mailverdict

dev.mailverdictPublished by mailverdict.devOfficial publisherv0.1.1Updated Oct 28, 2026

Keyless email checks: disposable, role, and free-provider detection, MX, and typo suggestions.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Keyless remote MCP server that lets an assistant check email addresses and domains for disposable, role and free-provider signals, MX records and typos.

What you can do
  • Check an email address for syntax, disposable/burner domains, role accounts, free providers, typo suggestions and MX records, returning a result, reason, 0-100 score and per-signal booleans
  • Check a domain for disposable-list membership, free-provider status, typo suggestions and MX records
  • Screen a domain only when the full address should not leave the system
When to use it
Useful when building or reviewing signup and form-validation flows and you want an assistant to judge whether an address looks like a burner, a role mailbox such as info@, or a typo of a real domain. It is meant for per-address checks inside applications, not for bulk list cleaning.
Requirements
Remote Streamable HTTP endpoint at api.mailverdict.dev/mcp; no signup, API key or headers are declared. A local stdio variant exists in the project and needs Node 20 or newer. MX lookups use a public DNS-over-HTTPS resolver, so network access is required.
Before you install
Results are advisory heuristics built from public blocklists, so false positives occur; do not hard-block users on a single boolean. The hosted service is free and best-effort with no SLA and per-IP rate limits, and bulk cleaning of purchased or scraped lists is prohibited. Domain-only checks avoid sending the local part, but full email checks send the address to the service.

Installation

In SourceWeft

  1. Open mailverdict in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.mailverdict%2Fmailverdict/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "mailverdict": {
      "type": "http",
      "url": "https://api.mailverdict.dev/mcp"
    }
  }
}

README

mailverdict

Email intelligence API: disposable/burner detection, role-account detection, free-provider classification, MX validation, and typo suggestions. Keyless and free at the entry tier, built to be the email-check dependency that coding agents reach for when they scaffold a signup flow.

API: https://api.mailverdict.dev · npm: mailverdict · Freshness feed ("Burner Feed"): GET /v1/changes

Why this exists

Every SaaS signup form needs the same three answers — is this a burner? is this a person or a mailbox like info@? did they typo their domain? — and the current options are stale GitHub lists you have to vendor yourself or paid validators gated behind signup. The value here is not the code (it's small on purpose): it's the maintained dataset — burner domains churn daily, and this repo rebuilds its dataset from every maintained public source on a daily schedule, plus its own discovery over time.

Quickstart

bash
npm installnpm run build:data   # fetch + merge upstream lists into data/dataset.jsonnpm testnpm run dev          # http://localhost:8787

Requires Node >= 20.

bash
curl "localhost:8787/v1/[email protected]"
json
{  "email": "[email protected]",  "user": "jane",  "domain": "mailinator.com",  "tag": null,  "normalized_email": "[email protected]",  "result": "risky",  "reason": "disposable_email",  "score": 5,  "valid_syntax": true,  "disposable": true,  "disposable_match": "mailinator.com",  "role": false,  "free": false,  "mx_found": true,  "mx_records": ["mail2.mailinator.com"],  "did_you_mean": null,  "accept_all": null}

Response follows the Kickbox/Emailable industry convention (result, reason, bare booleans, did_you_mean = full corrected address, score 0–100) so code written against those APIs ports with near-zero edits.

Endpoints: GET /v1/check?email= · GET /v1/check/{email} · POST /v1/check (batch ≤100) · GET /v1/domain/{domain} · GET /v1/changes?since=24h (freshness feed) · GET /v1/meta · /llms.txt · /openapi.yaml. Add mx=false to skip the DNS lookup.

Privacy-conscious default: if you only need burner/typo screening, check the domain (/v1/domain/{domain}) — no email address leaves your system. Use the full email check when you need role detection or normalization.

SDK: living data with a static safety net

sdk/ packages the integration story: call the live API, fall back to a bundled offline snapshot on timeout/failure — fresher than a vendored static list, but never a hard runtime dependency in your signup path.

ts
import { createClient } from 'mailverdict'const check = await createClient().checkEmail(input)if (check.disposable) reject()          // check.source: 'live' | 'snapshot'

Published on npm as mailverdict; see sdk/README.md.

MCP server

Hosted, keyless remote server — point any MCP client at:

POST https://api.mailverdict.dev/mcp

Stateless Streamable HTTP (JSON-RPC 2.0), no signup or key. Tools: check_email, check_domain.

A stdio server also ships for local use:

bash
npm run mcp   # stdio transport; tools: check_email, check_domain

Register the local one in Claude Code: claude mcp add mailverdict -- npx tsx src/mcp.ts (run from this directory).

