email-validator-mcp 1.0.2 → 1.0.3

package/README.md

@@ -7,8 +7,15 @@ This file is self contained. It reads public data only and never writes to the m
 ## Tools
 
 
-* `validate_email`  Validate a single email address.
-* `validate_batch`  Validate multiple addresses.
+* `validate_email`  Check one email address: format, live MX records, disposable-domain status, role account (info@, support@) and whether it is a free provider.
+* `validate_batch`  Validate up to 25 addresses at once and get a count of well-formed, malformed and risky ones.
+* `check_domain`  Domain-level mail check: MX records, A records, and whether the domain is a disposable or free provider.
+* `normalize_email`  Canonical form of an address: lowercase the domain, drop the +tag, and remove Gmail dots, so duplicates collapse to one record.
+* `extract_emails`  Pull every unique email address out of a block of text, flagging any disposable domains.
+* `disposable_domains`  List the known disposable email domains this server checks against.
+* `email_auth_records`  The full anti-spoofing picture for a domain: MX hosts, SPF with its all-rule, DMARC policy and DKIM selectors.
+* `mx_health`  Every MX host for a domain, whether it resolves to an A record, and its reverse DNS.
+* `correct_typo`  Suggests the mail provider a mistyped domain probably meant, e.g. gmial.com -> gmail.com, without contacting the domain.
 
 ## Usage
 
@@ -19,3 +26,22 @@ node dist/index.js
 ```
 
 MX records are resolved through the DNS of the sending machine. A missing MX record does not guarantee an inbox does not exist, the result is honest about that.
+
+<!-- paywall -->
+## Premium tools
+
+These tools need a license key:
+
+* `smtp_mailbox_check`
+* `spf_evaluate`
+
+Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-email-validator-mcp and set it in your MCP client config:
+
+```json
+"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
+```
+
+The key is checked against MCP Marketplace, cached for 24 hours, and keeps
+working offline once one check has succeeded. Every other tool on this server
+stays free.
+<!-- /paywall -->

package/dist/api.js

@@ -1,38 +1,80 @@
 import { promises as dns } from "node:dns";
 export class EmailError extends Error {
 }
-const DISPOSABLE = new Set([
+/**
+ * Throwaway-mail domains seen in signup fraud. Kept small on purpose so a
+ * false positive is rare; the list is easy to extend.
+ */
+export const DISPOSABLE = new Set([
     "mailinator.com", "10minutemail.com", "guerrillamail.com", "sharklasers.com",
     "yopmail.com", "tempmail.com", "throwawaymail.com", "maildrop.cc", "temp-mail.org",
     "getnada.com", "dispostable.com", "mohmal.com", "emailondeck.com", "burnermail.io",
     "trashmail.com", "spam4.me", "fakeinbox.com", "mailnesia.com", "mintemail.com",
+    "mailcatch.com", "mailnull.com", "spamgourmet.com", "tempr.email", "discard.email",
+    "33mail.com", "mytemp.email", "tempinbox.com", "email-temp.com",
 ]);
+/** Shared/role mailboxes — deliverable, but usually not a real person. */
+export const ROLE_LOCALPARTS = new Set([
+    "info", "support", "sales", "admin", "administrator", "help", "contact", "billing",
+    "accounts", "accounting", "hr", "jobs", "careers", "marketing", "press", "media",
+    "noreply", "no-reply", "donotreply", "postmaster", "webmaster", "abuse", "security",
+    "hello", "team", "office", "enquiries", "inquiries", "service", "customerservice",
+]);
+const FREE_PROVIDERS = new Set([
+    "gmail.com", "googlemail.com", "yahoo.com", "yahoo.co.uk", "outlook.com", "hotmail.com",
+    "live.com", "msn.com", "aol.com", "icloud.com", "me.com", "mac.com", "proton.me",
+    "protonmail.com", "gmx.com", "gmx.de", "yandex.com", "zoho.com", "mail.com", "qq.com",
+    "163.com", "126.com", "web.de", "fastmail.com", "tutanota.com", "hey.com",
+]);
+const LOCAL_RE = /^[A-Za-z0-9!#$%&'*+/=?^_`{|}~.-]+$/;
+const DOMAIN_RE = /^(?=.{1,253}$)([A-Za-z0-9](-*[A-Za-z0-9])*\.)+[A-Za-z]{2,}$/;
 async function checkOne(email) {
-    const parts = email.split("@");
-    const result = {
-        email,
-        format: parts.length !== 2 || !parts[0] || !/^[^\s@]+$/.test(parts[0]) ? "invalid" : "valid",
+    const trimmed = email.trim();
+    const at = trimmed.lastIndexOf("@");
+    const localpart = at > 0 ? trimmed.slice(0, at) : "";
+    const domain = (at > 0 ? trimmed.slice(at + 1) : "").toLowerCase();
+    const base = {
+        email: trimmed,
+        format: at > 0 && localpart && LOCAL_RE.test(localpart) && !localpart.startsWith(".") &&
+            !localpart.endsWith(".") && !localpart.includes("..") && DOMAIN_RE.test(domain)
+            ? "valid"
+            : "invalid",
+        domain,
+        localpart,
         mx_hosts: [],
-        disposable: DISPOSABLE.has((parts[1] ?? "").toLowerCase()),
+        disposable: DISPOSABLE.has(domain),
+        free_provider: FREE_PROVIDERS.has(domain),
+        role_account: ROLE_LOCALPARTS.has(localpart.toLowerCase()),
+        plus_tag: localpart.includes("+") ? localpart.slice(localpart.indexOf("+") + 1) : null,
         deliverable: "unknown",
     };
-    if (result.format === "invalid") {
-        result.deliverable = "not checked";
-        return result;
+    if (base.format === "invalid") {
+        base.deliverable = "not checked";
+        return base;
     }
     try {
-        const hosts = await dns.resolveMx(parts[1]);
-        result.mx_hosts = hosts.sort((a, b) => a.priority - b.priority).map((h) => h.exchange);
-        result.deliverable = result.mx_hosts.length > 0 ? "likely" : "no MX record";
+        const hosts = await dns.resolveMx(domain);
+        base.mx_hosts = hosts.sort((a, b) => a.priority - b.priority).map((h) => h.exchange);
+        base.deliverable = base.mx_hosts.length > 0 ? "likely" : "no MX record";
     }
     catch {
-        result.deliverable = "no MX record or domain not found";
+        base.deliverable = "no MX record or domain not found";
     }
-    return result;
+    return base;
 }
 function fmt(r) {
-    const flags = [r.format === "invalid" ? "INVALID FORMAT" : null, r.disposable ? "DISPOSABLE" : null].filter(Boolean);
-    return `${r.email}\n  Format: ${r.format}\n  MX: ${r.mx_hosts.slice(0, 5).join(", ") || "none"}\n  Deliverable: ${r.deliverable}${flags.length ? ` | ${flags.join(" | ")}` : ""}`;
+    const flags = [
+        r.format === "invalid" ? "INVALID FORMAT" : null,
+        r.disposable ? "DISPOSABLE" : null,
+        r.role_account ? "ROLE ACCOUNT" : null,
+        r.free_provider ? "free provider" : null,
+    ].filter(Boolean);
+    return (`${r.email}\n` +
+        `  Format: ${r.format}\n` +
+        `  Domain: ${r.domain}\n` +
+        `  MX: ${r.mx_hosts.slice(0, 5).join(", ") || "none"}\n` +
+        `  Deliverable: ${r.deliverable}${flags.length ? ` | ${flags.join(" | ")}` : ""}` +
+        (r.plus_tag ? `\n  Plus tag: +${r.plus_tag}` : ""));
 }
