Mcp Outbound Infrastructure Fingerprint

com.mambabuiltPublished by mambabuilt.comv1.3.1Updated Nov 7, 2026

Detect whether a company runs cold outbound, on what stack, and from which sending domains.

VerifiedSTDIODesktop onlyWeb Search & ScrapingBusiness & Commerce

Overview

AI-generated overview

Local MCP server that fingerprints a company's cold email outbound setup from its domain, via an Apify actor.

What you can do
  • Fingerprint one company domain, or a batch of domains, for cold outbound activity
  • Return a runs_outbound verdict (program, light, none, unknown) with confidence and quotable evidence
  • Report sending domains, registration clusters, sending platforms, inbox provider, warmup and infrastructure vendors
  • Check SPF, DKIM and DMARC posture, with an optional separately billed deliverability and blacklist check
  • Tune the scan with sending-domain depth, probe caps, timeouts, cache bypass and a per-call spending cap
When to use it
Useful for sales, GTM or research work that needs to know whether a prospect or competitor actually runs cold email outbound and which sending stack and domains they use, without manual DNS digging.
Requirements
Runs locally over stdio via npx, so Node.js is needed. Requires an Apify account and an APIFY_TOKEN environment variable; the underlying actor is billed to that Apify account. Network access is required for the actor calls.
Before you install
Every run consumes Apify credits: a start fee plus a per-domain charge, and domains with no signals or that do not resolve are still charged. The optional deliverability check is billed separately; use max_charge_usd to cap spending. The APIFY_TOKEN is a secret and should not be shared. Results are heuristic: common-word brand names cap confidence, and sending-platform recall is partial.

Installation

In SourceWeft

  1. Open Mcp Outbound Infrastructure Fingerprint in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Outbound Infrastructure Fingerprint MCP Server

[npm] [MCP] [License: MIT]

[Outbound Infrastructure Fingerprint MCP server]

MCP server for the Mamba Labs Outbound Stack Detector actor on Apify.

Give it a company domain. It tells your agent whether that company runs cold email outbound, and on what stack.

Tool

fingerprint_outbound_infrastructure

InputTypeNotes
domainstringOne company domain.
domainsstring[]Batch. Takes precedence over domain.
scan_sending_domainsbooleanDefault true. The strongest signal and the slowest step.
sending_domain_depthdeep | standardDefault deep (.com .co .io .net .org).
check_deliverabilitybooleanDefault false. Adds a separately billed blacklist check and health score.
skipCachebooleanIgnore the 7 day result cache.
max_sending_domain_probesinteger10 to 300, default 80. Cap on candidate sending domains probed per company.
request_timeout_msinteger3000 to 20000, default 9000. Per HTTP request timeout.
dns_timeout_msinteger1000 to 15000, default 4000. Per DNS lookup timeout.
max_charge_usdnumberOptional spending cap for this call, in USD. The actor stops before any charge that would take the run past this amount and keeps every row already charged.

Returns a flat row per domain: runs_outbound (program, light, none, unknown), confidence, sending_domains[], registration_clusters[], sending_platforms[], inbox_provider, warmup_detected, infrastructure_vendors[], spf_status, dkim_status, dmarc_policy, and an evidence[] array of quotable strings.

What it actually detects

A real outbound program does not send from the domain the business runs on. It buys lookalikes (getcompany.com, company-mail.com, trycompany.co), gives them their own mail tenant, and redirects their web root at the real site. That redirect is the attribution handle, and finding those domains is the part nobody else does.

Measured on nine live domains: 6 of 6 detected on companies that demonstrably run outbound, 0 false positives of 3 on controls.

Two honest limits. When the brand token is an ordinary English word (Gong, Clay, Ramp), lookalike patterns collide with unrelated businesses that legitimately own them; the actor sets brand_is_common_word and caps confidence rather than reporting a confident none. And sending-platform recall is partial by design: Instantly, Smartlead, Lemlist, Apollo and Salesloft connect over OAuth to a customer's own mailbox and publish no SPF include host at all, so an empty sending_platforms tells you little while a populated one is solid.

Pricing

You pay per event on Apify, billed to your own Apify account. Prices from the live pricing record, read 2026-10-16:

EventPrice per event (USD)Fires when
actor-start$0.00005Charged once when the run starts.
domain-analyzed$0.004 on the Free plan, down to $0.0034 on higher Apify plansCharged once per domain analyzed. Domains that return no outbound signals, or that do not resolve, still count as analyzed and are charged.

The actor's Apify page carries the current prices. Running this server consumes Apify credits.

Setup

json
{  "mcpServers": {    "mamba-outbound-infrastructure-fingerprint": {      "command": "npx",      "args": ["-y", "@mambalabsdev/mcp-outbound-infrastructure-fingerprint"],      "env": { "APIFY_TOKEN": "your-apify-token" }    }  }}

Get a token at console.apify.com/account/integrations. Read-only; consumes Apify credits per domain analyzed.

Also available

This tool is also exposed by the GTM Suite umbrella server, alongside the rest of the Mamba Labs GTM actors, if you would rather run one server than many.

Built by Mamba Labs.

Source: README.md at commit 55e1163

Tools

1

fingerprint_outbound_infrastructure

Fingerprint Outbound Infrastructure

Given a company domain, determine whether that company runs cold email outbound and on what stack. Returns a runs_outbound verdict of program (a deliberate cold outbound setup), light (one weak signal), none, or unknown, plus the evidence behind it. The strongest signal is the lookalike sending domains a real outbound program leaves behind: domains like getcompany.com or company-mail.com that carry their own mail and redirect back to the primary site. Also returns the inbox provider (Google Workspace, Microsoft 365 and others) for the primary domain and each sending domain, any detected sending platform (Outreach, Salesloft, Lemlist, Instantly, Smartlead, Apollo and more), registration clusters showing sending domains bought on the same day, cold email infrastructure vendors, and deliverability posture (SPF, DKIM, DMARC). Note that sending platform recall is partial by design: sequencers that connect over OAuth to a customer's own mailbox leave no DNS trace, so an empty sending_platforms means little while a populated one is solid. Public DNS and HTTP redirects only, no login, no mailbox access. Returns flat Clay-ready JSON. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per domain analyzed.

ParametersdomaindomainsskipCachedns_timeout_msmax_charge_usdrequest_timeout_mscheck_deliverabilityscan_sending_domainssending_domain_depthmax_sending_domain_probes

Version history

5
  1. v1.3.1LatestNov 5, 2026
  2. v1.3.0Oct 16, 2026
  3. v1.2.1Oct 6, 2026
  4. v1.2.0Oct 6, 2026
  5. v1.1.1Sep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts