KingMinos

com.kingminosPublished by kingminos.comOfficial publisherv2026.10.23Updated Nov 6, 2026

B2B company and person enrichment for agents. Multiple data providers, pay only for results.

VerifiedStreamable HTTPWeb executableDeveloper ToolsData & AnalyticsBusiness & Commerce

Overview

AI-generated overview

KingMinos enriches B2B company and person records — domains, hierarchy, titles, emails, phones — through a hosted, credit-billed API.

What you can do
  • Resolve companies from email, domain or website, and get domain decisions, parent/subsidiary hierarchy, LinkedIn and X accounts, icons and descriptions
  • Look up people by email or LinkedIn URL: employment verification, English-language fit, phone numbers, title and seniority, LinkedIn profile, name and work email
  • Verify whether an email mailbox is deliverable
  • Inspect the workspace credit balance, ledger, history, forecast, billing health and usage aggregates
  • Manage Your Keys credentials for third-party data vendors, list masked entries, store or revoke them
  • Manage webhooks and events: create, patch, delete, rotate secrets, send test pings, list deliveries and replay them, list events
When to use it
Useful when an assistant needs to fill or check CRM-style company and contact fields, qualify outbound lists, or verify emails and phone numbers before sending. Also suited to teams that want to monitor enrichment credit spend and webhook deliveries from the same session.
Requirements
Remote streamable HTTP endpoint at mcp.kingminos.com/mcp with OAuth sign-in; a KingMinos tenant Bearer token is sent as an Authorization header. A KingMinos workspace with credits is needed, since capability calls spend credits. Optional local Node 22 run is possible. Some tools need specific scopes such as billing:read, erase or webhooks.
Before you install
Enrichment calls spend workspace credits unless dry_run is set, and runs are recorded even when nothing is written to a CRM. put_credentials asks for third-party vendor API keys that become visible in the conversation; the README recommends entering them in the web app instead. Credential, subject-deletion and webhook mutations change or remove data and should be confirmed first. Phone numbers and emails returned are personal contact data.

Installation

In SourceWeft

  1. Open KingMinos in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.kingminos%2Fmcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "kingminos": {
      "type": "http",
      "url": "https://mcp.kingminos.com/mcp"
    }
  }
}

README

KingMinos by OutboundSync — MCP

Streamable HTTP MCP server that wraps the live KingMinos enrichment API at https://api.kingminos.com. One tool per bearer-authenticated resource route. Session and cookie routes under /v1/auth/* and /v1/account/*, and operator routes under /v1/admin/*, are not OpenAPI resource tools. This is not the OutboundSync product MCP and does not expose OutboundSync account, source, or sync tools.

Default paths run on house keys. ZoomInfo, BuiltWith, Prospeo, Apollo, Company URL Finder, People Data Labs, HG Insights, Brandfetch, Enrich-CRM, Lemlist, and Snov.io are BYOK via put_credentials. Websearch is house-only and cannot be stored. Snov.io is OAuth (clientId/clientSecret) and is a credential vendor only. Cognism, Lusha, Starbridge, Clay, Databar, QuickEnrich, GetLeads, and BlitzAPI are API-key credential vendors only — no routing hop yet. The server never embeds vendor keys and never logs the tenant Bearer or credential bodies.

Say SFDC, never SF.

Production host

Admin tools (admin token only)

abuse_report, partner_report, partner_payout, feedback_report and partner_admin wrap /v1/admin/abuse/daily, /v1/admin/partners/analytics, /v1/admin/partners/payouts, /v1/admin/feedback and /v1/admin/partners (list, create partner + code, add/deactivate code). They are registered only when the MCP bearer is a KingMinos admin token (kmadm_…, hashed in the API). Any other bearer never sees them in tools/list; an admin bearer sees only these admin tools. The API re-checks the token on every call. They are not OpenAPI resource tools: the live spec also lists a few /v1/admin/* operations (privacy suppressions, signups), and check:surfaces skips every /v1/admin/* path through nonToolPathPrefixes plus the reviewed excludedOperationIds catalog, so they never show up as drift.

