apimail-mcp 1.0.0 → 1.2.0

package/README.md

@@ -46,6 +46,9 @@ Bump `version` in `package.json` for each release (`npm version patch`).
 - `apimail_domain_availability`
 - `apimail_purchase_accounts`
 - `apimail_purchased_emails`
+- `apimail_email_risk` — check an email address risk/reputation (0–100 score); $0.005 per check
+- `apimail_user_auth_submit` — submit your own Microsoft account (email + password; optional cookies, client proxy, backup_email) for OAuth authorization; returns `task_id`; token costs $0.0015 minus loyalty discount, charged at delivery
+- `apimail_user_auth_status` — poll a user-auth job by `task_id` until terminal (`success` → refresh_token + client_id; `email_linked` → backup email bound, no token, free, retry later; `failed`/`timeout` → reason in `error`/`error_message`)
 
 ## Security
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apimail-mcp",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "MCP server for ApiMail API (stdio, Model Context Protocol)",
   "type": "module",
   "main": "server.js",

package/server.js

@@ -57,6 +57,50 @@ const TOOL_DEFS = [
       required: ["payment_id"],
       additionalProperties: false
     }
+  },
+  {
+    name: "apimail_email_risk",
+    description: "Check the risk and reputation of an email address. Returns a transparent 0-100 risk score and signals: disposable/temporary mail, free provider, suspicious TLD, role account, MX/domain resolution, SPF/DMARC (spoofability), domain age and Gravatar. Costs $0.005 per check from the account balance.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        email: { type: "string", description: "Email address to check." },
+        token: { type: "string", description: "Optional API token override." },
+        smtp: { type: "boolean", description: "Also run an SMTP deliverability probe (optional, slower)." }
+      },
+      required: ["email"],
+      additionalProperties: false
+    }
+  },
+  {
+    name: "apimail_user_auth_submit",
+    description: "Submit YOUR OWN Microsoft account (email + password, optional MSA cookies, client proxy and desired backup email) for OAuth authorization. Returns a task_id; poll apimail_user_auth_status until a terminal status (job lives up to 3 minutes). On success returns a Graph-verified refresh_token + client_id ($0.0015 minus loyalty discount, charged at delivery). Backup-email binding is free. Limits: 50 concurrent jobs per key, 200 global.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        email: { type: "string", description: "Microsoft account email (Outlook/Hotmail)." },
+        password: { type: "string", description: "Microsoft account password." },
+        cookies: { type: "string", description: "Optional MSA session cookies string 'name=value, name2=value2' — cookie-first login with password fallback." },
+        proxy: { type: "string", description: "Optional client proxy 'scheme://[user:pass@]host:port' (http/https/socks4/socks5/socks5h). Used instead of the service pool; its failures are reported as CLIENT_PROXY_ERROR." },
+        backup_email: { type: "string", description: "Optional backup (recovery) email to bind if Microsoft demands one; verification codes are readable only for temp-mail.io-style inboxes." },
+        token: { type: "string", description: "Optional API token override." }
+      },
+      required: ["email", "password"],
+      additionalProperties: false
+    }
+  },
+  {
+    name: "apimail_user_auth_status",
+    description: "Poll a user-auth job by task_id. task_status: pending/processing (keep polling; bound backup email appears early), success (token + client_id, charged once at first delivery), email_linked (terminal, NOT a failure: backup email bound but no token — free; save the account and re-submit later to retry), failed/timeout (reason in error + error_message). Poll every few seconds, up to ~3 minutes.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        task_id: { type: "string", description: "32-hex task id returned by apimail_user_auth_submit." },
+        token: { type: "string", description: "Optional API token override." }
+      },
+      required: ["task_id"],
+      additionalProperties: false
+    }
   }
 ];
 
@@ -85,16 +129,30 @@ function toQuery(params) {
   return query.toString();
 }
 
-async function callApi(endpoint, params) {
-  const query = toQuery(params);
-  const url = `${API_BASE_URL}/${endpoint}${query ? `?${query}` : ""}`;
+async function callApi(endpoint, params, options = {}) {
+  const method = options.method || "GET";
+  let url;
+  const fetchOptions = {
+    method,
+    headers: { Accept: "application/json" }
+  };
+  if (method === "POST") {
+    // Тело — JSON; токен остаётся в query (API принимает и Bearer, и query).
+    url = `${API_BASE_URL}/${endpoint}`;
+    fetchOptions.headers["Content-Type"] = "application/json";
+    fetchOptions.body = JSON.stringify(options.body || {});
+    const query = toQuery(params);
+    if (query) url += `?${query}`;
+  } else {
+    const query = toQuery(params);
+    url = `${API_BASE_URL}/${endpoint}${query ? `?${query}` : ""}`;
+  }
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
 
   try {
     const response = await fetch(url, {
-      method: "GET",
-      headers: { Accept: "application/json" },
+      ...fetchOptions,
       signal: controller.signal
     });
     const text = await response.text();
@@ -161,11 +219,59 @@ async function handleTool(name, args) {
     return asText(JSON.stringify(result, null, 2));
   }
 
+  if (name === "apimail_email_risk") {
+    const token = getTokenFromArgs(args || {});
+    const email = args && typeof args.email === "string" ? args.email.trim() : "";
+    if (!email) {
+      throw new Error("email is required.");
+    }
+    const params = { token, email };
+    if (args && args.smtp === true) {
+      params.smtp = 1;
+    }
+    const result = await callApi("emailRisk", params);
+    return asText(JSON.stringify(result, null, 2));
+  }
+
+  if (name === "apimail_user_auth_submit") {
+    const token = getTokenFromArgs(args || {});
+    const email = args && typeof args.email === "string" ? args.email.trim() : "";
+    const password = args && typeof args.password === "string" ? args.password : "";
+    if (!email) {
+      throw new Error("email is required.");
+    }
+    if (!password) {
+      throw new Error("password is required.");
+    }
+    const body = { email, password };
+    if (args && typeof args.cookies === "string" && args.cookies.trim()) {
+      body.cookies = args.cookies.trim();
+    }
+    if (args && typeof args.proxy === "string" && args.proxy.trim()) {
+      body.proxy = args.proxy.trim();
+    }
+    if (args && typeof args.backup_email === "string" && args.backup_email.trim()) {
+      body.backup_email = args.backup_email.trim();
+    }
+    const result = await callApi("userAuthSubmit", { token }, { method: "POST", body });
+    return asText(JSON.stringify(result, null, 2));
+  }
+
+  if (name === "apimail_user_auth_status") {
+    const token = getTokenFromArgs(args || {});
+    const taskId = args && typeof args.task_id === "string" ? args.task_id.trim() : "";
+    if (!/^[0-9a-f]{32}$/.test(taskId)) {
+      throw new Error("task_id must be a 32-character hex string.");
+    }
+    const result = await callApi("userAuthStatus", { token, task_id: taskId });
+    return asText(JSON.stringify(result, null, 2));
+  }
+
   throw new Error(`Unknown tool: ${name}`);
 }
 
 const server = new Server(
-  { name: "apimail-mcp", version: "1.1.0" },
+  { name: "apimail-mcp", version: "1.2.0" },
   { capabilities: { tools: { listChanged: false } } }
 );