ValidReach MCP server
The Model Context Protocol (MCP) lets an AI client call tools. ValidReach exposes a remote MCP endpoint over HTTP at https://validreach.dev/api/mcp. It uses your normal API key, the same credits and the same rate limits as the REST API.
Tools
| Tool | What it does | Cost |
|---|---|---|
| verify_email | Checks one address and returns its status. | 1 credit for a definite result; unknown is not billed |
| check_disposable | Checks whether the domain is a known disposable-mail domain. | Free |
| get_credits | Returns the credit balance for the key’s account. | Free |
Authentication
Send your API key in an Authorization: Bearer header (X-API-Key also works). Listing tools needs no key; calling a tool does. Create a key in the dashboard and keep it out of prompts and shared files.
OAuth for MCP clients
Clients that support OAuth 2.1 can skip the API key. The authorization server metadata is published at /api/auth/.well-known/oauth-authorization-server, and clients can register themselves at /api/auth/mcp/register (public clients with PKCE only).
The flow is standard: the client opens /api/auth/mcp/authorize with response_type=code, code_challenge and prompt=consent; you review the request on the consent screen and approve or deny it; the client exchanges the code at /api/auth/mcp/token. Consent and access tokens belong to your account, not to a key, so they spend the same credits.
Review or withdraw access at any time in Settings → Connected apps. Revoking deletes the stored token immediately, and the client has to ask again.
Try it with curl
curl -s https://validreach.dev/api/mcp \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
curl -s https://validreach.dev/api/mcp \
-H "Authorization: Bearer $VALIDREACH_API_KEY" \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"verify_email","arguments":{"email":"user@example.com"}}}'Add it to a client
Clients that support remote MCP servers over HTTP take a URL and optional headers. Use https://validreach.dev/api/mcp as the URL and add the Authorization header. How you enter this differs between clients and changes over time, so follow your client’s documentation for the exact steps.
Limits
The server is stateless and answers with plain JSON. It does not stream, and it does not send server-initiated messages. It checks one address per call; for lists use the file endpoint. Each definite result spends a credit, so limit how many calls an agent may make in a run.