# SignupBouncer

> An API that checks new signups for disposable emails and repeat accounts.

- name: com.signupbouncer/checker
- version: 1.1.1
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 89/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.signupbouncer%2Fchecker
- tools: https://api.protogrid.dev/v1/servers/com.signupbouncer%2Fchecker/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "checker": {
      "type": "http",
      "url": "https://signupbouncer.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-4d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 89/100 (new)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 6 of 6 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 2,099 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history recorded for 3 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 6, about 2,099 tokens to load them all
- tool set hash: 81163d6472512e312a25f4498ecba69e
- tools last changed: 2026-10-19T23:38:25.445Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.signupbouncer/checker.svg)](https://protogrid.dev/servers/com.signupbouncer/checker)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-19 `update_rules` changed (inputSchema)
- 2026-10-19 `lookup_burner_domain` changed (description)
  - before: Says whether a domain is on SignupBouncer's disposable (burner) email list, a known relay service or a free subdomain mail service, or a known real mailbox provider, and when our harvester observed it. Uses only the loaded lists, no DNS lookup, so a brand-new burner domain on a burner mail server is caught only by check_email. Accepts a domain or an email address.
  - after: Says whether a domain is on SignupBouncer's disposable (burner) email list, only on an old burner list (a challenge, not a block), a known relay service or a free subdomain mail service, or a known real mailbox provider, and when our harvester observed it. Uses only the loaded lists, no DNS lookup, so a brand-new burner domain on a burner mail server is caught only by check_email. Accepts a domain or an email address.
- 2026-10-17 `update_rules` added
  - Needs an API key. Changes the Rules settings of one of your apps, which changes live signup blocking for that app: the next real signups are scored and refused under the new settings. Send only the settings to change. The others stay as they are. Setting mode to "enforce" starts refusing signups marked block, and "shadow" stops refusing any. If one value is wrong, nothing changes and the answer says which. Returns the app's rules afterwards, with the settings that changed. Confirm the change with the user first. A key made for one app changes that app, so leave out "app". An older all-apps key needs "app".
- 2026-10-17 `get_rules` added
  - Needs an API key. Returns the Rules settings of one of your apps: shadow or enforce mode, the challenge and block score cutoffs, what a challenge does in the Supabase hook, the message a refused person sees, the "Why was this refused?" link, the velocity thresholds and the setting of each check. The context part lists your plan, the checks that need a higher plan, the values each check takes and the defaults. A key made for one app reads that app, so leave out "app". An older all-apps key needs "app".
- 2026-10-17 `integration_guide` changed (description)
  - before: Returns the steps and the copy-paste code that checks new signups with signupbouncer in one stack: supabase (a hook, no code), fetch (any TypeScript server), nextjs, express, hono, python, firebase or better-auth. Use it when the user is building or changing a signup, register or auth flow. The code reads the API key from SIGNUPBOUNCER_API_KEY. The call has a 1.5-second limit, and any failure lets the signup through.
  - after: Returns the steps and the copy-paste code that checks new signups with SignupBouncer in one stack: supabase (a hook, no code), fetch (any TypeScript server), nextjs, express, hono, python, firebase or better-auth. Use it when the user is building or changing a signup, register or auth flow. The code reads the API key from SIGNUPBOUNCER_API_KEY. The call has a 1.5-second limit, and any failure lets the signup through.
- 2026-10-17 `lookup_burner_domain` changed (description)
  - before: Says whether a domain is on signupbouncer's disposable (burner) email list, a known relay service or a free subdomain mail service, or a known real mailbox provider, and when our harvester observed it. Uses only the loaded lists, no DNS lookup, so a brand-new burner domain on a burner mail server is caught only by check_email. Accepts a domain or an email address.
  - after: Says whether a domain is on SignupBouncer's disposable (burner) email list, a known relay service or a free subdomain mail service, or a known real mailbox provider, and when our harvester observed it. Uses only the loaded lists, no DNS lookup, so a brand-new burner domain on a burner mail server is caught only by check_email. Accepts a domain or an email address.
- 2026-10-17 `explain_reason` changed (description)
  - before: Explains a signupbouncer reason code (for example disposable_domain, burner_mx, repeat_inbox, datacenter_ip): what it means, how many points it adds or whether it blocks alone, and the lowest plan on which it counts. Without a code, lists every code.
  - after: Explains a SignupBouncer reason code (for example disposable_domain, burner_mx, repeat_inbox, datacenter_ip): what it means, how many points it adds or whether it blocks alone, and the lowest plan on which it counts. Without a code, lists every code.
- 2026-10-17 `check_email` changed (description)
  - before: Checks one email address, and optionally the signup's IP address, the way signupbouncer checks a new signup. Returns the result as "verdict" (allow, challenge or block), a 0-100 score, the reasons with their reason codes, the normalised inbox (Gmail dots and +tags folded) and the IP's network. When the domain looks like a typo of a big mail provider (gmial.com), "suggestion" holds the corrected address. Looks up the domain's mail servers live. Every reason is listed, including ones only paid plans count. Nothing sent is stored.
  - after: Checks one email address, and optionally the signup's IP address, the way SignupBouncer checks a new signup. Returns the result as "verdict" (allow, challenge or block), a 0-100 score, the reasons with their reason codes, the normalised inbox (Gmail dots and +tags folded) and the IP's network. When the domain looks like a typo of a big mail provider (gmial.com), "suggestion" holds the corrected address. Looks up the domain's mail servers live. Every reason is listed, including ones only paid plans count. Nothing sent is stored.

