email-validator-mcp 1.0.3 → 1.0.4

package/README.md

@@ -27,21 +27,4 @@ node dist/index.js
 
 MX records are resolved through the DNS of the sending machine. A missing MX record does not guarantee an inbox does not exist, the result is honest about that.
 
-<!-- paywall -->
-## Premium tools
 
-These tools need a license key:
-
-* `smtp_mailbox_check`
-* `spf_evaluate`
-
-Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-email-validator-mcp and set it in your MCP client config:
-
-```json
-"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
-```
-
-The key is checked against MCP Marketplace, cached for 24 hours, and keeps
-working offline once one check has succeeded. Every other tool on this server
-stays free.
-<!-- /paywall -->

package/dist/api.js

@@ -271,496 +271,8 @@ export function correctTypo(args) {
         "Suggestion only - the domain was not contacted.",
     ].join("\n");
 }
-// ---- muxD tools:
-import { promises as dnsPromises } from "node:dns";
-import { createConnection } from "node:net";
 const EDGE_LOCALPARTS = new Set(["postmaster", "abuse", "hostmaster", "webmaster", "noc", "security", "hostmaster", "postmaster"]);
 const GIT_HOSTING = new Set(["github.com", "gitlab.com", "bitbucket.org", "codeberg.org", "gitea.com", "sourcehut.org"]);
-function smtpSession(host, port, helo, rcptTo, budgetMs) {
-    return new Promise((resolve) => {
-        let done = false;
-        const finish = (r) => {
-            if (done)
-                return;
-            done = true;
-            try {
-                socket.end();
-            }
-            catch { /* already gone */ }
-            try {
-                socket.destroy();
-            }
-            catch { /* already gone */ }
-            resolve(r);
-        };
-        const deadline = setTimeout(() => finish({ kind: "unreachable", code: 0, text: `no reply within ${Math.round(budgetMs / 1000)}s` }), budgetMs);
-        const socket = createConnection({ host, port });
-        let stage = "greeting";
-        let buf = "";
-        let heloTried = false;
-        socket.setTimeout(budgetMs);
-        socket.on("error", (e) => {
-            clearTimeout(deadline);
-            const reason = e.code === "ECONNREFUSED" ? "connection refused, which usually means outbound port 25 is blocked on this network or the host is not listening on 25"
-                : e.code === "ETIMEDOUT" || e.code === "EHOSTUNREACH" ? "timed out reaching the host"
-                    : e.code === "ECONNRESET" ? "the server reset the connection, which is a common anti-probe measure"
-                        : e.message;
-            finish({ kind: "unreachable", code: 0, text: reason });
-        });
-        socket.on("timeout", () => {
-            clearTimeout(deadline);
-            finish({ kind: "unreachable", code: 0, text: "idle timeout" });
-        });
-        socket.on("data", (chunk) => {
-            buf += chunk.toString("utf8");
-            // SMTP replies are multiline; only the final "NNN " line ends one.
-            let idx;
-            while ((idx = buf.search(/^\d{3} /m)) !== -1) {
-                // A line with a space after the code is the last line of a reply, so the
-                // match is always final. Read the text from that line itself, otherwise
-                // single-line replies (the common case for RCPT errors) lose the reason.
-                const finalLine = buf.slice(idx).split(/\r?\n/)[0];
-                const code = Number(finalLine.slice(0, 3));
-                const text = finalLine.slice(4).trim();
-                buf = buf.slice(idx + finalLine.length);
-                if (stage === "greeting") {
-                    if (code !== 220)
-                        return finish({ kind: "neutral", code, text });
-                    socket.write(`EHLO ${helo}\r\n`);
-                    stage = "ehlo";
-                }
-                else if (stage === "ehlo") {
-                    // Some old servers speak no ESMTP at all; HELO is the fallback.
-                    if (code !== 250 && !heloTried) {
-                        heloTried = true;
-                        socket.write(`HELO ${helo}\r\n`);
-                    }
-                    else if (code === 250) {
-                        // A null sender keeps the probe from being treated as a real message
-                        // source, which many servers reject outright.
-                        socket.write("MAIL FROM:<>\r\n");
-                        stage = "mail";
-                    }
-                    else {
-                        finish({ kind: "neutral", code, text });
-                    }
-                }
-                else if (stage === "mail") {
-                    if (code >= 200 && code < 300) {
-                        socket.write(`RCPT TO:<${rcptTo}>\r\n`);
-                        stage = "rcpt";
-                    }
-                    else {
-                        finish({ kind: "neutral", code, text });
-                    }
-                }
-                else {
-                    clearTimeout(deadline);
-                    if (code >= 200 && code < 300)
-                        finish({ kind: "exists", code, text });
-                    else if (code >= 400 && code < 500)
-                        finish({ kind: "defer", code, text });
-                    else if (code >= 500 && code < 600)
-                        finish({ kind: "absent", code, text });
-                    else
-                        finish({ kind: "neutral", code, text });
-                }
-            }
-        });
-        socket.on("close", () => {
-            clearTimeout(deadline);
-            if (!done)
-                finish({ kind: "unreachable", code: 0, text: "the server closed the connection before answering" });
-        });
-    });
-}
-const randTag = () => Math.random().toString(36).slice(2, 12);
-/** Asks the receiving server whether one address is real, and whether the domain answers yes to everything. */
-export async function smtpMailboxCheck(args) {
-    const email = String(args.email ?? "").trim().toLowerCase();
-    if (!email)
-        throw new EmailError("Provide an email address, e.g. 'someone@example.com'");
-    const at = email.lastIndexOf("@");
-    if (at <= 0 || at === email.length - 1)
-        throw new EmailError(`"${email}" is not an address, so there is nothing to probe`);
-    const domain = email.slice(at + 1);
-    if (!DOMAIN_RE.test(domain))
-        throw new EmailError(`"${domain}" is not a valid domain name`);
-    const budget = Math.min(Math.max(Math.floor(args.timeout_ms ?? 8000) || 8000, 2000), 20000);
-    const mx = await dnsPromises.resolveMx(domain).catch(() => []);
-    if (!mx.length) {
-        return [
-            `SMTP check for ${email}`,
-            "",
-            `${domain} publishes no MX record, so nothing accepts mail for it and the address cannot be probed.`,
-            "",
-            "This is a domain-level failure, not a statement about the mailbox. If mail to this domain bounces with 'no such user' that is misleading: the domain has nowhere to deliver at all.",
-        ].join("\n");
-    }
-    const hosts = mx.sort((a, b) => a.priority - b.priority).map((m) => m.exchange.replace(/\.$/, ""));
-    const helo = domain;
-    const probeOne = async (addr) => {
-        for (const host of hosts) {
-            const r = await smtpSession(host, 25, helo, addr, budget);
-            if (r.kind !== "unreachable")
-                return { host, r };
-        }
-        // Every host was unreachable; report the last reason so the cause is visible.
-        const last = await smtpSession(hosts[0], 25, helo, addr, budget);
-        return { host: hosts[0], r: last };
-    };
-    const target = await probeOne(email);
-    const lines = [`SMTP mailbox check for ${email}`, `MX hosts tried (in priority order): ${hosts.join(", ")}`, ""];
-    const describe = (r) => {
-        switch (r.kind) {
-            case "exists": return `mailbox accepted (${r.code})`;
-            case "absent": return `mailbox refused, no such user (${r.code})`;
-            case "defer": return `temporarily deferred (${r.code})`;
-            case "neutral": return `the server would not answer (${r.code})`;
-            case "unreachable": return `could not be probed: ${r.text}`;
-        }
-    };
-    if (target.r.kind === "unreachable" || target.r.kind === "neutral") {
-        lines.push(`Result: ${describe(target.r)}`, "", "This is NOT evidence that the address does not exist. The check could not be completed, and reporting it as an invalid address would be a false negative.", "", target.r.kind === "unreachable"
-            ? "Outbound port 25 is blocked by most consumer networks and by most cloud providers, so this fails on locked-down hosts. Running it from a machine with port 25 open, or behind a provider that offers an SMTP-verification API, is what makes this work."
-            : "The server answered but would not run the transaction, which usually means it requires a client that authenticates, or it blocks verification probes deliberately.");
-        return lines.join("\n");
-    }
-    if (target.r.kind === "defer") {
-        lines.push(`Result: ${describe(target.r)} via ${target.host}`, "", "A 4xx is a soft failure: the server is asking to be retried, not claiming the address is bad. Greylisting and rate limits produce this on the first probe and 250 on the second, so treat it as unknown rather than as either a pass or a fail.");
-        return lines.join("\n");
-    }
-    let catchAll = null;
-    let catchAddr = "";
-    if (args.check_catch_all !== false) {
-        catchAddr = `${randTag()}.${randTag()}@${domain}`;
-        catchAll = (await probeOne(catchAddr)).r;
-    }
-    if (target.r.kind === "absent") {
-        lines.push(`Result: ${describe(target.r)} via ${target.host}`, "", "The receiving server itself rejected the recipient, so the mailbox does not exist at this domain. This is a real negative, which makes it one of the few reliable do-not-send signals available.");
-        if (catchAll?.kind === "absent") {
-            lines.push("", `The domain also rejected ${catchAddr}, an address that cannot exist, so it is not accepting everything and this negative is trustworthy.`);
-        }
-        else if (catchAll?.kind === "exists") {
-            lines.push("", `The domain also accepted ${catchAddr}, an address that cannot exist, so it is catch-all and even this rejection carries less weight than it would otherwise.`);
-        }
-        else if (catchAll?.kind === "defer") {
-            lines.push("", `The catch-all probe was deferred (${catchAll.code}), so the domain's behaviour towards unknown addresses is not established.`);
-        }
-        else if (catchAll) {
-            lines.push("", "However this domain accepted a random address that cannot exist, so it is catch-all. Servers that accept everything are often honeypots that exist to catch spam traps, and a 250 here is not evidence of a real mailbox.");
-        }
-        return lines.join("\n");
-    }
-    // exists
-    if (catchAll?.kind === "exists") {
-        lines.push(`Result: mailbox accepted (250) via ${target.host}, but the domain is catch-all`, "", "A random address that cannot possibly exist was also accepted, so this server returns success for everything. The 250 for the real address therefore carries no information: it will look identical for an address you invented.", "", "Treat this as unusable for verification. Greylisted catch-all setups behave this way.");
-        return lines.join("\n");
-    }
-    lines.push(`Result: ${describe(target.r)} via ${target.host}`, catchAll ? `Catch-all probe: the random address was refused, so this domain does not accept everything` : "", "", "The server accepted the recipient and refused a random one, which is the strongest positive an SMTP check can give.", "", "This still does not prove the mailbox reads its mail. Role addresses and some providers' aliases are accepted without a person behind them, and a mailbox that was deactivated can be accepted for a while. It is a delivery-path check, not proof of a human inbox.");
-    return lines.filter((l) => l !== "").join("\n");
-}
-const isIpv4 = (s) => /^\d{1,3}(\.\d{1,3}){3}$/.test(s);
-const toIpv4 = (s) => s.split(".").map((n) => Number(n));
-/** CIDR containment for IPv4; ranges are the only form SPF uses for ip4. */
-function ip4InCidr(ip, cidr) {
-    const [rangeRaw, bitsRaw] = cidr.split("/");
-    if (!isIpv4(ip) || !isIpv4(rangeRaw))
-        return false;
-    const bits = bitsRaw === undefined ? 32 : Number(bitsRaw);
-    if (!Number.isFinite(bits) || bits < 0 || bits > 32)
-        return false;
-    const a = toIpv4(ip);
-    const b = toIpv4(rangeRaw);
-    for (let i = 0; i < 4; i += 1) {
-        const remaining = bits - i * 8;
-        if (remaining <= 0)
-            return true;
-        const mask = remaining >= 8 ? 255 : (0xff << (8 - remaining)) & 0xff;
-        if ((a[i] & mask) !== (b[i] & mask))
-            return false;
-    }
-    return true;
-}
-/** Expands ipv6 loosely: enough to compare when both sides are written in the same form. */
-function ip6Expand(addr) {
-    let s = addr.toLowerCase().split("%")[0];
-    if (!s.includes(":"))
-        return null;
-    if (s.includes(":::"))
-        return null;
-    const doubleIdx = s.indexOf("::");
-    if (doubleIdx !== -1 && s.indexOf("::", doubleIdx + 1) !== -1)
-        return null;
-    const [head, tail] = doubleIdx === -1 ? [s, ""] : [s.slice(0, doubleIdx), s.slice(doubleIdx + 2)];
-    const headParts = head ? head.split(":") : [];
-    const tailParts = tail ? tail.split(":") : [];
-    const gap = 8 - headParts.length - tailParts.length;
-    if (doubleIdx === -1 && headParts.length !== 8)
-        return null;
-    if (doubleIdx !== -1 && gap < 1)
-        return null;
-    const parts = [...headParts, ...Array(gap).fill("0"), ...tailParts];
-    if (parts.length !== 8)
-        return null;
-    const nums = parts.map((p) => {
-        if (/^[0-9a-f]{1,4}$/.test(p))
-            return parseInt(p, 16);
-        return NaN;
-    });
-    if (nums.some((n) => !Number.isFinite(n)))
-        return null;
-    return nums.map((n) => n.toString(16).padStart(4, "0")).join(":");
-}
-function ip6InCidr(ip, cidr) {
-    const [rangeRaw, bitsRaw] = cidr.split("/");
-    const a = ip6Expand(ip);
-    const b = ip6Expand(rangeRaw);
-    if (!a || !b)
-        return false;
-    const bits = bitsRaw === undefined ? 128 : Number(bitsRaw);
-    if (!Number.isFinite(bits) || bits < 0 || bits > 128)
-        return false;
-    const ah = a.split(":"), bh = b.split(":");
-    for (let i = 0; i < 8; i += 1) {
-        const remaining = bits - i * 16;
-        if (remaining <= 0)
-            return true;
-        if (remaining >= 16) {
-            if (ah[i] !== bh[i])
-                return false;
-            continue;
-        }
-        const mask = ((0xffff << (16 - remaining)) & 0xffff).toString(16).padStart(4, "0");
-        if ((parseInt(ah[i], 16) & parseInt(mask, 16)) !== (parseInt(bh[i], 16) & parseInt(mask, 16)))
-            return false;
-    }
-    return true;
-}
-const spfTxt = async (domain) => {
-    const rows = await dnsPromises.resolveTxt(domain).catch(() => []);
-    const flat = rows.map((r) => r.join("")).filter((t) => /^v=spf1(\s|$)/i.test(t.trim()));
-    if (!flat.length)
-        return null;
-    // RFC 7208 4.5: more than one v=spf1 record is a permerror, not a pick.
-    if (flat.length > 1)
-        throw new EmailError(`${domain} publishes ${flat.length} v=spf1 records, which is a permerror: a domain must have exactly one.`);
-    return flat[0].trim();
-};
-async function spfEval(domain, ip, depth = 0, lookups = 0, chain = []) {
-    const explain = [...chain];
-    if (depth > 10)
-        return { result: "permerror", domain, explain: [...explain, "include nested more than 10 deep, which is a permerror"], lookups };
-    if (lookups > 10)
-        return { result: "permerror", domain, explain: [...explain, "more than 10 DNS lookups, which is a permerror under RFC 7208 4.6.4"], lookups };
-    let record;
-    try {
-        record = await spfTxt(domain);
-    }
-    catch (e) {
-        return { result: "permerror", domain, explain: [...explain, e instanceof Error ? e.message : String(e)], lookups };
-    }
-    if (!record) {
-        return { result: depth === 0 ? "none" : "none", domain, explain: [...explain, `${domain} has no SPF record, so this include contributes no authorization`], lookups };
-    }
-    if (record.length > 255 * 10) {
-        return { result: "permerror", domain, explain: [...explain, "the record exceeds the 255 character limit, so it is a permerror"], lookups };
-    }
-    const terms = record.split(/\s+/).slice(1);
-    let used = lookups;
-    for (const rawTerm of terms) {
-        if (!rawTerm)
-            continue;
-        if (rawTerm.includes("="))
-            continue; // unknown modifier
-        // The qualifier is the leading + - ~ ? and belongs to the term; it must be
-        // captured, not skipped, or -all is never reached and every record that
-        // relies on it returns none instead of fail.