Production is Cloudflare Worker kingminos-mcp-prod on the existing OutboundSync Cloudflare account. Janus deploys it with Wrangler:

bash
npx wrangler deploy

Production MCP URL: https://mcp.kingminos.com/mcp. The custom domain mcp.kingminos.com is attached in Cloudflare and tracked in wrangler.jsonc (routes with custom_domain: true) so Janus deploys keep the hostname. workers_dev is false, so the Worker is not published on *.workers.dev (custom domain only).

This Worker must not bind D1 outboundsync-router, R2 outboundsync-router-raw, or Worker outboundsync-router. API base stays https://api.kingminos.com.

Fly is not the production host. fly.example.toml / Dockerfile are a local Node fallback sample only — not a production config.

PathPurpose
GET /healthLiveness
GET /Service card
GET /.well-known/mcp/server-card.jsonMCP server card (advertises https://mcp.kingminos.com/mcp, plus privacy_url / terms_url)
POST /mcpStreamable HTTP MCP
OPTIONS /mcpAdvertises Allow: POST, OPTIONS
GET / DELETE /mcp405 Method Not Allowed

Run it locally

Requires Node 22.

bash
npm installnpm run buildnpm start

The process listens on HOST (default 127.0.0.1) and PORT (default 8080) and serves the same paths as the Worker.

Dev (tsx, no build):

bash
npm run dev

Contract check against the vendored inventory (inventory/openapi-surfaces.json). Deterministic; no live network. Default PR CI uses this pin — it does not fetch production OpenAPI.

bash
npm run check:surfacesnpm run check:providers

check:surfaces compares advertised MCP tools to operations[]. check:providers compares the Zod ProviderName / CredentialProvider enums to the pinned providers[] / credentialProviders[]. A new BYOK id such as prospeo, companyurlfinder, peopledatalabs, hginsights, brandfetch, enrichcrm, or lemlist fails CI until both Zod enums and the pin list it — that is how routing.only: ["prospeo"] and put_credentials({ provider: "prospeo" }) stay accepted.

/v1/auth/* and /v1/account/* are intentionally not MCP tools (cookie/session app surfaces), and /v1/admin/* is the operator API (the admin-token tools above are hand-written, not generated from OpenAPI). All three prefixes are denied by nonToolPathPrefixes plus the reviewed excludedOperationIds catalog. Do not implement the ~24 auth/account operations as tools.

Live OpenAPI drift check (scheduled CI / workflow_dispatch, or local). Surfaces compare only bearer resource operations after the deny-list — account/auth on the live spec is not a failure. Provider live check is one-way: it fails only when production lists a provider Zod does not have. Production lagging the pin (missing prospeo) does not fail. Override the spec URL with KINGMINOS_OPENAPI_JSON_URL (default https://api.kingminos.com/openapi.json):

bash
npm run check:surfaces:livenpm run check:providers:live

Refresh the pin from live OpenAPI (network). Unions provider enums and newly seen auth/account operationIds; never drops pinned providers. Credential-only vendors (snovio, cognism, lusha, starbridge, clay, databar, quickenrich, getleads, blitzapi — no routing hop) are skipped from providers[]; the hand-written capabilityProviders pin is preserved. Review the diff before committing:

bash
npm run inventory:refresh

Application CI can point at its own inventory with KINGMINOS_OPENAPI_INVENTORY=/path/to/openapi-surfaces.json. This repo does not vendor KingMinos application source.

Smoke (starts an ephemeral listener and lists tools; uses the file inventory, not the live spec):

bash
npm testnpm run smoke

Worker bundle check (no Cloudflare auth required):

bash
npm run check:worker

Full local suite:

bash
npm run ci

That is exactly what the required OpenAPI tool contract check runs on PRs and main (branches must be up to date; protection applies to admins, so no direct pushes to main). npm install also installs git hooks (simple-git-hooks): pre-commit runs biome check --write on staged files, pre-push runs typecheck + tests. The nightly live drift job opens a Live OpenAPI drift issue instead of blocking PRs. CI map for all kingminos-* repos: kingminos-application/docs/ci.md.

Releases (CalVer)

After CI succeeds on a push to main, the CalVer Release workflow tags that commit (YYYY.MM.DD.N, UTC) and opens a GitHub release with generated notes. It does not push commits to main (Workers Builds deploys kingminos-mcp-prod on every main push).

The runtime version (/health, service card, MCP serverInfo) comes from export const VERSION in src/config.ts (kept in sync with package.json; see src/fetch.test.ts). Bump both in a normal PR when you want production to advertise a newer version than the last tag. Optional local helper: npm run release:apply stamps those files to the next CalVer tag without creating a release.

Preview the next tag and notes: npm run release:preview.

Tenant Bearer

The KingMinos tenant Bearer is sent by the client as Authorization: Bearer <token>. The server never mints, embeds, or logs that value.

Worker mode never reads KINGMINOS_API_KEY from process.env or from Worker bindings. A missing Authorization header is always 401 on the Worker.

A local Node process may fall back to KINGMINOS_API_KEY only when all of these are true:

  • the process is bound to loopback (127.0.0.1, localhost, or ::1)
  • KINGMINOS_MCP_ALLOW_ENV_BEARER=1

Production Workers do not store this secret. The value is never printed here.

POST /mcp rejects a present Origin that is not allowlisted. Clients that send no Origin keep working (typical MCP clients hitting https://mcp.kingminos.com/mcp). Local default hosts are localhost, 127.0.0.1, and [::1]; production also admits mcp.kingminos.com.

Optional:

  • KINGMINOS_API_URL — API base (default https://api.kingminos.com). Path prefixes on this URL are preserved.
  • HOST — local Node listen address (default 127.0.0.1)
  • PORT — local Node listen port (default 8080)
  • KINGMINOS_MCP_ALLOWED_HOSTS — comma-separated Host allowlist for /mcp (Node default = loopback; Worker empty = allow all)
  • KINGMINOS_MCP_ALLOWED_ORIGINS — extra Origin hostnames for /mcp
  • KINGMINOS_MCP_PUBLIC_URL — advertised MCP URL on the server card (Worker default https://mcp.kingminos.com/mcp). The card never uses the client Host header.
  • KINGMINOS_MCP_ALLOW_ENV_BEARER — set to 1 to opt in to the local loopback env-bearer fallback
  • KINGMINOS_OPENAPI_INVENTORY — path to the file inventory used by check:surfaces, check:providers, and PR CI
  • KINGMINOS_OPENAPI_JSON_URL — override URL for check:surfaces:live / check:providers:live / inventory:refresh

Copy .env.example for local names only. Do not commit a filled .env. Do not put secrets in Wrangler vars or files.

Cursor

Add to ~/.cursor/mcp.json (or project .cursor/mcp.json).

Local:

json
{  "mcpServers": {    "kingminos": {      "url": "http://127.0.0.1:8080/mcp",      "headers": {        "Authorization": "Bearer ${env:KINGMINOS_API_KEY}"      }    }  }}

Hosted (production):

json
{  "mcpServers": {    "kingminos": {      "url": "https://mcp.kingminos.com/mcp",      "headers": {        "Authorization": "Bearer ${env:KINGMINOS_API_KEY}"      }    }  }}

Cursor GUI sessions do not inherit shell .env files. Export KINGMINOS_API_KEY into the GUI environment so ${env:KINGMINOS_API_KEY} resolves.

Tools

Every tool is the snake_case operationId of one bearer-authenticated KingMinos resource route. /health, OpenAPI docs, and session/cookie /v1/auth/* + /v1/account/* routes are not tools.

ToolRouteNotes
get_providersGET /v1/providersRegistry + configured flags
get_capabilitiesGET /v1/capabilitiesCall before the first resolve
get_recipesGET /v1/recipesAgent chaining recipes; ask speed / balance / accuracy / coverage before a bulk run
get_balanceGET /v1/balanceWorkspace credit snapshot (available, in-flight, buckets, plan/PAYG, refills, per-key 24h spend). Needs billing:read. Read-only; does not grant credits
get_balance_ledgerGET /v1/balance/ledgerPaginated credit ledger (newest first, signed delta). Filters since / until / kind / key_id / user_id / before. Members see only their own run/refund rows
get_balance_historyGET /v1/balance/historyOwner/session only. UTC interval day (≤400d) or hour (≤7d) buckets from balance_after. Excludes in-flight holds
get_balance_forecastGET /v1/balance/forecastConservative vs refill-aware runout from trailing run: debit rates. Does not reserve credits
get_balance_healthGET /v1/balance/healthBilling health + optional capability affordance check (no reservation)
get_usageGET /v1/usageCharged vs no-charge run aggregates; optional group_by / capability / since / until. Charged = charged_credits > 0, not run status
company_resolvePOST /v1/company/resolveEmail / domain / website. Spends credits unless dry_run is true (API default false). Name-only is no_decision. result.operator (0 credits) names a product brand's operator (fizzy.do → 37signals) without changing company_name
company_domainPOST /v1/company/domainWrite-safe CRM domain decision
company_hierarchyPOST /v1/company/hierarchyImmediate / ultimate parent + capped subsidiaries
company_b2b_socialPOST /v1/company/b2b-socialLinkedIn company page URL (search-confirmed) or null; paths speed / balance / accuracy / coverage
company_x_accountPOST /v1/company/x-accountThe company's own X account: result.x_url (https://x.com/{handle}, never twitter.com) and result.x_handle, or null. domain / website / email / name (name-only runs name→domain on accuracy / coverage only; 400 missing_subject when all blank); x_url is an agree-check hint. routing.path speed (cap 1) | balance (default, cap 2) | accuracy (cap 3) | coverage (cap 4), + handle confirmation; your own ZoomInfo key adds fill. Outcome-priced 1 / 1.3 / 1.6 / 1.7 credits on a floor-passing hit, 0 on a withhold or miss, BYOK 0.1; write signal is confidence only (no safe_to_write), floors speed / coverage low, balance medium, accuracy high, min_confidence overrides; 10 s server budget
company_iconPOST /v1/company/iconRequired domain, optional name (no routing/path/preset; no website/email); on hit result.icon_url is always https://logos.kingminos.com/i/<sha256>.png (256×256 R2); optional result.icon_source_url; source under 64px → hosted hit with confidence low, flags.low_res, safe_to_write.icon_url true; rejects wrong-company/junk/empty only; fetch/store fail → icon_url null; your own Brandfetch / ZoomInfo key adds larger logos
company_descriptionPOST /v1/company/descriptionEnglish result.description or null (max_chars 80–500, default 300); always pass path (omit → balance at cap 6; path: balance → cap 2); paths speed (meta/og → data-provider text) | balance (judge-ranked extracts + optional rewrite) | accuracy (compose) | coverage (compose + off-homepage evidence, your own ZoomInfo key when stored); flags hype / first_person / tagline / same_as_speed / truncated / cta / grammar (may gain keys — tolerate unknowns; truncated/cta → low; grammar informational only); cache bypass via skip_cache or cache_bypass (not Idempotency-Key replay; company.resolve ignores bypass); answer.confidence, answer.identity; safe_to_write.description only on non-low + identity; winner-only billing
person_verify_employmentPOST /v1/person/verify-employmentFour-way send/block pre-flight
person_languagePOST /v1/person/languageCan we engage in English, and if not, which language? email or linkedin_url required (names are match-only); result.english yes | likely | unconfirmed | unknown, recommended_language / local_language at medium+ only; routing.path speed (cap 1) | balance (default, cap 3) | accuracy (cap 4), coverage is 400 invalid_routing; skip_cache / cache_bypass
person_phonePOST /v1/person/phoneOne dialable phone for a person by work email or LinkedIn URL. email or linkedin_url required (names are match-only); phone_types (mobile | landline | other | unknown, omit = any) and max_results (1–10, default 3); result.best_phone {number (E.164), type, source} or null, ranked result.phones (mobile first), result.flags conflicting_numbers blocks safe_to_write.best_phone; Agent-managed router, answers in < 10 s: every eligible vendor (including your own stored keys) runs in parallel under a ~8.5 s budget; late vendors are dropped (bill 0). Four modes via routing.path: speed (the cheapest vendors race; first number back wins; cap 10), balance (default: best single number by vendor prior / region / line type, no waiting for agreement), accuracy (agreement required, exactly one number; conflicting_numbers → not safe), coverage (up to 5 ranked numbers, each with source, line type, confidence, consensus). consensus and do_not_call on every number; routing.only / ignore filter the pool. Only vendors behind returned numbers bill (coverage: each returned number), capped at 38 credits; 0 on a miss; BYOK 0.1; 30-day cache, skip_cache / cache_bypass; API tenants only; numbers are contact PII
person_titlePOST /v1/person/titleA person's current title, seniority and function by work email or LinkedIn URL. email or linkedin_url required (names and company_domain are match-only); fields (title | seniority | function, omit = all) drives the ladder; routing.path speed | balance (default) | accuracy | coverage — outcome-priced 1 / 2 / 3 / 5 credits on a hit, 0 on a miss or partial (fields_incomplete); your own ZoomInfo key improves fill; safe_to_write.title / seniority / function false on conflicting_titles / unconfirmed_identity / employer_mismatch; 30-day cache, skip_cache / cache_bypass; API tenants only
person_b2b_socialPOST /v1/person/b2b-socialA person's LinkedIn profile URL from an email address. email required (the one discovery key); linkedin_url / first_name / last_name are match-only (person_mismatch, 0 credits); result.status found | not_found, canonical result.linkedin_url, result.candidates (winner first, with agrees), result.flags; routing.path speed | balance (default) | accuracy, no coverage tier — outcome-priced 2 / 3 / 5 credits on a hit, 0 on a miss, mismatch or below-floor withhold; write signal is confidence only (no safe_to_write): two agreeing sources high, one medium, a disagreement low (conflicting_profiles); path floors speed low, balance medium, accuracy high, min_confidence overrides; 30-day cache, skip_cache / cache_bypass; API tenants only
person_namePOST /v1/person/nameA person's proper-cased first / last / full name by email or LinkedIn URL. email or linkedin_url required (phone / x_handle accepted, never looked up → unsupported_input); role addresses are role_address at 0 credits; result.name_source vendor | email_local_parse (last-resort parsed_only, low), result.matched_on, result.flags; routing.path speed | balance (default) | accuracy | coverage — outcome-priced 1 / 2 / 3 / 5 credits on a hit, 0 on a miss, conflict (conflicting_names) or below-floor withhold; write signal is answer.confidence only (no safe_to_write), path floors speed / coverage low, balance medium, accuracy high, min_confidence overrides; 30-day cache, skip_cache / cache_bypass; API tenants only
person_emailPOST /v1/person/emailWhat is this person's work email? first_name + last_name + company_domain (name route) and/or linkedin_url (LinkedIn route), top level or under person; a name without a domain is 400 (no guessed patterns). Only verified addresses are delivered: result.status found | not_found | conflict | catch_all, result.email on found only, result.route, result.confidence (two independent sources high, one medium), result.flags; routing.path speed | balance (default) | accuracy | coverage (adds the LinkedIn route, and settles a two-address conflict by independent checks at low, flag conflict_settled_by_check); min_confidence overrides the path floor. Outcome-priced 2–5 credits: only a delivered answer is billed; misses, catch-alls and conflicts are not. 30-day hits-only cache, skip_cache; API tenants only
