SimpleVerifier MCP server
Give ChatGPT, Claude, Cursor or any MCP client the SimpleVerifier checks as tools: verify one email address or up to 100 per call, check a phone number's format, check a domain's MX, SPF, DMARC, disposable and catch-all status, and read your plan's usage. ChatGPT and claude.ai connect by signing in with your SimpleVerifier account; other clients can use an API key. Either way it needs the Pro, Business or Agency plan.
Endpoint and authentication
The server speaks Streamable HTTP at one URL and accepts two kinds of credential on every request:
- Sign in with OAuth, for ChatGPT, claude.ai and other clients that add servers by URL. You sign in with the same Google account as SimpleVerifier and approve a consent screen listing what the app can do. Nothing to copy or paste.
- An API key in the
Authorizationheader, for IDEs and scripts. Keys come with the Pro, Business and Agency plans and are created on the API keys page. Keep them out of shared config files and repositories.
https://simpleverifier.com/api/mcp
Authorization: Bearer sv_live_... (API key)The OAuth flow follows the MCP authorization spec: OAuth 2.1 with PKCE (S256 only), protected resource metadata at /.well-known/oauth-protected-resource, authorization server metadata at /.well-known/oauth-authorization-server, Client ID Metadata Documents and dynamic client registration, and access tokens bound to this server's URL. Permissions: verify and usage. Access tokens last one hour and renew with a rotating refresh token. You can disconnect any app under Connected apps on the API keys page.
Set it up
ChatGPT and claude.ai need no key. For the other clients, replace YOUR_API_KEY with your key, then restart or reload the client.
These steps follow OpenAI's connect a server to ChatGPT guide. OpenAI says account and workspace policies apply to custom MCP servers, so on a Business, Enterprise or Edu workspace an admin may need to allow it first. You also need a SimpleVerifier Pro, Business or Agency plan.
- Open ChatGPT Plugins at chatgpt.com/plugins.
- Select the plus button, then Add custom MCP server.
- Enter a name (for example SimpleVerifier) and a description.
- Under Connection, choose a public endpoint and enter
https://simpleverifier.com/api/mcp, including the/mcppath. - Choose OAuth for authentication, review the risk warning and select I understand and want to continue.
- Select Create as a plugin and review the tools ChatGPT discovers.
- Sign in with Google on the SimpleVerifier screen and choose Allow.
OpenAI renames these menus from time to time; if a label differs, follow OpenAI's guide. ChatGPT sends you back to SimpleVerifier's consent screen with the redirect address chatgpt.com/connector_platform_oauth_redirect, which it publishes in its client metadata.
Tools
| Tool | What it does |
|---|---|
| verify_email | One address: valid, risky or invalid, with a reason, plus action, risk, likely_invented and reason_code for agents. Syntax, domain, disposable and live mailbox (SMTP) checks. |
| verify_emails | Up to 100 addresses in one call, deduplicated. Waits up to 45 seconds and returns every result, or a job_id to finish with get_job_results. |
| get_job_results | Progress and per-address results of a verify_emails job, paged 500 rows at a time. |
| check_phone_format | Format, E.164 form, country and numbering-plan line type. A format check only: it never says whether a number is in service or on any messaging app. |
| check_domain | A domain's MX, SPF and DMARC records, disposable status, and an optional catch-all probe (one mailbox check). |
| get_usage | Your plan, what it includes, this month's phone lookups, today's shared mailbox-check capacity and the rate limit. |
The email statuses mean the same as in the REST API: valid means the mail server confirmed the mailbox, risky means it may work but delivery isn't confirmed, and invalid means don't send. For a list, the agent calls verify_emails, which usually returns every result in one go; if it says done: false, the agent calls get_job_results with the job_id later. Batches run as list jobs on your account, exactly like a CSV upload, so they show in your history too.
Limits
- 120 requests a minute per API key (REST and MCP share it), and 120 a minute per connected app when you sign in with OAuth. Every MCP request counts, including initialize and tools/list.
- verify_emails takes up to 100 addresses a call and waits up to 45 seconds for them. For bigger lists, upload a CSV on the Verify page.
- get_job_results returns up to 500 rows a call; follow next_offset for the rest.
- check_domain's catch-all probe is one mailbox check on a random address we generate. Pass check_catch_all: false to skip it.
- A single mailbox check can take up to 30 seconds when a mail server is slow.
- Mailbox checks share a daily capacity that resets at 00:00 UTC. When it runs out, verify_email answers risky with a retry time and is not charged, and verify_emails holds the remaining addresses until the reset (get_job_results shows them as waiting). get_usage says whether checks are available right now.
Errors
Authentication and rate-limit failures come back as HTTP errors with a JSON-RPC error body. Problems with a single tool call, such as a malformed domain or an unknown job id, come back as a tool result with isError: true and a plain-English message the agent can act on.
| 401 | No credentials, or the API key or access token is wrong, expired or revoked. The response carries a WWW-Authenticate: Bearer header with resource_metadata, which is how ChatGPT and claude.ai find the sign-in. |
| 403 | An OAuth connection that wasn't granted the permission the tool needs (verify for the checking tools, usage for get_usage). Reconnect the app and allow it. |
| 402 | The plan has no API access: the subscription has lapsed, or the account is on Starter, which covers CSV verification in the dashboard only. The message links to pricing. |
| 429 | More than 120 requests a minute on one key or connected app. Wait and retry. |
| 405 | GET or DELETE. The server is stateless, so it only takes POST. |
Common questions
- Do I need a paid plan to use the SimpleVerifier MCP server?
- Yes. API and MCP access come with Pro at $39/month, Business at $99/month and Agency at $249/month. Starter covers CSV verification in the dashboard and does not include API or MCP access. If you try to connect ChatGPT or claude.ai on that plan, the consent screen says so and links to pricing. Connect with OAuth or with an API key from the API keys page.
- Does the MCP server cost extra per call?
- Not on top of the API. MCP tool calls count against the same monthly API calls as REST requests (handshakes like initialize and tools/list don't). Pro includes 10,000 API calls a month, then $1.50 per 1,000; Business includes 100,000 and Agency 300,000, then $1.00 per 1,000 on monthly billing; on yearly billing the included calls are a monthly limit and further calls get HTTP 402 until the 1st (UTC). The per-key rate limit applies to MCP and REST requests together.
- Can check_phone_format tell me if a number is in service or on WhatsApp?
- No. It checks the number against its country's numbering plan and returns the E.164 form, country and the line type the range is allocated for. It does not contact any network, so it can't show whether a number is connected or registered on any app.
- Does a risky result mean the address is fine?
- No. Only valid means the mail server confirmed the mailbox. Risky means it could not be confirmed (a catch-all domain, a role address, a provider that hides mailbox status, or a server that would not answer), so it may bounce. Every result carries mailbox_confirmed and a plain-English meaning so an agent can't mistake one for the other.
- What should an agent branch on?
- The action field. Every result from verify_email, verify_emails and get_job_results carries action (send, send_with_care, retry_later or do_not_send), risk (low, medium or high), likely_invented (true when the address looks made up: a placeholder like test@ or john.doe@, a reserved domain like example.com, a domain with no mail server, or a sequential local part like 1234@; never for a confirmed mailbox) and reason_code (a stable code such as mailbox_not_found, catch_all, role, disposable or no_mx). None of them is ever null, and only status valid gives action send. The full list of codes is in the API docs under Decision fields.
- Can an agent split leads by mail provider?
- Yes. Every result carries provider (the mailbox provider read from the domain's MX record, such as Google Workspace, Gmail, Microsoft 365, Outlook.com/Hotmail, Yahoo or Other/self-hosted) and gateway (a security filter in front of the mailbox, such as Mimecast, Proofpoint or Barracuda, or none). Both are null when the domain could not be looked up. Send Google, Microsoft and gateway-protected leads from separate campaigns: Microsoft 365 often hides whether a mailbox exists, and gateways can quarantine cold email without a bounce, so both do better at a lower daily volume.
- Which MCP transport does SimpleVerifier use?
- Streamable HTTP at a single endpoint, without sessions. Clients that sign in with OAuth (ChatGPT, claude.ai, MCP Inspector) discover the sign-in from the server itself; clients that take a custom Authorization header can use an API key instead.
- How do I disconnect ChatGPT or Claude from my account?
- Open the API keys page and use Disconnect under Connected apps. The app's access and refresh tokens stop working immediately. API keys are revoked on the same page and keep working exactly as before until you do.
- What can a connected app see?
- Only what you allow on the consent screen: the verify permission runs email, phone-format and domain checks on your plan, and the usage permission reads your plan and usage. It can't see your uploaded lists, billing details or API keys. Access tokens last one hour and are renewed with a refresh token; both are stored only as hashes on our side.