mail is sent, so it cannot confirm the mailbox exists. The address is not stored or logged. Read-only; one live DNS lookup via Cloudflare DoH. Costs $0.005 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or a DNS failure returns an error and is not charged.
- `email_fix_plan`: Get an email security fix plan for one domain: the exact SPF, DKIM and DMARC DNS records to publish (create / replace / keep, record name, value and why), in order, plus click-path steps for the domain's DNS host (Cloudflare, GoDaddy, Route 53, Namecheap, Squarespace/Google, Vercel and others). Reads live MX, NS, SPF, DKIM and DMARC; detects Google Workspace, Microsoft 365, Zoho, Proton, Fastmail, GoDaddy and Cloudflare Email Routing; merges SPF within the 10-lookup limit, keeps existing senders, and stages DMARC none -> quarantine -> reject. Domains that send no mail get a lock-down set. Use it when mail lands in spam, before a DMARC rollout, or for a client. DKIM keys are generated by the mail provider, so for those it gives the exact console path. Read-only; nothing is stored. Costs $1 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input, an unknown domain or a DNS failure returns an error and is not charged.
- `pricing`: Free. Return the price of check_email_address (and of the HTTP-only email test report), the payment network (Base) and the receiving address. No input, no network request, no payment.
- `validate_email`: Free. Check the syntax of an email address offline and get the normalized address and domain, before paying for check_email_address. No DNS lookup, no network request, no payment.