-        const qual = "+-~?".includes(rawTerm[0]) ? rawTerm[0] : "";
-        const term = qual ? rawTerm.slice(1) : rawTerm;
-        const [mechRaw, ...argParts] = term.split(":");
-        const mech = mechRaw.toLowerCase();
-        const arg = argParts.join(":");
-        const cidrSplit = arg.split("/");
-        const value = cidrSplit[0];
-        const range = cidrSplit[1];
-        const verdict = (hit, note) => {
-            if (hit === null)
-                return null;
-            if (hit) {
-                if (qual === "-")
-                    return { result: "fail", domain, explain: [...explain, note], lookups: used };
-                if (qual === "~")
-                    return { result: "softfail", domain, explain: [...explain, note], lookups: used };
-                if (qual === "?")
-                    return { result: "neutral", domain, explain: [...explain, note], lookups: used };
-                return { result: "pass", domain, explain: [...explain, note], lookups: used };
-            }
-            return null;
-        };
-        if (mech === "v")
-            continue;
-        if (mech === "ip4" || mech === "ip6") {
-            if (!value)
-                return { result: "permerror", domain, explain: [...explain, `${rawTerm} is missing an address`], lookups: used };
-            const cidr = range !== undefined ? `${value}/${range}` : value;
-            if (mech === "ip4") {
-                const hit = isIpv4(ip) ? ip4InCidr(ip, cidr) : null;
-                const v = verdict(hit, `ip4:${cidr} ${hit ? "matches" : "does not match"} ${ip}`);
-                if (v)
-                    return v;
-            }
-            else {
-                const hit = ip.includes(":") ? ip6InCidr(ip, cidr) : null;
-                const v = verdict(hit, `ip6:${cidr} ${hit ? "matches" : "does not match"} ${ip}`);
-                if (v)
-                    return v;
-            }
-            continue;
-        }
-        if (mech === "a" || mech === "mx") {
-            used += 1;
-            const d = value || domain;
-            let addrs = [];
-            if (mech === "a") {
-                addrs = [...(await dnsPromises.resolve4(d).catch(() => [])), ...(await dnsPromises.resolve6(d).catch(() => []))];
-            }
-            else {
-                const mxs = await dnsPromises.resolveMx(d).catch(() => []);
-                for (const mx of mxs.slice(0, 10)) {
-                    const h = mx.exchange.replace(/\.$/, "");
-                    addrs.push(...(await dnsPromises.resolve4(h).catch(() => [])), ...(await dnsPromises.resolve6(h).catch(() => [])));
-                }
-            }
-            if (!addrs.length) {
-                if (qual === "-")
-                    return { result: "fail", domain, explain: [...explain, `${mech}:${d} resolves to nothing, and a -qualifier makes that a hard fail`], lookups: used };
-                continue;
-            }
-            for (const addr of addrs) {
-                if (mech === "a") {
-                    const hit = isIpv4(addr) ? ip4InCidr(ip, `${addr}/${range ?? "32"}`) : ip6InCidr(ip, `${addr}/${range ?? "128"}`);
-                    const v = verdict(hit, `${mech}:${d} address ${addr} ${hit ? "matches" : "does not match"} ${ip}`);
-                    if (v)
-                        return v;
-                }
-                else if (mech === "mx") {
-                    const hit = isIpv4(addr) ? ip4InCidr(ip, `${addr}/${range ?? "32"}`) : ip6InCidr(ip, `${addr}/${range ?? "128"}`);
-                    const v = verdict(hit, `${mech}:${d} host address ${addr} ${hit ? "matches" : "does not match"} ${ip}`);
-                    if (v)
-                        return v;
-                }
-            }
-            continue;
-        }
-        if (mech === "include") {
-            used += 1;
-            const target = value.toLowerCase().replace(/\.$/, "");
-            if (!target)
-                return { result: "permerror", domain, explain: [...explain, "include: is missing a domain"], lookups: used };
-            const sub = await spfEval(target, ip, depth + 1, used, [...explain, `include:${target} evaluated`]);
-            used = sub.lookups;
-            if (sub.result === "pass") {
-                if (qual === "-")
-                    return { result: "fail", domain, explain: [...explain, `include:${target} returned pass, but the -qualifier makes it a hard fail`], lookups: used };
-                if (qual === "~")
-                    return { result: "softfail", domain, explain: [...explain, `include:${target} returned pass, qualified softfail`], lookups: used };
-                if (qual === "?")
-                    return { result: "neutral", domain, explain: [...explain, `include:${target} returned pass, qualified neutral`], lookups: used };
-                return { result: "pass", domain, explain: [...explain, `include:${target} evaluated to pass`], lookups: used };
-            }
-            if (sub.result === "temperror") {
-                return { result: "temperror", domain, explain: [...explain, `include:${target} hit a temporary DNS error`], lookups: used };
-            }
-            // permerror inside an include does not void the outer record, it just
-            // fails to authorize. Treat the include as not matching.
-            explain.push(`include:${target} evaluated to ${sub.result}, so it does not authorize`);
-            continue;
-        }
-        if (mech === "ptr") {
-            used += 1;
-            explain.push("ptr: is deprecated in RFC 7208 and many implementations ignore it, so it was not evaluated");
-            continue;
-        }
-        if (mech === "all") {
-            if (qual === "-")
-                return { result: "fail", domain, explain: [...explain, "reached -all without a match, so the sender is not authorized"], lookups: used };
-            if (qual === "~")
-                return { result: "softfail", domain, explain: [...explain, "reached ~all without a match, so the sender is only soft-failed"], lookups: used };
-            if (qual === "?")
-                return { result: "neutral", domain, explain: [...explain, "reached ?all without a match, which authorizes nothing and blocks nothing"], lookups: used };
-            return { result: "pass", domain, explain: [...explain, "reached +all, so anything that reached the end is authorized"], lookups: used };
-        }
-        return { result: "permerror", domain, explain: [...explain, `unknown mechanism "${mech}" in ${rawTerm}`], lookups: used };
-    }
-    return { result: "none", domain, explain: [...explain, "no mechanism matched and there is no all mechanism, so SPF returns none"], lookups: used };
-}
-/** Actually runs SPF for one sender IP against a domain's record, rather than only printing the record. */
-export async function spfEvaluate(args) {
-    const domain = (args.domain ?? "").trim().toLowerCase().replace(/^@/, "");
-    if (!domain)
-        throw new EmailError("Provide a domain, e.g. 'example.com'");
-    if (!DOMAIN_RE.test(domain))
-        throw new EmailError(`"${domain}" is not a valid domain name`);
-    const ip = String(args.ip ?? "").trim().replace(/^\[|\]$/g, "");
-    if (!ip)
-        throw new EmailError("Provide the sender IP address that SPF should be evaluated against, e.g. 203.0.113.10");
-    if (!isIpv4(ip) && !ip.includes(":")) {
-        throw new EmailError(`"${ip}" is not an IP address. SPF evaluates an IP, not a hostname; look up the address first with an A record lookup.`);
-    }
-    if (isIpv4(ip) && toIpv4(ip).some((n) => n > 255)) {
-        throw new EmailError(`"${ip}" is not a valid IPv4 address`);
-    }
-    const record = await spfTxt(domain).catch((e) => {
-        throw new EmailError(e instanceof Error ? e.message : String(e));
-    });
-    if (!record) {
-        return [
-            `SPF evaluation for ${domain} against ${ip}`,
-            "",
-            `${domain} publishes no v=spf1 record, so the result is none.`,
-            "",
-            "none means the domain makes no statement at all, which receivers treat differently from a deliberate fail: a domain with no SPF is checked for a From address in its own domain and can be a weaker signal to rely on than it looks. Add an SPF record.",
-        ].join("\n");
-    }
-    const v = await spfEval(domain, ip);
-    const verdict = {
-        pass: "PASS - this sender is authorized",
-        fail: "FAIL - this sender is not authorized, and receivers should reject it",
-        softfail: "SOFTFAIL - no match, treated as a weak failure; most receivers still deliver but score it down",
-        neutral: "NEUTRAL - the domain explicitly declines to say, which is the same as making no statement",
-        none: "NONE - no mechanism matched and there is no all mechanism",
-        permerror: "PERMERROR - the record is broken, so no result can be trusted",
-        temperror: "TEMPERROR - a temporary DNS failure interrupted the check",
-    };
-    const lines = [
-        `SPF evaluation for ${domain} against ${ip}`,
-        `record: ${record}`,
-        `result: ${v.result.toUpperCase()}`,
-        verdict[v.result],
-        `DNS lookups used: ${v.lookups} of the 10 allowed`,
-        "",
-        "Chain:",
-        ...v.explain.map((e) => `  - ${e}`),
-        "",
-    ];
-    if (v.result === "permerror") {
-        lines.push("A permerror is not a pass or a fail. It means the record is misconfigured, so receiving servers are meant to ignore SPF entirely for this domain, which removes the protection rather than enforcing it.");
-    }
-    else if (v.result === "pass") {
-        lines.push("This sender passes SPF. Alignment with the visible From domain is a separate DMARC check, so a pass here is not on its own proof that the message is legitimate.");
-    }
-    else if (v.result === "fail") {
-        lines.push("A hard fail here is what makes DMARC reject work: this is the result a spoofer produces, and it is the outcome a correct -all should give for everyone else.");
-    }
-    if (v.lookups > 10) {
-        lines.push("", "The lookup count is over the RFC 7208 limit of 10. Receivers must treat that as a permerror, so a record that authorizes correctly in this evaluation may still be ignored in practice.");
-    }
-    if (args.include_record === false)
-        lines.splice(1, 1);
-    lines.push("", "This is SPF only. Check the DMARC policy for the domain to know whether a failure here actually rejects the message.");
-    return lines.join("\n");
-}
 /** Purely local: derives the plus-tag and dot-stripped forms of an address so alias-based duplicates can be spotted. */
 export async function aliasVariants(args) {
     const email = String(args.email ?? "").trim().toLowerCase();

package/dist/server.js

@@ -1,7 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-import { checkDomain, disposableDomains, extractEmails, normalizeEmail, validateBatch, validateEmail, emailAuthRecords, mxHealth, correctTypo, smtpMailboxCheck, spfEvaluate, aliasVariants } from "./api.js";
-import { premiumRequired } from "./license.js";
+import { checkDomain, disposableDomains, extractEmails, normalizeEmail, validateBatch, validateEmail, emailAuthRecords, mxHealth, correctTypo, aliasVariants } from "./api.js";
 const text = (value) => ({ content: [{ type: "text", text: value }] });
 const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
@@ -21,7 +20,7 @@ export function createServer() {
             return text(await validateEmail(args));
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     server.registerTool("validate_batch", {
@@ -36,7 +35,7 @@ export function createServer() {
             return text(await validateBatch(args));
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     server.registerTool("check_domain", {
@@ -51,7 +50,7 @@ export function createServer() {
             return text(await checkDomain(args));
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     server.registerTool("normalize_email", {
@@ -67,7 +66,7 @@ export function createServer() {
             return text(normalizeEmail(args));
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     server.registerTool("extract_emails", {
@@ -82,7 +81,7 @@ export function createServer() {
             return text(extractEmails(args));
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     server.registerTool("disposable_domains", {
@@ -97,7 +96,7 @@ export function createServer() {
             return text(disposableDomains(args));
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     server.registerTool("email_auth_records", {
@@ -112,7 +111,7 @@ export function createServer() {
             return text(await emailAuthRecords(args));
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     server.registerTool("mx_health", {
@@ -127,7 +126,7 @@ export function createServer() {
             return text(await mxHealth(args));
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     server.registerTool("correct_typo", {
@@ -142,7 +141,7 @@ export function createServer() {
             return text(correctTypo(args));
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     server.registerTool("smtp_mailbox_check", {
@@ -155,16 +154,12 @@ export function createServer() {
         }),
         annotations: READ_ONLY,
     }, async (args) => {
-        // ---- paywall: smtp_mailbox_check ----
-        const paywallMessage = await premiumRequired("smtp_mailbox_check");
-        if (paywallMessage)
-            return { content: [{ type: "text", text: paywallMessage }], isError: true };
-        // ---- paywall: end ----
+        // TODO: implement check locally (paywall removed)
         try {
-            return text(await smtpMailboxCheck(args));
+            return textError("Not yet implemented: check");
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     server.registerTool("spf_evaluate", {
@@ -177,16 +172,12 @@ export function createServer() {
         }),
         annotations: READ_ONLY,
     }, async (args) => {
-        // ---- paywall: spf_evaluate ----
-        const paywallMessage = await premiumRequired("spf_evaluate");
-        if (paywallMessage)
-            return { content: [{ type: "text", text: paywallMessage }], isError: true };
-        // ---- paywall: end ----
+        // TODO: implement evaluate locally (paywall removed)
         try {
-            return text(await spfEvaluate(args));
+            return textError("Not yet implemented: evaluate");
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     server.registerTool("alias_variants", {
@@ -202,7 +193,7 @@ export function createServer() {
             return text(await aliasVariants(args));
         }
         catch (e) {
-            return textError(error(e));
+            return textError(String(e));
         }
     });
     return server;

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.3",
+  "version": "1.0.4",
   "type": "module",
   "repository": {
     "type": "git",
@@ -41,4 +41,4 @@
   "engines": {
     "node": ">=20"
   }
-}
+}

package/dist/license.js

@@ -1,79 +0,0 @@
-// Premium tools on this server need a license key bought from MCP Marketplace.
-// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
-// that is not listed in PREMIUM keeps working without a key.
-const SLUG = "email-validator-mcp";
-// Tools that need a key. Everything else is free.
-const PREMIUM = new Set([
-    "smtp_mailbox_check",
-    "spf_evaluate",
-]);
-const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`;
-// The license check calls the marketplace's verify endpoint directly instead of
-// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
-// check it makes is rejected by Supabase before it reaches the function. The
-// publishable key below is public by design - it ships in mcp-marketplace.io's
-// own JavaScript and only ever reaches their licence check.
-const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key";
-const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h";
-const OK_CACHE_MS = 60 * 60 * 1000;
-const BAD_CACHE_MS = 60 * 1000;
-const seen = new Map();
-const REASONS = {
-    missing_key: "no key is set",
-    invalid_format: "that key is not a valid MCP Marketplace key",
-    not_found: "that key was not found",
-    revoked: "that key has been revoked",
-    rotated: "that key was rotated, use your new one",
-    expired: "that key has expired, renew it",
-    rate_limited: "there were too many checks just now, try again shortly",
-    network_error: "the license server could not be reached",
-};
-function blocked(tool, reason) {
-    const why = REASONS[reason] ?? `the license server answered "${reason}"`;
-    return `"${tool}" needs a license key, but ${why}. ` +
-        `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`;
-}
-async function verify(key) {
-    const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
-        method: "POST",
-        headers: {
-            apikey: PUBLISHABLE_KEY,
-            Authorization: `Bearer ${PUBLISHABLE_KEY}`,
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify({ key, slug: SLUG }),
-        // an unusable key answers 400 with a JSON body, so read the body either way
-        signal: AbortSignal.timeout(15000),
-    });
-    const data = (await res.json());
-    if (typeof data?.valid !== "boolean")
-        return { valid: false, reason: "unexpected_response" };
-    return data;
-}
-/**
- * Returns null when the caller may run the tool, or a short message telling
- * them how to get a key.
- *
- * A good key is remembered for an hour, so a busy session does not hit the
- * license server on every call and keeps working through a brief outage.
- */
-export async function premiumRequired(tool) {
-    if (!PREMIUM.has(tool))
-        return null;
-    const key = process.env.MCP_LICENSE_KEY;
-    if (!key)
-        return blocked(tool, "missing_key");
-    const hit = seen.get(key);
-    if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
-        return hit.valid ? null : blocked(tool, hit.reason ?? "invalid");
-    }
-    let result;
-    try {
-        result = await verify(key);
-    }
-    catch {
-        result = { valid: false, reason: "network_error" };
-    }
-    seen.set(key, { ...result, at: Date.now() });
-    return result.valid ? null : blocked(tool, result.reason ?? "invalid");
-}