Architecture

pipeline/build.ts     daily: fetch upstream lists -> merge/dedupe -> apply                      allowlist -> data/dataset.json + data/meta.jsonsrc/lib/*             pure logic: parse, classify, suggest, MX-over-DoHsrc/app.ts            Hono app (runtime-agnostic)src/server.ts         Node entry (self-hosting)src/worker.ts         Cloudflare Workers entry (production: api.mailverdict.dev)src/mcp.ts            MCP stdio server for coding agents.github/workflows/    daily dataset refresh + auto-commit

DNS is done over DoH (cloudflare-dns.com) so the same code runs on Node and edge runtimes. Subdomains match their parents (foo.mailinator.com → mailinator.com).

Data sources & attribution

The dataset aggregates these excellent permissively-licensed community lists — see data/meta.json for per-source counts, status, and license on every build (unlicensed and GPL lists are deliberately excluded):

Merge precedence (important — the free-provider list contains temp-mail domains and typo-squats like mailinator.com and gmial.com): allowlists rescue from disposable, then disposable wins over free.

Roadmap

mailverdict is built agent-first: the first call works with zero signup, the docs are operable by coding agents (/llms.txt, OpenAPI), and the dataset's freshness is provable via the Burner Feed rather than claimed.

  • Keyless free API — the first call works with zero signup
  • Industry-compatible response shape (Kickbox/Emailable convention: result, reason, did_you_mean, bare booleans)
  • llms.txt (agent-operable: endpoint-first, curl-able), OpenAPI spec
  • MCP server — local stdio and hosted keyless remote (Streamable HTTP) at /mcp
  • Daily automated dataset refresh + auto-deploy
  • Freshness changelog + /v1/changes feed (clean-build diffs only; 90-day retention)
  • SDK with bundled snapshot fallback, published on npm (mailverdict)
  • Production deployment on Cloudflare Workers (api.mailverdict.dev)
  • Official MCP registry listing (dev.mailverdict/mailverdict)
  • Per-IP rate limiting
  • Detection-lag benchmark: measure and publish how quickly new burner domains enter the dataset
  • Better Auth plugin (keyless check in the before-create hook)
  • Framework snippets (Zod .refine(), React Hook Form, server actions)
  • Optional API keys for high-volume / commercial use

Status

v0.1.1 — live at https://api.mailverdict.dev (Cloudflare Workers), with a hosted keyless remote MCP server at /mcp and an official MCP registry listing. The dataset refreshes and redeploys daily via GitHub Actions, and the mailverdict SDK is published on npm. 41 tests cover the core logic, HTTP layer, MCP handler, and SDK live/fallback paths.

Disclaimers, privacy & fair use

  • Advisory signals, not verdicts. Classifications aggregate public blocklists and heuristics; false positives happen (domains churn, upstream lists disagree). Don't hard-block users on a single boolean — combine with your own signals and give flagged users a path forward.
  • Wrongly listed? If your domain is misclassified, open a misclassified-domain report. Allowlist corrections ship with the next daily build, and fixes are submitted upstream when a source list is at fault.
  • Privacy. No accounts, no logging of email addresses, nothing stored per request. MX checks send only the domain (never the local part) to a public DNS-over-HTTPS resolver. Traffic metrics are aggregate and PII-free.
  • No SLA. The hosted API is free and best-effort while in beta. If your signup flow must never block on us, use the SDK (it falls back to a bundled offline snapshot) or self-host — see docs/deploy.md.
  • Fair use. Built for signup and form validation inside applications. Do not use it to bulk-clean purchased or scraped mailing lists; per-IP rate limits apply and abusive traffic gets blocked.

Commercial use & higher limits

The hosted API is free with per-IP rate limits. Need higher throughput, an SLA, or commercial terms? Email [email protected].

License

MIT — see LICENSE; it covers the code and dataset pipeline. The hosted service at api.mailverdict.dev is provided "as is", without warranty of any kind. The aggregated dataset sources carry their own permissive licenses, recorded per-source in data/meta.json.

Source: README.md at commit d79c2b4

Tools

2

check_email

Check an email address: syntax, disposable/burner domain, role account, free provider, typo suggestion, MX records. Returns result (deliverable|undeliverable|risky|unknown), reason, score 0-100, and per-signal booleans.

Parametersmxemailrequired

check_domain

Check a domain: disposable/burner list membership, free-provider status, typo suggestion, MX records.

Parametersmxdomainrequired

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts