OAuth 2.1 connection

OAuth-capable remote MCP clients can discover Emaily authorization from the MCP endpoint. The protected-resource metadata endpoint is:

GET https://email-verifier-v61-production-gateway.emaily.workers.dev/.well-known/oauth-protected-resource

Emaily supports Authorization Code flow with mandatory PKCE S256, the mcp scope, the resource parameter targeting /mcp, and dynamic client registration at /oauth/register. Access tokens are short-lived and must be sent as Authorization: Bearer <access_token> to /mcp. Active paid Emaily membership is required, and authorization is completed through secure account sign-in and an Emaily consent screen.

If a client does not support MCP OAuth discovery, use the API-key fallback: Authorization: Bearer ev_live_.... API keys and OAuth tokens use the same Emaily account, subscription, quota, rate-limit, and billing pipeline.

OAuth endpoints do not consume verification credits. Never include tokens in logs, issue tokens for a different resource, or reuse an authorization code or refresh token.

Paid tiers

Every paid tier includes the same implemented feature set: all six MCP tools, all documented REST endpoints, CLI access, OAuth and API-key authentication, sync verification for up to 10 emails, async batches for up to 1,000 emails, and batch result export. Tiers differ only in enforced quota and throughput.

The implemented verification engine includes syntax and normalization, MX and Null MX, A/AAAA fallback, SPF, DMARC, disposable and role-account heuristics, common provider and typo detection, and domain inspection for MTA-STS, TLS-RPT, DANE, DKIM, and BIMI. It does not use SMTP and cannot confirm mailbox existence or catch-all behavior.

Email Verifier MCP Server Reference

This is a remote MCP server (@modelcontextprotocol/server v2) exposed over HTTPS. It offers the same verification engine as the REST API through MCP tools so AI agents can verify email addresses and inspect domains directly.

Endpoint

https://email-verifier-v61-production-gateway.emaily.workers.dev/mcp

OAuth is the preferred authentication method for clients that support MCP authorization discovery. Send the resulting access token on every request:

Authorization: Bearer <oauth-access-token>

Clients without OAuth support can use the API-key compatibility path:

Authorization: Bearer ev_live_<your-api-key>

An invalid or missing credential returns 401 with protected-resource metadata for OAuth-capable clients.

Try it with the official Inspector

npx @modelcontextprotocol/inspector@latest

Open the Inspector and point it at the MCP endpoint above with your API key (Authorization: Bearer ev_live_...).

Tools

Tool schemas

check_email_syntax

Input:

• email (string, 1–254 chars). Required.

Output: { email, valid, normalized, local, domain, ...flags, note }.

verify_email

Input:

• email (string, 3–254 chars). Required.
• include_policy_checks (boolean, optional, default true). When false, SPF/DMARC DNS queries are skipped (fewer DNS requests).

Output: full verification result + billing (see the verification schema).

verify_emails

Input:

• emails (array of strings, 1–10, each 3–254 chars). Required.
• include_policy_checks (boolean, optional, default false).

Constraints:

• Policy checks (include_policy_checks: true) are limited to 3 addresses per batch. Exceeding that returns a batch_policy_check_limit error payload.

Output: { summary, results, billing }.

inspect_domain_email_security

Input:

• domain (string, 3–253 chars). Required.
• dkim_selectors (array of strings, optional, max 8, each ≤ 63 chars).
• try_common_dkim_selectors (boolean, optional).
• fetch_mta_sts_policy (boolean, optional).

Output: MX/SPF/DMARC/MTA-STS/TLS-RPT/DANE/DKIM/BIMI analysis + billing.

get_usage

No input. Output: { account, plan, period, used, limit, remaining, reserved }.

get_capabilities

No input. Output: the capability declaration.

Response convention

MCP tool results include both:

• content: [{ type: "text", text: "<pretty-printed JSON>" }], and
• structuredContent: (the same data as a structured object), so clients can consume the result as native JSON without parsing text.

Errors (e.g. rate limiting, quota exhausted, invalid input) are returned as an isError: true result whose payload carries the error code — see the error code table.

Example: Claude / agent configuration

Point the client at the /mcp endpoint with a bearer header:

MCP endpoint:  https://email-verifier-v61-production-gateway.emaily.workers.dev/mcp
Authorization: Bearer ev_live_<your-api-key>
Type:          remote HTTP (Streamable HTTP)

The six tools are discovered automatically via the MCP tools/list handshake.