 export async function validateEmail(args) {
     const email = (args.email ?? "").trim();
@@ -41,9 +83,756 @@ export async function validateEmail(args) {
     return fmt(await checkOne(email));
 }
 export async function validateBatch(args) {
-    const list = (args.emails ?? "").split(",").map((e) => e.trim()).filter(Boolean);
+    const list = (args.emails ?? "").split(/[,\s]+/).map((e) => e.trim()).filter(Boolean);
     if (list.length === 0)
         throw new EmailError("Provide at least one email address");
     const results = await Promise.all(list.slice(0, 25).map(checkOne));
-    return results.map(fmt).join("\n\n");
+    const valid = results.filter((r) => r.format === "valid").length;
+    const risky = results.filter((r) => r.disposable || r.role_account).length;
+    return (`${results.length} address(es): ${valid} well-formed, ${results.length - valid} malformed, ${risky} flagged (disposable or role).\n\n` +
+        results.map(fmt).join("\n\n"));
+}
+/** Domain-level check: MX plus A record and disposable status, no address needed. */
+export async function checkDomain(args) {
+    const domain = (args.domain ?? "").trim().toLowerCase().replace(/^@/, "");
+    if (!domain)
+        throw new EmailError("Provide a domain, e.g. 'example.com'");
+    if (!DOMAIN_RE.test(domain))
+        throw new EmailError(`"${domain}" is not a valid domain name`);
+    const [mx, a] = await Promise.all([
+        dns.resolveMx(domain).catch(() => []),
+        dns.resolve4(domain).catch(() => []),
+    ]);
+    const sorted = mx.sort((x, y) => x.priority - y.priority);
+    const lines = [
+        `Domain: ${domain}`,
+        `Accepts mail: ${sorted.length > 0 ? "yes" : "NO — no MX record, addresses here will bounce"}`,
+        `MX records (${sorted.length}):`,
+        ...(sorted.length ? sorted.map((m) => `  ${m.priority} ${m.exchange}`) : ["  none"]),
+        `A records (${a.length}): ${a.slice(0, 4).join(", ") || "none"}`,
+        `Disposable provider: ${DISPOSABLE.has(domain) ? "YES" : "no"}`,
+        `Free mail provider: ${FREE_PROVIDERS.has(domain) ? "yes" : "no"}`,
+    ];
+    return lines.join("\n");
+}
+/** Canonical form of an address, plus the variants providers will also accept. */
+export function normalizeEmail(args) {
+    const raw = (args.email ?? "").trim();
+    if (!raw)
+        throw new EmailError("Provide an email address");
+    const at = raw.lastIndexOf("@");
+    if (at <= 0)
+        throw new EmailError(`"${raw}" has no @, so it cannot be normalised`);
+    const local = raw.slice(0, at);
+    const domain = raw.slice(at + 1).toLowerCase();
+    const withoutTag = local.split("+")[0];
+    // Gmail and Googlemail ignore dots in the local part.
+    const isGoogle = domain === "gmail.com" || domain === "googlemail.com";
+    const canonicalLocal = isGoogle ? withoutTag.replace(/\./g, "") : withoutTag;
+    const canonical = `${canonicalLocal}@${domain === "googlemail.com" ? "gmail.com" : domain}`;
+    const variants = new Set([raw.toLowerCase(), `${local.toLowerCase()}@${domain}`, canonical]);
+    return [
+        `Input:     ${raw}`,
+        `Normalised: ${canonical}`,
+        `Local part: ${local}${args.email?.includes("+") ? " (has a plus tag)" : ""}`,
+        `Domain:     ${domain}`,
+        "",
+        "Equivalent forms:",
+        ...[...variants].map((v) => `  ${v}`),
+    ].join("\n");
+}
+/** Pull every email address out of a blob of text. */
+export function extractEmails(args) {
+    const body = args.text ?? "";
+    if (!body.trim())
+        throw new EmailError("Provide some text to scan");
+    const found = body.match(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g) ?? [];
+    const unique = [...new Set(found.map((e) => e.replace(/[.,;:]+$/, "")))];
+    if (!unique.length)
+        return "No email addresses found in that text.";
+    const junk = unique.filter((e) => DISPOSABLE.has(e.split("@")[1]?.toLowerCase() ?? ""));
+    return (`Found ${unique.length} unique address(es):\n` +
+        unique.map((e) => `  ${e}`).join("\n") +
+        (junk.length ? `\n\nFlagged as disposable (${junk.length}): ${junk.join(", ")}` : ""));
+}
+/** The disposable-domain list this server checks against. */
+export function disposableDomains(args) {
+    const limit = Math.min(Math.max(Number(args.limit) || 40, 1), DISPOSABLE.size);
+    const all = [...DISPOSABLE].sort();
+    return (`${DISPOSABLE.size} known disposable domains, showing ${Math.min(limit, all.length)}:\n` +
+        all.slice(0, limit).map((d, i) => `${i + 1}. ${d}`).join("\n"));
+}
+// ---- batch-4 tools: auth records, MX health, typo help (2026-09-27) ----
+const DKIM_SELECTORS = ["default", "google", "selector1", "selector2", "k1", "mail", "dkim"];
+const txtOf = (name) => dns.resolveTxt(name).then((rows) => rows.map((parts) => parts.join(""))).catch(() => []);
+/** The full anti-spoofing picture: MX hosts, SPF, DMARC policy and DKIM selectors. */
+export async function emailAuthRecords(args) {
+    const domain = (args.domain ?? "").trim().toLowerCase().replace(/^@/, "");
+    if (!domain)
+        throw new EmailError("Provide a domain, e.g. 'example.com'");
+    if (!DOMAIN_RE.test(domain))
+        throw new EmailError(`"${domain}" is not a valid domain name`);
+    const [root, dmarc, mx] = await Promise.all([
+        txtOf(domain),
+        txtOf(`_dmarc.${domain}`),
+        dns.resolveMx(domain).catch(() => []),
+    ]);
+    const spf = root.find((t) => t.toLowerCase().startsWith("v=spf1"));
+    const dmarcRecord = dmarc.find((t) => t.toLowerCase().startsWith("v=dmarc1"));
+    const dkim = [];
+    for (const selector of DKIM_SELECTORS) {
+        const rows = await txtOf(`${selector}._domainkey.${domain}`);
+        if (rows.some((r) => /v=dkim1|k=rsa|p=/i.test(r)))
+            dkim.push(selector);
+    }
+    const policy = dmarcRecord?.match(/p=(none|quarantine|reject)/i)?.[1] ?? null;
+    const allRule = spf?.match(/([-~?])all/)?.[1] ?? null;
+    const allNote = allRule === "-" ? " - hard fail, unauthorised senders are rejected" :
+        allRule === "~" ? " - soft fail, unauthorised senders are marked" :
+            allRule === "?" ? " - neutral, unauthorised senders are allowed" : "";
+    return [
+        `Mail authentication for ${domain}`,
+        `MX hosts (${mx.length}): ${mx.length ? mx.sort((a, b) => a.priority - b.priority).map((m) => m.exchange).join(", ") : "none - the domain cannot receive mail"}`,
+        `SPF: ${spf ?? "missing"}${allRule ? `  (all rule "${allRule}all"${allNote})` : ""}`,
+        `DMARC: ${dmarcRecord ?? "missing"}${policy ? `  (policy ${policy.toUpperCase()})` : ""}`,
+        `DKIM selectors found: ${dkim.length ? dkim.join(", ") : `none at ${DKIM_SELECTORS.join(", ")}`}`,
+        "",
+        spf && dmarcRecord && policy && policy !== "none" && dkim.length
+            ? "SPF, DMARC and DKIM are all in place."
+            : "Gaps above are what let spoofed mail through; fix them at the DNS host.",
+    ].join("\n");
+}
+/** Every MX host, whether it resolves, and its reverse DNS. */
+export async function mxHealth(args) {
+    const domain = (args.domain ?? "").trim().toLowerCase().replace(/^@/, "");
+    if (!domain)
+        throw new EmailError("Provide a domain, e.g. 'example.com'");
+    if (!DOMAIN_RE.test(domain))
+        throw new EmailError(`"${domain}" is not a valid domain name`);
+    const mx = await dns.resolveMx(domain).catch(() => []);
+    if (!mx.length)
+        return `${domain} has no MX record, so it cannot receive mail. Add one at the DNS host.`;
+    const rows = [];
+    let unreachable = 0;
+    for (const record of mx.sort((a, b) => a.priority - b.priority).slice(0, 10)) {
+        const host = record.exchange.replace(/\.$/, "");
+        const [addresses, ptr] = await Promise.all([
+            dns.resolve4(host).catch(() => []),
+            dns.reverse(host).catch(() => []),
+        ]);
+        if (!addresses.length)
+            unreachable += 1;
+        rows.push(`${String(record.priority).padStart(3)} ${host} | ${addresses.length ? `A ${addresses.slice(0, 2).join(", ")}` : "NO A record - mail routed here will fail"}${ptr.length ? ` | PTR ${ptr[0]}` : ""}`);
+    }
+    return [
+        `MX health for ${domain}: ${mx.length} host(s), ${unreachable ? `${unreachable} without an A record` : "all resolve"}`,
+        "",
+        ...rows,
+        "",
+        unreachable ? "Fix the hosts that do not resolve before mail starts bouncing." : "Every MX host resolves, so mail has a route in.",
+    ].join("\n");
+}
+const KNOWN_DOMAINS = [...new Set([...FREE_PROVIDERS, "zoho.com", "yandex.com", "gmx.de", "web.de", "fastmail.com", "hey.com", "qq.com", "163.com"])];
+const editDistance = (a, b) => {
+    const dp = Array.from({ length: a.length + 1 }, (_, i) => [i, ...Array(b.length).fill(0)]);
+    for (let j = 0; j <= b.length; j += 1)
+        dp[0][j] = j;
+    for (let i = 1; i <= a.length; i += 1) {
+        for (let j = 1; j <= b.length; j += 1) {
+            dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+    }
+    return dp[a.length][b.length];
+};
+/** Suggests the provider a mistyped domain was probably meant to be. Nothing is sent anywhere. */
+export function correctTypo(args) {
+    const raw = (args.email ?? "").trim();
+    if (!raw)
+        throw new EmailError("Provide an email address to check");
+    const at = raw.lastIndexOf("@");
+    if (at <= 0)
+        throw new EmailError(`"${raw}" has no @, so there is nothing to correct`);
+    const local = raw.slice(0, at);
+    const domain = raw.slice(at + 1).toLowerCase();
+    if (KNOWN_DOMAINS.includes(domain)) {
+        return `${raw} uses ${domain}, a known mail provider - no correction suggested.`;
+    }
+    const best = KNOWN_DOMAINS
+        .map((candidate) => ({ candidate, distance: editDistance(domain, candidate) }))
+        .sort((a, b) => a.distance - b.distance)[0];
+    if (!best || best.distance > 2) {
+        return `No close match for the domain "${domain}" - it may be a real domain. Run check_domain to test whether it accepts mail.`;
+    }
+    return [
+        `Possible typo in "${domain}"`,
+        `Closest known provider: ${best.candidate} (edit distance ${best.distance})`,
+        `Suggested address: ${local}@${best.candidate}`,
+        "",
+        "Suggestion only - the domain was not contacted.",
+    ].join("\n");
+}
+// ---- muxD tools:
+import { promises as dnsPromises } from "node:dns";
+import { createConnection } from "node:net";
+const EDGE_LOCALPARTS = new Set(["postmaster", "abuse", "hostmaster", "webmaster", "noc", "security", "hostmaster", "postmaster"]);
+const GIT_HOSTING = new Set(["github.com", "gitlab.com", "bitbucket.org", "codeberg.org", "gitea.com", "sourcehut.org"]);
+function smtpSession(host, port, helo, rcptTo, budgetMs) {
+    return new Promise((resolve) => {
+        let done = false;
+        const finish = (r) => {
+            if (done)
+                return;
+            done = true;
+            try {
+                socket.end();
+            }
+            catch { /* already gone */ }
+            try {
+                socket.destroy();
+            }
+            catch { /* already gone */ }
+            resolve(r);
+        };
+        const deadline = setTimeout(() => finish({ kind: "unreachable", code: 0, text: `no reply within ${Math.round(budgetMs / 1000)}s` }), budgetMs);
+        const socket = createConnection({ host, port });
+        let stage = "greeting";
+        let buf = "";
+        let heloTried = false;
+        socket.setTimeout(budgetMs);
+        socket.on("error", (e) => {
+            clearTimeout(deadline);
+            const reason = e.code === "ECONNREFUSED" ? "connection refused, which usually means outbound port 25 is blocked on this network or the host is not listening on 25"
+                : e.code === "ETIMEDOUT" || e.code === "EHOSTUNREACH" ? "timed out reaching the host"
+                    : e.code === "ECONNRESET" ? "the server reset the connection, which is a common anti-probe measure"
+                        : e.message;
+            finish({ kind: "unreachable", code: 0, text: reason });
+        });
+        socket.on("timeout", () => {
+            clearTimeout(deadline);
+            finish({ kind: "unreachable", code: 0, text: "idle timeout" });
+        });
+        socket.on("data", (chunk) => {
+            buf += chunk.toString("utf8");
+            // SMTP replies are multiline; only the final "NNN " line ends one.
+            let idx;
+            while ((idx = buf.search(/^\d{3} /m)) !== -1) {
+                // A line with a space after the code is the last line of a reply, so the
+                // match is always final. Read the text from that line itself, otherwise
+                // single-line replies (the common case for RCPT errors) lose the reason.
+                const finalLine = buf.slice(idx).split(/\r?\n/)[0];
+                const code = Number(finalLine.slice(0, 3));
+                const text = finalLine.slice(4).trim();
+                buf = buf.slice(idx + finalLine.length);
+                if (stage === "greeting") {
+                    if (code !== 220)
+                        return finish({ kind: "neutral", code, text });
+                    socket.write(`EHLO ${helo}\r\n`);
+                    stage = "ehlo";
+                }
+                else if (stage === "ehlo") {
+                    // Some old servers speak no ESMTP at all; HELO is the fallback.
+                    if (code !== 250 && !heloTried) {
+                        heloTried = true;
+                        socket.write(`HELO ${helo}\r\n`);
+                    }
+                    else if (code === 250) {
+                        // A null sender keeps the probe from being treated as a real message
+                        // source, which many servers reject outright.
+                        socket.write("MAIL FROM:<>\r\n");
+                        stage = "mail";
+                    }
+                    else {
+                        finish({ kind: "neutral", code, text });
+                    }
+                }
+                else if (stage === "mail") {
+                    if (code >= 200 && code < 300) {
+                        socket.write(`RCPT TO:<${rcptTo}>\r\n`);
+                        stage = "rcpt";
+                    }
+                    else {
+                        finish({ kind: "neutral", code, text });
+                    }
+                }
+                else {
+                    clearTimeout(deadline);
+                    if (code >= 200 && code < 300)
+                        finish({ kind: "exists", code, text });
+                    else if (code >= 400 && code < 500)
+                        finish({ kind: "defer", code, text });
+                    else if (code >= 500 && code < 600)
+                        finish({ kind: "absent", code, text });
+                    else
+                        finish({ kind: "neutral", code, text });
+                }
+            }
+        });
+        socket.on("close", () => {
+            clearTimeout(deadline);
+            if (!done)
+                finish({ kind: "unreachable", code: 0, text: "the server closed the connection before answering" });
+        });
+    });
+}
+const randTag = () => Math.random().toString(36).slice(2, 12);
+/** Asks the receiving server whether one address is real, and whether the domain answers yes to everything. */
+export async function smtpMailboxCheck(args) {
+    const email = String(args.email ?? "").trim().toLowerCase();
+    if (!email)
+        throw new EmailError("Provide an email address, e.g. 'someone@example.com'");
+    const at = email.lastIndexOf("@");
+    if (at <= 0 || at === email.length - 1)
+        throw new EmailError(`"${email}" is not an address, so there is nothing to probe`);
+    const domain = email.slice(at + 1);
+    if (!DOMAIN_RE.test(domain))
+        throw new EmailError(`"${domain}" is not a valid domain name`);
+    const budget = Math.min(Math.max(Math.floor(args.timeout_ms ?? 8000) || 8000, 2000), 20000);
+    const mx = await dnsPromises.resolveMx(domain).catch(() => []);
+    if (!mx.length) {
+        return [
+            `SMTP check for ${email}`,
+            "",
+            `${domain} publishes no MX record, so nothing accepts mail for it and the address cannot be probed.`,
+            "",
+            "This is a domain-level failure, not a statement about the mailbox. If mail to this domain bounces with 'no such user' that is misleading: the domain has nowhere to deliver at all.",
+        ].join("\n");
+    }
+    const hosts = mx.sort((a, b) => a.priority - b.priority).map((m) => m.exchange.replace(/\.$/, ""));
+    const helo = domain;
+    const probeOne = async (addr) => {
+        for (const host of hosts) {
+            const r = await smtpSession(host, 25, helo, addr, budget);
+            if (r.kind !== "unreachable")
+                return { host, r };
+        }
+        // Every host was unreachable; report the last reason so the cause is visible.
+        const last = await smtpSession(hosts[0], 25, helo, addr, budget);
+        return { host: hosts[0], r: last };
+    };
+    const target = await probeOne(email);
+    const lines = [`SMTP mailbox check for ${email}`, `MX hosts tried (in priority order): ${hosts.join(", ")}`, ""];
+    const describe = (r) => {
+        switch (r.kind) {
+            case "exists": return `mailbox accepted (${r.code})`;
+            case "absent": return `mailbox refused, no such user (${r.code})`;
+            case "defer": return `temporarily deferred (${r.code})`;
+            case "neutral": return `the server would not answer (${r.code})`;
+            case "unreachable": return `could not be probed: ${r.text}`;
+        }
+    };
+    if (target.r.kind === "unreachable" || target.r.kind === "neutral") {
+        lines.push(`Result: ${describe(target.r)}`, "", "This is NOT evidence that the address does not exist. The check could not be completed, and reporting it as an invalid address would be a false negative.", "", target.r.kind === "unreachable"
+            ? "Outbound port 25 is blocked by most consumer networks and by most cloud providers, so this fails on locked-down hosts. Running it from a machine with port 25 open, or behind a provider that offers an SMTP-verification API, is what makes this work."
+            : "The server answered but would not run the transaction, which usually means it requires a client that authenticates, or it blocks verification probes deliberately.");
+        return lines.join("\n");
+    }
+    if (target.r.kind === "defer") {
+        lines.push(`Result: ${describe(target.r)} via ${target.host}`, "", "A 4xx is a soft failure: the server is asking to be retried, not claiming the address is bad. Greylisting and rate limits produce this on the first probe and 250 on the second, so treat it as unknown rather than as either a pass or a fail.");
+        return lines.join("\n");
+    }
+    let catchAll = null;
+    let catchAddr = "";
+    if (args.check_catch_all !== false) {
+        catchAddr = `${randTag()}.${randTag()}@${domain}`;
+        catchAll = (await probeOne(catchAddr)).r;
+    }
+    if (target.r.kind === "absent") {
+        lines.push(`Result: ${describe(target.r)} via ${target.host}`, "", "The receiving server itself rejected the recipient, so the mailbox does not exist at this domain. This is a real negative, which makes it one of the few reliable do-not-send signals available.");
+        if (catchAll?.kind === "absent") {
+            lines.push("", `The domain also rejected ${catchAddr}, an address that cannot exist, so it is not accepting everything and this negative is trustworthy.`);
+        }
+        else if (catchAll?.kind === "exists") {
+            lines.push("", `The domain also accepted ${catchAddr}, an address that cannot exist, so it is catch-all and even this rejection carries less weight than it would otherwise.`);
+        }
+        else if (catchAll?.kind === "defer") {
+            lines.push("", `The catch-all probe was deferred (${catchAll.code}), so the domain's behaviour towards unknown addresses is not established.`);
+        }
+        else if (catchAll) {
+            lines.push("", "However this domain accepted a random address that cannot exist, so it is catch-all. Servers that accept everything are often honeypots that exist to catch spam traps, and a 250 here is not evidence of a real mailbox.");
+        }
+        return lines.join("\n");
+    }
+    // exists
+    if (catchAll?.kind === "exists") {
+        lines.push(`Result: mailbox accepted (250) via ${target.host}, but the domain is catch-all`, "", "A random address that cannot possibly exist was also accepted, so this server returns success for everything. The 250 for the real address therefore carries no information: it will look identical for an address you invented.", "", "Treat this as unusable for verification. Greylisted catch-all setups behave this way.");
+        return lines.join("\n");
+    }
+    lines.push(`Result: ${describe(target.r)} via ${target.host}`, catchAll ? `Catch-all probe: the random address was refused, so this domain does not accept everything` : "", "", "The server accepted the recipient and refused a random one, which is the strongest positive an SMTP check can give.", "", "This still does not prove the mailbox reads its mail. Role addresses and some providers' aliases are accepted without a person behind them, and a mailbox that was deactivated can be accepted for a while. It is a delivery-path check, not proof of a human inbox.");
+    return lines.filter((l) => l !== "").join("\n");
+}
+const isIpv4 = (s) => /^\d{1,3}(\.\d{1,3}){3}$/.test(s);
+const toIpv4 = (s) => s.split(".").map((n) => Number(n));
+/** CIDR containment for IPv4; ranges are the only form SPF uses for ip4. */
+function ip4InCidr(ip, cidr) {
+    const [rangeRaw, bitsRaw] = cidr.split("/");
+    if (!isIpv4(ip) || !isIpv4(rangeRaw))
+        return false;
+    const bits = bitsRaw === undefined ? 32 : Number(bitsRaw);
+    if (!Number.isFinite(bits) || bits < 0 || bits > 32)
+        return false;
+    const a = toIpv4(ip);
+    const b = toIpv4(rangeRaw);
+    for (let i = 0; i < 4; i += 1) {
+        const remaining = bits - i * 8;
+        if (remaining <= 0)
+            return true;
+        const mask = remaining >= 8 ? 255 : (0xff << (8 - remaining)) & 0xff;
+        if ((a[i] & mask) !== (b[i] & mask))
+            return false;
+    }
+    return true;
+}
+/** Expands ipv6 loosely: enough to compare when both sides are written in the same form. */
+function ip6Expand(addr) {
+    let s = addr.toLowerCase().split("%")[0];
+    if (!s.includes(":"))
+        return null;
+    if (s.includes(":::"))
+        return null;
+    const doubleIdx = s.indexOf("::");
+    if (doubleIdx !== -1 && s.indexOf("::", doubleIdx + 1) !== -1)
+        return null;
+    const [head, tail] = doubleIdx === -1 ? [s, ""] : [s.slice(0, doubleIdx), s.slice(doubleIdx + 2)];
+    const headParts = head ? head.split(":") : [];
+    const tailParts = tail ? tail.split(":") : [];
+    const gap = 8 - headParts.length - tailParts.length;
+    if (doubleIdx === -1 && headParts.length !== 8)
+        return null;
+    if (doubleIdx !== -1 && gap < 1)
+        return null;
+    const parts = [...headParts, ...Array(gap).fill("0"), ...tailParts];
+    if (parts.length !== 8)
+        return null;
+    const nums = parts.map((p) => {
+        if (/^[0-9a-f]{1,4}$/.test(p))
+            return parseInt(p, 16);
+        return NaN;
+    });
+    if (nums.some((n) => !Number.isFinite(n)))
+        return null;
+    return nums.map((n) => n.toString(16).padStart(4, "0")).join(":");
+}
+function ip6InCidr(ip, cidr) {
+    const [rangeRaw, bitsRaw] = cidr.split("/");
+    const a = ip6Expand(ip);
+    const b = ip6Expand(rangeRaw);
+    if (!a || !b)
+        return false;
+    const bits = bitsRaw === undefined ? 128 : Number(bitsRaw);
+    if (!Number.isFinite(bits) || bits < 0 || bits > 128)
+        return false;
+    const ah = a.split(":"), bh = b.split(":");
+    for (let i = 0; i < 8; i += 1) {
+        const remaining = bits - i * 16;
+        if (remaining <= 0)
+            return true;
+        if (remaining >= 16) {
+            if (ah[i] !== bh[i])
+                return false;
+            continue;
+        }
+        const mask = ((0xffff << (16 - remaining)) & 0xffff).toString(16).padStart(4, "0");
+        if ((parseInt(ah[i], 16) & parseInt(mask, 16)) !== (parseInt(bh[i], 16) & parseInt(mask, 16)))
+            return false;
+    }
+    return true;
+}
+const spfTxt = async (domain) => {
+    const rows = await dnsPromises.resolveTxt(domain).catch(() => []);
+    const flat = rows.map((r) => r.join("")).filter((t) => /^v=spf1(\s|$)/i.test(t.trim()));
+    if (!flat.length)
+        return null;
+    // RFC 7208 4.5: more than one v=spf1 record is a permerror, not a pick.
+    if (flat.length > 1)
+        throw new EmailError(`${domain} publishes ${flat.length} v=spf1 records, which is a permerror: a domain must have exactly one.`);
+    return flat[0].trim();
+};
+async function spfEval(domain, ip, depth = 0, lookups = 0, chain = []) {
+    const explain = [...chain];
+    if (depth > 10)
+        return { result: "permerror", domain, explain: [...explain, "include nested more than 10 deep, which is a permerror"], lookups };
+    if (lookups > 10)
+        return { result: "permerror", domain, explain: [...explain, "more than 10 DNS lookups, which is a permerror under RFC 7208 4.6.4"], lookups };
+    let record;
+    try {
+        record = await spfTxt(domain);
+    }
+    catch (e) {
+        return { result: "permerror", domain, explain: [...explain, e instanceof Error ? e.message : String(e)], lookups };
+    }
+    if (!record) {
+        return { result: depth === 0 ? "none" : "none", domain, explain: [...explain, `${domain} has no SPF record, so this include contributes no authorization`], lookups };
+    }
+    if (record.length > 255 * 10) {
+        return { result: "permerror", domain, explain: [...explain, "the record exceeds the 255 character limit, so it is a permerror"], lookups };
+    }
+    const terms = record.split(/\s+/).slice(1);
+    let used = lookups;
+    for (const rawTerm of terms) {
+        if (!rawTerm)
+            continue;
+        if (rawTerm.includes("="))
+            continue; // unknown modifier
+        // The qualifier is the leading + - ~ ? and belongs to the term; it must be
+        // captured, not skipped, or -all is never reached and every record that
+        // relies on it returns none instead of fail.
+        const qual = "+-~?".includes(rawTerm[0]) ? rawTerm[0] : "";
+        const term = qual ? rawTerm.slice(1) : rawTerm;
+        const [mechRaw, ...argParts] = term.split(":");
+        const mech = mechRaw.toLowerCase();
+        const arg = argParts.join(":");
+        const cidrSplit = arg.split("/");
+        const value = cidrSplit[0];
+        const range = cidrSplit[1];
+        const verdict = (hit, note) => {
+            if (hit === null)
+                return null;
+            if (hit) {
+                if (qual === "-")
+                    return { result: "fail", domain, explain: [...explain, note], lookups: used };
+                if (qual === "~")
+                    return { result: "softfail", domain, explain: [...explain, note], lookups: used };
+                if (qual === "?")
+                    return { result: "neutral", domain, explain: [...explain, note], lookups: used };
+                return { result: "pass", domain, explain: [...explain, note], lookups: used };
+            }
+            return null;
+        };
+        if (mech === "v")
+            continue;
+        if (mech === "ip4" || mech === "ip6") {
+            if (!value)
+                return { result: "permerror", domain, explain: [...explain, `${rawTerm} is missing an address`], lookups: used };
+            const cidr = range !== undefined ? `${value}/${range}` : value;
+            if (mech === "ip4") {
+                const hit = isIpv4(ip) ? ip4InCidr(ip, cidr) : null;
+                const v = verdict(hit, `ip4:${cidr} ${hit ? "matches" : "does not match"} ${ip}`);
+                if (v)
+                    return v;
+            }
+            else {
+                const hit = ip.includes(":") ? ip6InCidr(ip, cidr) : null;
+                const v = verdict(hit, `ip6:${cidr} ${hit ? "matches" : "does not match"} ${ip}`);
+                if (v)
+                    return v;
+            }
+            continue;
+        }
+        if (mech === "a" || mech === "mx") {
+            used += 1;
+            const d = value || domain;
+            let addrs = [];
+            if (mech === "a") {
+                addrs = [...(await dnsPromises.resolve4(d).catch(() => [])), ...(await dnsPromises.resolve6(d).catch(() => []))];
+            }
+            else {
+                const mxs = await dnsPromises.resolveMx(d).catch(() => []);
+                for (const mx of mxs.slice(0, 10)) {
+                    const h = mx.exchange.replace(/\.$/, "");
+                    addrs.push(...(await dnsPromises.resolve4(h).catch(() => [])), ...(await dnsPromises.resolve6(h).catch(() => [])));
+                }
+            }
+            if (!addrs.length) {
+                if (qual === "-")
+                    return { result: "fail", domain, explain: [...explain, `${mech}:${d} resolves to nothing, and a -qualifier makes that a hard fail`], lookups: used };
+                continue;
+            }
+            for (const addr of addrs) {
+                if (mech === "a") {
+                    const hit = isIpv4(addr) ? ip4InCidr(ip, `${addr}/${range ?? "32"}`) : ip6InCidr(ip, `${addr}/${range ?? "128"}`);
+                    const v = verdict(hit, `${mech}:${d} address ${addr} ${hit ? "matches" : "does not match"} ${ip}`);
+                    if (v)
+                        return v;
+                }
+                else if (mech === "mx") {
+                    const hit = isIpv4(addr) ? ip4InCidr(ip, `${addr}/${range ?? "32"}`) : ip6InCidr(ip, `${addr}/${range ?? "128"}`);
+                    const v = verdict(hit, `${mech}:${d} host address ${addr} ${hit ? "matches" : "does not match"} ${ip}`);
+                    if (v)
+                        return v;
+                }
+            }
+            continue;
+        }
+        if (mech === "include") {
+            used += 1;
+            const target = value.toLowerCase().replace(/\.$/, "");
+            if (!target)
+                return { result: "permerror", domain, explain: [...explain, "include: is missing a domain"], lookups: used };
+            const sub = await spfEval(target, ip, depth + 1, used, [...explain, `include:${target} evaluated`]);
+            used = sub.lookups;
+            if (sub.result === "pass") {
+                if (qual === "-")
+                    return { result: "fail", domain, explain: [...explain, `include:${target} returned pass, but the -qualifier makes it a hard fail`], lookups: used };
+                if (qual === "~")
+                    return { result: "softfail", domain, explain: [...explain, `include:${target} returned pass, qualified softfail`], lookups: used };
+                if (qual === "?")
+                    return { result: "neutral", domain, explain: [...explain, `include:${target} returned pass, qualified neutral`], lookups: used };
+                return { result: "pass", domain, explain: [...explain, `include:${target} evaluated to pass`], lookups: used };
+            }
+            if (sub.result === "temperror") {
+                return { result: "temperror", domain, explain: [...explain, `include:${target} hit a temporary DNS error`], lookups: used };
+            }
+            // permerror inside an include does not void the outer record, it just
+            // fails to authorize. Treat the include as not matching.
+            explain.push(`include:${target} evaluated to ${sub.result}, so it does not authorize`);
+            continue;
+        }
+        if (mech === "ptr") {
+            used += 1;
+            explain.push("ptr: is deprecated in RFC 7208 and many implementations ignore it, so it was not evaluated");
+            continue;
+        }
+        if (mech === "all") {
+            if (qual === "-")
+                return { result: "fail", domain, explain: [...explain, "reached -all without a match, so the sender is not authorized"], lookups: used };
+            if (qual === "~")
+                return { result: "softfail", domain, explain: [...explain, "reached ~all without a match, so the sender is only soft-failed"], lookups: used };
+            if (qual === "?")
+                return { result: "neutral", domain, explain: [...explain, "reached ?all without a match, which authorizes nothing and blocks nothing"], lookups: used };
+            return { result: "pass", domain, explain: [...explain, "reached +all, so anything that reached the end is authorized"], lookups: used };
+        }
+        return { result: "permerror", domain, explain: [...explain, `unknown mechanism "${mech}" in ${rawTerm}`], lookups: used };
+    }
+    return { result: "none", domain, explain: [...explain, "no mechanism matched and there is no all mechanism, so SPF returns none"], lookups: used };
+}
+/** Actually runs SPF for one sender IP against a domain's record, rather than only printing the record. */
+export async function spfEvaluate(args) {
+    const domain = (args.domain ?? "").trim().toLowerCase().replace(/^@/, "");
+    if (!domain)
+        throw new EmailError("Provide a domain, e.g. 'example.com'");
+    if (!DOMAIN_RE.test(domain))
+        throw new EmailError(`"${domain}" is not a valid domain name`);
+    const ip = String(args.ip ?? "").trim().replace(/^\[|\]$/g, "");
+    if (!ip)
+        throw new EmailError("Provide the sender IP address that SPF should be evaluated against, e.g. 203.0.113.10");
+    if (!isIpv4(ip) && !ip.includes(":")) {
+        throw new EmailError(`"${ip}" is not an IP address. SPF evaluates an IP, not a hostname; look up the address first with an A record lookup.`);
+    }
+    if (isIpv4(ip) && toIpv4(ip).some((n) => n > 255)) {
+        throw new EmailError(`"${ip}" is not a valid IPv4 address`);
+    }
+    const record = await spfTxt(domain).catch((e) => {
+        throw new EmailError(e instanceof Error ? e.message : String(e));
+    });
+    if (!record) {
+        return [
+            `SPF evaluation for ${domain} against ${ip}`,
+            "",
+            `${domain} publishes no v=spf1 record, so the result is none.`,
+            "",
+            "none means the domain makes no statement at all, which receivers treat differently from a deliberate fail: a domain with no SPF is checked for a From address in its own domain and can be a weaker signal to rely on than it looks. Add an SPF record.",
+        ].join("\n");
+    }
+    const v = await spfEval(domain, ip);
+    const verdict = {
+        pass: "PASS - this sender is authorized",
+        fail: "FAIL - this sender is not authorized, and receivers should reject it",
+        softfail: "SOFTFAIL - no match, treated as a weak failure; most receivers still deliver but score it down",
+        neutral: "NEUTRAL - the domain explicitly declines to say, which is the same as making no statement",
+        none: "NONE - no mechanism matched and there is no all mechanism",
+        permerror: "PERMERROR - the record is broken, so no result can be trusted",
+        temperror: "TEMPERROR - a temporary DNS failure interrupted the check",
+    };
+    const lines = [
+        `SPF evaluation for ${domain} against ${ip}`,
+        `record: ${record}`,
+        `result: ${v.result.toUpperCase()}`,
+        verdict[v.result],
+        `DNS lookups used: ${v.lookups} of the 10 allowed`,
+        "",
+        "Chain:",
+        ...v.explain.map((e) => `  - ${e}`),
+        "",
+    ];
+    if (v.result === "permerror") {
+        lines.push("A permerror is not a pass or a fail. It means the record is misconfigured, so receiving servers are meant to ignore SPF entirely for this domain, which removes the protection rather than enforcing it.");
+    }
+    else if (v.result === "pass") {
+        lines.push("This sender passes SPF. Alignment with the visible From domain is a separate DMARC check, so a pass here is not on its own proof that the message is legitimate.");
+    }
+    else if (v.result === "fail") {
+        lines.push("A hard fail here is what makes DMARC reject work: this is the result a spoofer produces, and it is the outcome a correct -all should give for everyone else.");
+    }
+    if (v.lookups > 10) {
+        lines.push("", "The lookup count is over the RFC 7208 limit of 10. Receivers must treat that as a permerror, so a record that authorizes correctly in this evaluation may still be ignored in practice.");
+    }
+    if (args.include_record === false)
+        lines.splice(1, 1);
+    lines.push("", "This is SPF only. Check the DMARC policy for the domain to know whether a failure here actually rejects the message.");
+    return lines.join("\n");
+}
+/** Purely local: derives the plus-tag and dot-stripped forms of an address so alias-based duplicates can be spotted. */
+export async function aliasVariants(args) {
+    const email = String(args.email ?? "").trim().toLowerCase();
+    if (!email)
+        throw new EmailError("Provide an email address, e.g. 'someone+news@example.com'");
+    const at = email.lastIndexOf("@");
+    if (at <= 0 || at === email.length - 1)
+        throw new EmailError(`"${email}" is not an address`);
+    const localRaw = email.slice(0, at);
+    const domain = email.slice(at + 1);
+    if (!DOMAIN_RE.test(domain))
+        throw new EmailError(`"${domain}" is not a valid domain name`);
+    if (!LOCAL_RE.test(localRaw))
+        throw new EmailError(`"${localRaw}" contains characters that are not valid in a local part`);
+    const max = Math.min(Math.max(Math.floor(args.max ?? 40) || 40, 1), 200);
+    const set = new Set();
+    const add = (s) => { if (s && s !== email && s.length <= 64)
+        set.add(s); };
+    const plusIdx = localRaw.indexOf("+");
+    const base = plusIdx === -1 ? localRaw : localRaw.slice(0, plusIdx);
+    const tag = plusIdx === -1 ? null : localRaw.slice(plusIdx + 1);
+    if (tag) {
+        add(`${base}@${domain}`);
+        // The tag is a routing label, so every plausible reading of it is a
+        // different mailbox that reaches the same person.