email_verifyPOST /v1/email/verifyIs this mailbox deliverable? email required. result.status valid | invalid | catch_all | unknown, result.source local | vendor, result.confidence, result.flags (describe the mailbox, never change the status). Free local syntax / DNS checks first; routing.path speed | balance (default) | accuracy (two agreeing checks) | coverage; min_confidence overrides the path floor. Outcome-priced 0.5–1.5 credits: only a delivered answer is billed; misses, catch-alls and conflicts are not. Not cached; API tenants only
get_runGET /v1/runs/{id}Recorded run envelope
list_credentialsGET /v1/credentialsMasked Your Keys catalog. Never returns raw keys
put_credentialsPUT /v1/credentials/{provider}Tenant Your Keys (ciphertext). Confirm first. The key will be visible in this conversation; prefer the web app at https://app.kingminos.com/app/keys/
delete_credentialsDELETE /v1/credentials/{provider}Revoke Your Keys. Confirm first
delete_subjectDELETE /v1/subjects/{subject_key}Raw unencoded key (e.g. email:[email protected]). Needs erase scope. Confirm first
list_webhooksGET /v1/webhooksWorkspace endpoints (kmwhk_…). 403 webhooks_not_enabled while the workspace gate is off. Every webhook tool needs a key with the explicit webhooks scope (403 webhook_scope_required otherwise). Never returns secrets
create_webhookPOST /v1/webhooksHTTPS only; private/loopback targets rejected; max 20 per workspace. Signing secret (kmwhsec_…) shown once. Owner only. Confirm first
get_webhookGET /v1/webhooks/{id}One endpoint: is_active, consecutive_failures, auto_disabled_at. No secret
patch_webhookPATCH /v1/webhooks/{id}url / description / enabled_events / is_active; is_active: true re-enables after auto-disable. Owner only. Confirm first
delete_webhookDELETE /v1/webhooks/{id}Soft delete. Owner only. Confirm first
rotate_webhook_secretPOST /v1/webhooks/{id}/rotate-secretPrevious secret stops working immediately (no grace); new secret returned once. Owner only. Confirm first
test_webhookPOST /v1/webhooks/{id}/testSigned test.ping (202 { event_id }); 409 webhook_endpoint_inactive while paused. Owner only. Confirm first
list_webhook_deliveriesGET /v1/webhooks/{id}/deliveriesstatus pending | succeeded | failed | dead, last_http_status, last_error; limit ≤ 100
replay_webhook_deliveryPOST /v1/webhooks/{id}/deliveries/{delivery_id}/replayNew delivery for the same event. Re-enable a paused endpoint first. Owner only. Confirm first
list_eventsGET /v1/eventsReconciliation log; type, delivered (false = no successful delivery yet), limit ≤ 200, next_cursor only on a full page

Capability POSTs spend credits and write runs even though they do not write SFDC. Confirm put_credentials, delete_credentials, delete_subject, and webhook mutations (create_webhook, patch_webhook, delete_webhook, rotate_webhook_secret, test_webhook, replay_webhook_delivery) with the user. CI fails if this list drifts from the OpenAPI inventory.

Sentry

src/worker.ts is wrapped with @sentry/cloudflare withSentry (project outboundsync/kingminos-mcp). Errors only (tracesSampleRate: 0); the SDK is off unless the SENTRY_DSN secret is set (wrangler secret put, piped). No request bodies, tool arguments, auth headers, cookies, query strings, emails, LinkedIn URLs or km*_ (incl. kmadm_, kmwhsec_) / osr_ tokens leave the Worker (src/sentry.ts). Release: --var SENTRY_RELEASE:$(git rev-parse HEAD) at deploy, else the Worker version id.

Source: README.md at commit 313b7e3

Tools

0
This server asks for a credential such as an API key, so SourceWeft could not read its tools without one and has not indexed them.

Version history

1
  1. v2026.10.23LatestOct 23, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.