Full history: https://api.protogrid.dev/v1/servers/com.signupbouncer%2Fchecker/changes

## Remotes

- https://signupbouncer.com/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (6)

- `check_email`: Checks one email address, and optionally the signup's IP address, the way SignupBouncer checks a new signup. Returns the result as "verdict" (allow, challenge or block), a 0-100 score, the reasons with their reason codes, the normalised inbox (Gmail dots and +tags folded) and the IP's network. When the domain looks like a typo of a big mail provider (gmial.com), "suggestion" holds the corrected address. Looks up the domain's mail servers live. Every reason is listed, including ones only paid plans count. Nothing sent is stored.
- `explain_reason`: Explains a SignupBouncer reason code (for example disposable_domain, burner_mx, repeat_inbox, datacenter_ip): what it means, how many points it adds or whether it blocks alone, and the lowest plan on which it counts. Without a code, lists every code.
- `get_rules`: Needs an API key. Returns the Rules settings of one of your apps: shadow or enforce mode, the challenge and block score cutoffs, what a challenge does in the Supabase hook, the message a refused person sees, the "Why was this refused?" link, the velocity thresholds and the setting of each check. The context part lists your plan, the checks that need a higher plan, the values each check takes and the defaults. A key made for one app reads that app, so leave out "app". An older all-apps key needs "app".
- `integration_guide`: Returns the steps and the copy-paste code that checks new signups with SignupBouncer in one stack: supabase (a hook, no code), fetch (any TypeScript server), nextjs, express, hono, python, firebase or better-auth. Use it when the user is building or changing a signup, register or auth flow. The code reads the API key from SIGNUPBOUNCER_API_KEY. The call has a 1.5-second limit, and any failure lets the signup through.
- `lookup_burner_domain`: Says whether a domain is on SignupBouncer's disposable (burner) email list, only on an old burner list (a challenge, not a block), a known relay service or a free subdomain mail service, or a known real mailbox provider, and when our harvester observed it. Uses only the loaded lists, no DNS lookup, so a brand-new burner domain on a burner mail server is caught only by check_email. Accepts a domain or an email address.
- `update_rules`: Needs an API key. Changes the Rules settings of one of your apps, which changes live signup blocking for that app: the next real signups are scored and refused under the new settings. Send only the settings to change. The others stay as they are. Setting mode to "enforce" starts refusing signups marked block, and "shadow" stops refusing any. If one value is wrong, nothing changes and the answer says which. Returns the app's rules afterwards, with the settings that changed. Confirm the change with the user first. A key made for one app changes that app, so leave out "app". An older all-apps key needs "app".