+        for (const part of tag.split(/[._-]+/).filter(Boolean).slice(0, 6)) {
+            add(`${base}+${part}@${domain}`);
+            add(`${base}+${part.toUpperCase()}@${domain}`);
+        }
+    }
+    // Gmail and a handful of others ignore dots in the local part, so these all
+    // resolve to the same mailbox. Almost no other provider does this.
+    const dotInsensitive = new Set(["gmail.com", "googlemail.com"]);
+    if (dotInsensitive.has(domain) && base.includes(".")) {
+        add(`${base.replace(/\./g, "")}@${domain}`);
+        if (base.replace(/\./g, "").length > 0)
+            add(`${base.split(".")[0]}@${domain}`);
+    }
+    if (domain === "googlemail.com")
+        add(`${base}@gmail.com`);
+    if (domain === "gmail.com")
+        add(`${base}@googlemail.com`);
+    // Fastmail-style plus addressing is a documented feature, not a provider quirk.
+    if (["fastmail.com", "fastmail.fm", "migumail.com", "runbox.com", "hushmail.com", "tutanota.com", "zoho.com", "yandex.com", "hey.com", "icloud.com", "outlook.com", "proton.me", "protonmail.com", "fastmail.ch"].includes(domain)) {
+        add(`${base}+${tag ?? "unused"}@${domain}`);
+    }
+    const out = [...set].slice(0, max);
+    const isRole = EDGE_LOCALPARTS.has(base) || ROLE_LOCALPARTS.has(base);
+    const isFree = FREE_PROVIDERS.has(domain);
+    const isHosting = GIT_HOSTING.has(domain);
+    const lines = [
+        `Alias analysis for ${email}`,
+        `canonical-looking local part: ${base}${tag !== null ? `  (plus tag "${tag}" stripped)` : ""}`,
+        `domain: ${domain}  ${isFree ? "- a free consumer provider, where addresses are cheap to create in bulk" : ""}${isHosting ? "- a code-hosting domain, often a forge login rather than a person" : ""}`,
+        "",
+    ];
+    if (isRole) {
+        lines.push(`"${base}" is a role address, not a person. Role mailboxes are accepted by mail servers and always accept an SMTP probe, so an SMTP existence check will pass for one and it should not be read as a deliverable individual.`, "");
+    }
+    if (isFree) {
+        lines.push("Free providers hand out addresses freely, so a valid address from one is weak evidence that anyone chose it deliberately.", "");
+    }
+    if (isHosting) {
+        lines.push("On a code-hosting domain the address is usually a forge account, so a signup there is not a personal mailbox and often is not intended to receive mail.", "");
+    }
+    lines.push(`${out.length} variant(s) that reach the same person or the same inbox:`);
+    for (const v of out.slice(0, 20))
+        lines.push(`  ${v}`);
+    if (out.length > 20)
+        lines.push(`  ...and ${out.length - 20} more`);
+    if (!out.length)
+        lines.push("  none: there is no plus tag, no dot-insensitive provider and no alias feature to expand");
+    lines.push("", "Whether these are the same person cannot be decided from the address. Only a provider that documents alias collapsing, such as Gmail ignoring dots or Fastmail accepting plus tags, will treat them as identical; everywhere else plus is a real, separate mailbox.");
+    return lines.join("\n");
 }

package/dist/license.js

@@ -0,0 +1,79 @@
+// Premium tools on this server need a license key bought from MCP Marketplace.
+// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
+// that is not listed in PREMIUM keeps working without a key.
+const SLUG = "email-validator-mcp";
+// Tools that need a key. Everything else is free.
+const PREMIUM = new Set([
+    "smtp_mailbox_check",
+    "spf_evaluate",
+]);
+const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`;
+// The license check calls the marketplace's verify endpoint directly instead of
+// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
+// check it makes is rejected by Supabase before it reaches the function. The
+// publishable key below is public by design - it ships in mcp-marketplace.io's
+// own JavaScript and only ever reaches their licence check.
+const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key";
+const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h";
+const OK_CACHE_MS = 60 * 60 * 1000;
+const BAD_CACHE_MS = 60 * 1000;
+const seen = new Map();
+const REASONS = {
+    missing_key: "no key is set",
+    invalid_format: "that key is not a valid MCP Marketplace key",
+    not_found: "that key was not found",
+    revoked: "that key has been revoked",
+    rotated: "that key was rotated, use your new one",
+    expired: "that key has expired, renew it",
+    rate_limited: "there were too many checks just now, try again shortly",
+    network_error: "the license server could not be reached",
+};
+function blocked(tool, reason) {
+    const why = REASONS[reason] ?? `the license server answered "${reason}"`;
+    return `"${tool}" needs a license key, but ${why}. ` +
+        `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`;
+}
+async function verify(key) {
+    const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
+        method: "POST",
+        headers: {
+            apikey: PUBLISHABLE_KEY,
+            Authorization: `Bearer ${PUBLISHABLE_KEY}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ key, slug: SLUG }),
+        // an unusable key answers 400 with a JSON body, so read the body either way
+        signal: AbortSignal.timeout(15000),
+    });
+    const data = (await res.json());
+    if (typeof data?.valid !== "boolean")
+        return { valid: false, reason: "unexpected_response" };
+    return data;
+}
+/**
+ * Returns null when the caller may run the tool, or a short message telling
+ * them how to get a key.
+ *
+ * A good key is remembered for an hour, so a busy session does not hit the
+ * license server on every call and keeps working through a brief outage.
