Developers & AI

MCP server

Let Claude, ChatGPT, Cursor and other AI assistants check your domain and move your verification forward, step by step.

MCP (Model Context Protocol) is how AI assistants use tools. Our MCP server gives your assistant every VerifiedInbox capability, from the first free check to certificate renewals.

The easiest way to start: paste this into your assistant.

Add a verified VMC mark to my email domain using getverifiedinbox.com/get-started.md

The get-started guide tells your assistant everything else.

Endpoint#

URL: https://api.getverifiedinbox.com/mcp
Transport: Streamable HTTP, JSON responses. Protocol versions 2025-11-25, 2025-06-18, 2025-03-26.
Every tool wraps one or more API operations, and its arguments are generated from the OpenAPI schema, so they always match the API.

Connecting#

Mode	How	Can do
Anonymous	Connect with no credentials	All free tools. `start_application` returns a `guest_token` to pass to later calls.
OAuth	Clients that support MCP sign-in open a sign-in window when an account tool is first used	Everything your role allows
API key	`Authorization: Bearer vi_live_…` or `vi_test_…` (API keys)	One organization and environment

Claude#

claude.ai and Claude Desktop: Settings → Connectors → Add custom connector, URL https://api.getverifiedinbox.com/mcp.

Claude Code:

bash

claude mcp add --transport http verifiedinbox https://api.getverifiedinbox.com/mcp

Cursor#

~/.cursor/mcp.json (or .cursor/mcp.json in a project):

json

{
  "mcpServers": {
    "verifiedinbox": { "url": "https://api.getverifiedinbox.com/mcp" }
  }
}

With an API key, add "headers": { "Authorization": "Bearer vi_test_…" }.

ChatGPT#

Add a custom connector with the URL https://api.getverifiedinbox.com/mcp (Settings → Apps & Connectors; some plans require developer mode).

More clients and details: get-started.md.

Your progress never resets#

Everything is saved on our servers under a stable application_id.
Without an account, your assistant keeps the guest_token (valid 30 days from last use). In a new conversation it calls list_applications or get_application and continues.
create_resume_link gives you a one-time link (24 hours) to continue in your browser.
After you sign in, claim_application moves the draft into your account.
Every response includes next_actions, so your assistant always knows what's next.

Tools#

Each tool does the same thing as one or more API operations. The table is generated from the OpenAPI schema and the server's tool list, so it always matches what your assistant sees. Free tools accept guest_token (to continue an anonymous draft); account tools accept environment (live or test).

Tool	What it does	Arguments	Access	API operations
`get_started`	Explains the whole process (free checks, paid setup, certificate, go-live), pricing, what the user must do themselves, and how to continue later. Call this first if you're new to VerifiedInbox.	—	Free	`GET /v1/meta`
`check_domain`	Free, instant check of an email domain: can it get a verified logo? Detects shared providers that can't be used (gmail.com, outlook.com…), unregistered domains, the mailbox provider and a DMARC/BIMI summary. Accepts a domain, URL or email address.	`domain`*	Free	`POST /v1/checks/domain`
`check_email_security`	Free full inspection of SPF, DKIM, DMARC and BIMI with plain-English findings and exact fixes. Uses the domain's authoritative nameservers (sees changes within seconds).	`domain`*, `dkim_selectors`	Free	`POST /v1/checks/email-auth`
`start_application`	Starts the verification for a domain, or returns the existing one. Anonymous callers receive a guest_token — tell the user to keep it (with the application_id) to continue in a later conversation. Background checks start immediately. Returns the full state and next_actions.	`domain`*, `environment`, `guest_token`	Free	`POST /v1/applications`
`list_applications`	Lists the verifications visible to the caller (guest drafts for a guest_token, or the account's domains).	`environment`, `guest_token`	Free	`GET /v1/applications`
`get_application`	Full current state: separate outcomes (eligibility, payment, business, ownership, logo, trademark, certificate, BIMI, inbox display), the 11 wizard steps with status, running background work, and next_actions (what to do next and which tool to use). Call this whenever you need to know where things stand.	`application_id`*, `guest_token`	Free	`GET /v1/applications/{application_id}` `GET /v1/applications/{application_id}/next-steps`
`complete_step`	Moves the verification to the next step once the current step's required items are met (each step lists them in `requirements`; status `ready` means it can be completed). Background work never completes steps; this does, on the user's behalf. Also re-confirms an earlier step marked `attention` after it was fixed. Confirm with the user before completing a step they haven't reviewed.	`application_id`, `step`, `guest_token`	Free	`POST /v1/applications/{application_id}/steps/{step}/complete`
`set_email_usage`	Ask the user how email is used on their domain and record the answer: none (new domain, no email yet), low (little email) or active (email sent every day). none/low can switch on full protection (block all) right away; active should follow the staged rollout, though the user may skip ahead. Returns the email security report with the recommended DMARC record.	`application_id`, `email_usage`, `guest_token`	Free	`PUT /v1/applications/{application_id}/email-usage`
`recheck_email_security`	Re-checks SPF, DKIM and DMARC for the application right now (after the user published records) and returns the report plus the DMARC rollout plan: every stage's exact record, what to monitor and what happens to email at that stage.	`application_id`*, `guest_token`	Free	`POST /v1/applications/{application_id}/email-health/check`
`submit_logo`	Provide the company logo: SVG text (preferred), a URL to an SVG, or use_discovered=true to use the logo found on the company website. The original is kept untouched; an inbox-ready SVG Tiny P/S version is produced automatically and a US trademark search starts.	`application_id`*, `guest_token`, `svg`, `url`, `use_discovered`	Free	`PUT /v1/applications/{application_id}/logo`
`get_logo_status`	Logo processing status, compliance issues, the list of changes made for the inbox version (lossy ones flagged), visual difference, and preview URLs. Also lists logos discovered on the website.	`application_id`*, `guest_token`	Free	`GET /v1/applications/{application_id}/logo` `GET /v1/applications/{application_id}/logo-candidates`
`search_trademark`	Starts (or re-runs) the USPTO trademark search, or verifies a specific US serial/registration number the user provides. A registered trademark matching the logo unlocks the blue checkmark (VMC). Rate-limited for anonymous users.	`application_id`*, `guest_token`, `mark_text`, `owner_name`, `serial_or_registration_number`	Free	`POST /v1/applications/{application_id}/trademark/search` `POST /v1/applications/{application_id}/trademark/claim`
`get_trademark_status`	Trademark search result: matched registration (with similarity to the logo), candidates, and what it means.	`application_id`*, `guest_token`	Free	`GET /v1/applications/{application_id}/trademark`
`get_eligibility`	Outcome: vmc_eligible (logo + blue checkmark), cmc_eligible (logo only, no checkmark), not_currently_eligible (with evidence, estimated date and next steps such as the trademark filing service at trademark@getverifiedinbox.com), or assessing.	`application_id`*, `guest_token`	Free	`GET /v1/applications/{application_id}/eligibility`
`get_estimate`	Itemized yearly price before payment: plan (CMC $899 or VMC $1,499 per domain) plus the certificate issuer's fee (pass-through, no markup, ~$750–$1,750). Full refund if issuance is rejected.	`application_id`*, `guest_token`, `product`	Free	`GET /v1/applications/{application_id}/estimate`
`watch_eligibility`	Emails the user when the domain becomes eligible (we re-check daily). Use for not_currently_eligible outcomes.	`application_id`, `email`, `guest_token`	Free	`POST /v1/applications/{application_id}/eligibility/watch`
`create_resume_link`	Creates a one-time link (valid 24h) that opens this verification in the web app — useful for visual steps like reviewing the logo or copying DNS records. Optionally emails it.	`application_id`*, `email`, `guest_token`	Free	`POST /v1/applications/{application_id}/resume-links`
`explain_term`	Plain-English explanation of a term such as BIMI, VMC, CMC, DMARC, SPF, DKIM, selector, alignment, SVG Tiny P/S.	`term`*	Free	`GET /v1/glossary/{term}`
`contact_support`	Sends a message to the VerifiedInbox team (a human replies by email within one business day). Include the user's email.	`message`*, `application_id`, `email`, `guest_token`, `kind`, `name`	Free	`POST /v1/support`
`send_feedback`	Sends feedback or a feature request to the VerifiedInbox team.	`message`*, `email`, `guest_token`, `kind`	Free	`POST /v1/support`
`get_account`	Organizations, environment (live/test), every domain with its status and pending actions, and recent orders.	`environment`	Account	`GET /v1/me` `GET /v1/applications` `GET /v1/orders`
`claim_application`	Atomically moves a guest draft (application_id + guest_token) into the signed-in account. If the account already has the domain, keeps the more advanced one and reports which.	`application_id`, `guest_token`, `environment`	Account (`applications:write`)	`POST /v1/applications/{application_id}/claim`
`create_checkout`	Creates a Stripe checkout link for the chosen plan. Only a human can pay: give the link to the user, and confirm the price first (see get_estimate).	`application_id`, `product`, `environment`, `idempotency_key`	Account (`billing:write`)	`POST /v1/applications/{application_id}/checkout`
`submit_business_details`	Legal company details + the applicant (starts business registration verification). Requires payment. jurisdiction is the US state code like us_de.	`address`, `applicant`, `application_id`, `jurisdiction`, `legal_name`*, `authority_attested`, `environment`, `registration_number`	Account (`applications:write`)	`PUT /v1/applications/{application_id}/business`
`get_business_status`	Business verification status, matched registry record and applicant authority.	`application_id`*, `environment`	Account	`GET /v1/applications/{application_id}/business`
`approve_logo`	Approves the exact inbox-ready logo the user reviewed (pass converted_sha256 from get_logo_status). Ask the user to look at the preview first (create_resume_link helps).	`application_id`, `converted_sha256`, `environment`	Account (`applications:write`)	`POST /v1/applications/{application_id}/logo/approve`
`get_dns_records`	Every DNS record the user must add (ownership TXT, DMARC at the right rollout stage, BIMI) with copy-paste values and live status from the authoritative nameservers. The user adds them at their DNS provider.	`application_id`*, `environment`	Account	`GET /v1/applications/{application_id}/dns`
`verify_dns`	Re-checks the DNS records right now (and watches closely for the next minutes).	`application_id`*, `environment`	Account	`POST /v1/applications/{application_id}/dns/verify`
`verify_dkim_selectors`	Checks DKIM selectors the user provides. Needed only when the common selectors we try automatically found no key; the user's email provider shows the selector in its DKIM settings.	`application_id`, `selectors`, `guest_token`	Free	`POST /v1/applications/{application_id}/dkim-selectors`
`create_test_message`	Returns an address the user sends a real email to; we then report SPF/DKIM/DMARC alignment on that actual message.	`application_id`*, `environment`	Account	`POST /v1/applications/{application_id}/test-messages`
`get_test_message_result`	Result of the test email: SPF, DKIM, DMARC alignment and findings.	`application_id`, `test_message_id`, `environment`	Account	`GET /v1/applications/{application_id}/test-messages/{test_message_id}`
`get_certificate`	Certificate status timeline, prerequisites (with the step that fixes each), the latest final check, actions the issuer needs from the user, validity and renewal dates.	`application_id`*, `environment`	Account	`GET /v1/applications/{application_id}/certificate`
`run_final_check`	Re-verifies live everything the certificate issuer checks (domain, email protection, logo, company, trademark, DNS records). Runs automatically before the order is submitted and daily during the issuer's review; anything that fails marks its step `attention` and holds the order.	`application_id`*, `environment`	Account	`POST /v1/applications/{application_id}/certificate/check`
`order_certificate`	Submits the certificate order (normally automatic once prerequisites are met). Safe to call repeatedly.	`application_id`*, `environment`, `idempotency_key`	Account (`certificates:write`)	`POST /v1/applications/{application_id}/certificate/order`
`reissue_certificate`	Requests a reissue (e.g. after a logo change). Re-checks domain ownership first.	`application_id`, `reason`, `environment`, `idempotency_key`	Account (`certificates:write`)	`POST /v1/applications/{application_id}/certificate/reissue`
`renew_certificate`	Starts the renewal early (renewal is otherwise automatic 45 days before expiry).	`application_id`*, `environment`, `idempotency_key`	Account (`certificates:write`)	`POST /v1/applications/{application_id}/certificate/renew`
`revoke_certificate`	PERMANENTLY revokes the certificate; the logo disappears from inboxes. Only with explicit user confirmation: confirm must be exactly "REVOKE ".	`application_id`, `confirm`, `reason`*, `environment`, `idempotency_key`	Account (`certificates:write`)	`POST /v1/applications/{application_id}/certificate/revoke`
`confirm_inbox_display`	Records that the user saw their logo (and checkmark for VMC) in a mailbox such as Gmail — the final 'display observed' outcome.	`application_id`*, `environment`, `mailbox`, `observed`	Account (`applications:write`)	`POST /v1/applications/{application_id}/inbox-display`
`list_orders`	Orders and payments for the account.	`environment`	Account	`GET /v1/orders` `GET /v1/orders/{order_id}`

* required.

Resources and prompts#

verifiedinbox://get-started — the full get-started guide.
verifiedinbox://glossary — the glossary.
Prompt verify_my_domain(domain) — starts the guided flow.

Errors#

Tool failures return isError: true with a plain-English message and next_actions (for example: sign in, pay, add a DNS record). Rate limits include retry_after_seconds.

What your assistant won't do#

By design, assistants can't pay, can't change your DNS, and need your explicit confirmation to revoke a certificate. You approve your logo yourself. See Security.