+ */
+export async function premiumRequired(tool) {
+    if (!PREMIUM.has(tool))
+        return null;
+    const key = process.env.MCP_LICENSE_KEY;
+    if (!key)
+        return blocked(tool, "missing_key");
+    const hit = seen.get(key);
+    if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
+        return hit.valid ? null : blocked(tool, hit.reason ?? "invalid");
+    }
+    let result;
+    try {
+        result = await verify(key);
+    }
+    catch {
+        result = { valid: false, reason: "network_error" };
+    }
+    seen.set(key, { ...result, at: Date.now() });
+    return result.valid ? null : blocked(tool, result.reason ?? "invalid");
+}

package/dist/server.js

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-import { validateBatch } from "./api.js";
-import { validateEmail } from "./api.js";
+import { checkDomain, disposableDomains, extractEmails, normalizeEmail, validateBatch, validateEmail, emailAuthRecords, mxHealth, correctTypo, smtpMailboxCheck, spfEvaluate, aliasVariants } from "./api.js";
+import { premiumRequired } from "./license.js";
 const text = (value) => ({ content: [{ type: "text", text: value }] });
 const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
@@ -10,8 +10,11 @@ export function createServer() {
     const server = new McpServer({ name: "email-validator-mcp", version: "1.0.0" });
     server.registerTool("validate_email", {
         title: "Validate email",
-        description: "Check an email address format, MX record, and disposable status.",
-        inputSchema: z.object({ email: z.string().describe("Email address to validate.") }),
+        description: "Check one email address: format, live MX records, disposable-domain status, role account (info@, support@) " +
+            "and whether it is a free provider.",
+        inputSchema: z.object({
+            email: z.string().describe("Email address to validate."),
+        }),
         annotations: READ_ONLY,
     }, async (args) => {
         try {
@@ -23,8 +26,10 @@ export function createServer() {
     });
     server.registerTool("validate_batch", {
         title: "Validate batch",
-        description: "Check a list of comma separated email addresses.",
-        inputSchema: z.object({ emails: z.string().describe("Comma separated email addresses.") }),
+        description: "Validate up to 25 addresses at once and get a count of well-formed, malformed and risky ones.",
+        inputSchema: z.object({
+            emails: z.string().describe("Comma or space separated email addresses (max 25)."),
+        }),
         annotations: READ_ONLY,
     }, async (args) => {
         try {
@@ -34,5 +39,171 @@ export function createServer() {
             return textError(error(e));
         }
     });
+    server.registerTool("check_domain", {
+        title: "Check domain",
+        description: "Domain-level mail check: MX records, A records, and whether the domain is a disposable or free provider.",
+        inputSchema: z.object({
+            domain: z.string().describe("Domain name, e.g. 'example.com' (a leading @ is fine)."),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        try {
+            return text(await checkDomain(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("normalize_email", {
+        title: "Normalize email",
+        description: "Canonical form of an address: lowercase the domain, drop the +tag, and remove Gmail dots, " +
+            "so duplicates collapse to one record.",
+        inputSchema: z.object({
+            email: z.string().describe("Email address to normalise."),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        try {
+            return text(normalizeEmail(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("extract_emails", {
+        title: "Extract emails",
+        description: "Pull every unique email address out of a block of text, flagging any disposable domains.",
+        inputSchema: z.object({
+            text: z.string().describe("Text to scan, e.g. a pasted email thread or CSV cell."),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        try {
+            return text(extractEmails(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("disposable_domains", {
+        title: "Disposable domains",
+        description: "List the known disposable email domains this server checks against.",
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(100).default(40).describe("How many domains to list"),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        try {
+            return text(disposableDomains(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("email_auth_records", {
+        title: "Email auth records",
+        description: "The full anti-spoofing picture for a domain: MX hosts, SPF with its all-rule, DMARC policy and DKIM selectors.",
+        inputSchema: z.object({
+            domain: z.string().describe("Domain name, e.g. 'example.com' (a leading @ is fine)."),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        try {
+            return text(await emailAuthRecords(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("mx_health", {
+        title: "MX health",
+        description: "Every MX host for a domain, whether it resolves to an A record, and its reverse DNS.",
+        inputSchema: z.object({
+            domain: z.string().describe("Domain name, e.g. 'example.com' (a leading @ is fine)."),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        try {
+            return text(await mxHealth(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("correct_typo", {
+        title: "Correct typo",
+        description: "Suggests the mail provider a mistyped domain probably meant, e.g. gmial.com -> gmail.com, without contacting the domain.",
+        inputSchema: z.object({
+            email: z.string().describe("Email address that may contain a typo."),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        try {
+            return text(correctTypo(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("smtp_mailbox_check", {
+        title: "SMTP mailbox check",
+        description: "Asks the receiving mail server whether a specific address actually exists, using an SMTP RCPT TO probe after negotiating with each MX host in priority order. An MX record only proves the domain accepts mail somewhere, not that one mailbox is real, so this is the only real existence signal available. Also probes a random address to detect catch-all domains, where a success reply means nothing. Distinguishes a genuine no-such-user from a network failure or a greylisted deferral, and never reports an unreachable server as an invalid address.",
+        inputSchema: z.object({
+            email: z.string().describe("Address to probe, e.g. someone@example.com"),
+            check_catch_all: z.boolean().default(true).describe("Also probe a random address to detect a catch-all domain. Default true"),
+            timeout_ms: z.number().int().min(2000).max(20000).default(8000).describe("Per-host timeout in ms, default 8000"),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: smtp_mailbox_check ----
+        const paywallMessage = await premiumRequired("smtp_mailbox_check");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await smtpMailboxCheck(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("spf_evaluate", {
+        title: "Evaluate SPF for a sender IP",
+        description: "Runs RFC 7208 SPF evaluation of a sender IP against a domain's actual record: walks every mechanism in order, resolves a, mx and include recursively, applies the + - ~ ? qualifiers, and returns pass, fail, softfail, neutral, none, permerror or temperror with the full chain of reasoning and the DNS lookup count. Existing tools only print the SPF record; this one tells you what it actually decides, and distinguishes a broken record from a deliberate failure.",
+        inputSchema: z.object({
+            domain: z.string().describe("Domain whose SPF record should be evaluated, e.g. example.com"),
+            ip: z.string().describe("Sender IP address to evaluate, e.g. 203.0.113.10"),
+            include_record: z.boolean().default(true).describe("Show the raw SPF record. Default true"),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: spf_evaluate ----
+        const paywallMessage = await premiumRequired("spf_evaluate");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await spfEvaluate(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("alias_variants", {
+        title: "Alias variants of an address",
+        description: "Derives the addresses that reach the same inbox as a given one: the plus-tag and sub-address forms, the Gmail and Googlemail dot-stripped equivalents, and the providers that document plus addressing as a real feature. Flags role addresses, free providers and code-hosting domains where a valid SMTP result does not mean a deliverable person. Instant and entirely local, with no DNS or network access.",
+        inputSchema: z.object({
+            email: z.string().describe("Address to expand, e.g. someone+news@example.com"),
+            max: z.number().int().min(1).max(200).default(40).describe("Variants to return, default 40"),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        try {
+            return text(await aliasVariants(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
     return server;
 }

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.2",
+  "version": "1.0.3",
   "type": "module",
   "repository": {
     "type": "git",
@@ -22,11 +22,7 @@
   "license": "MIT",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.4",
-    "zod": "^3.23.8",
-    "pdf-lib": "^1.17.1",
-    "exceljs": "^4.4.0",
-    "qrcode": "^1.5.4",
-    "sharp": "^0.33.4"
+    "zod": "^3.23.8"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",