MCP server

MCP (Model Context Protocol) is how AI assistants use tools. Our MCP server gives your assistant every VerifiedInbox capability, from the first free check to certificate renewals.

The easiest way to start: paste this into your assistant.

Add a verified VMC mark to my email domain using verifiedinbox.ai/get-started.md

The get-started guide tells your assistant everything else.

Endpoint#

• URL: https://api.verifiedinbox.ai/mcp
• Transport: Streamable HTTP, JSON responses. Protocol versions 2025-11-25, 2025-06-18, 2025-03-26.
• Every tool wraps one or more API operations, and its arguments are generated from the OpenAPI schema, so they always match the API.

Connecting#

Claude#

claude.ai and Claude Desktop: Settings → Connectors → Add custom connector, URL https://api.verifiedinbox.ai/mcp.

Claude Code:

claude mcp add --transport http verifiedinbox https://api.verifiedinbox.ai/mcp

Cursor#

~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "verifiedinbox": { "url": "https://api.verifiedinbox.ai/mcp" }
  }
}

With an API key, add "headers": { "Authorization": "Bearer vi_test_…" }.

ChatGPT#

Add a custom connector with the URL https://api.verifiedinbox.ai/mcp (Settings → Apps & Connectors; some plans require developer mode).

More clients and details: get-started.md.

Your progress never resets#

• Everything is saved on our servers under a stable application_id.
• Without an account, your assistant keeps the guest_token (valid 30 days from last use). In a new conversation it calls list_applications or get_application and continues.
• create_resume_link gives you a one-time link (24 hours) to continue in your browser.
• After you sign in, claim_application moves the draft into your account.
• Every response includes next_actions, so your assistant always knows what's next.

Tools#

Each tool does the same thing as one or more API operations. The table is generated from the OpenAPI schema and the server's tool list, so it always matches what your assistant sees. Free tools accept guest_token (to continue an anonymous draft); account tools accept environment (live or test).

get_started#

Explains the whole process (free checks, paid setup, certificate, go-live), pricing, what the user must do themselves, and how to continue later. Call this first if you're new to VerifiedInbox.

check_domain#

Free, instant check of an email domain: can it get a verified logo? Detects shared providers that can't be used (gmail.com, outlook.com…), unregistered domains, the mailbox provider and a DMARC/BIMI summary. Accepts a domain, URL or email address.

check_email_security#

Free full inspection of SPF, DKIM, DMARC and BIMI with plain-English findings and exact fixes. Uses the domain's authoritative nameservers (sees changes within seconds).

start_application#

Starts the verification for a domain, or returns the existing one. Anonymous callers receive a guest_token — tell the user to keep it (with the application_id) to continue in a later conversation. Background checks start immediately. Returns the full state and next_actions.

list_applications#

Lists the verifications visible to the caller (guest drafts for a guest_token, or the account's domains).

get_application#

Full current state: separate outcomes (eligibility, payment, business, ownership, logo, trademark, certificate, BIMI, inbox display), the 11 wizard steps with status, running background work, and next_actions (what to do next and which tool to use). Call this whenever you need to know where things stand.

complete_step#

Moves the verification to the next step once the current step's required items are met (each step lists them in requirements; status ready means it can be completed). Background work never completes steps; this does, on the user's behalf. Also re-confirms an earlier step marked attention after it was fixed. Confirm with the user before completing a step they haven't reviewed.

set_email_usage#

Ask the user how email is used on their domain and record the answer: none (new domain, no email yet), low (only their mailbox provider, e.g. Google Workspace, sends email) or active (several tools send email: newsletters, billing, support…). none/low can block fake emails right away; active should follow the staged rollout, though the user may skip ahead. The email security step needs DMARC published with a report address (watch mode is enough); filtering or blocking is required by the DNS step. Returns the email security report with the recommended DMARC record.

set_dmarc_report_address#

Sets the email address for daily DMARC reports, used in every suggested DMARC record (rua=). Ask the user for a mailbox they read (or a DMARC reporting service); by default reports go to dmarc@, which must exist. Pass null to go back to the default. The user still publishes the record.

recheck_email_security#

Re-checks SPF, DKIM and DMARC for the application right now (after the user published records) and returns the report plus the DMARC rollout plan: every stage's exact record, what to monitor and what happens to email at that stage.

submit_logo#

Provide the company logo: SVG text (preferred), a URL to an SVG, or use_discovered=true to use the logo found on the company website. The original is kept untouched; an inbox-ready SVG Tiny P/S version is produced automatically and a US trademark search starts.

get_logo_status#

Logo processing status, compliance issues, the list of changes made for the inbox version (lossy ones flagged), visual difference, and preview URLs. Also lists logos discovered on the website.

search_trademark#

Starts (or re-runs) the USPTO trademark search, or verifies a specific US serial/registration number the user provides. A registered trademark matching the logo unlocks the blue checkmark (VMC). Rate-limited for anonymous users.

get_trademark_status#

Trademark search result: matched registration (with similarity to the logo), candidates, and what it means.

get_eligibility#

Outcome: vmc_eligible (logo + blue checkmark), cmc_eligible (logo only, no checkmark), not_currently_eligible (with evidence, estimated date and next steps such as the trademark filing service at trademark@getverifiedinbox.com), or assessing.

get_estimate#

Itemized yearly price before payment: plan (CMC $899 or VMC $1,499 per domain) plus the certificate issuer's fee (pass-through, no markup, ~$750–$1,750). Full refund if issuance is rejected.

watch_eligibility#

Emails the user when the domain becomes eligible (we re-check daily). Use for not_currently_eligible outcomes.

create_resume_link#

Creates a one-time link (valid 24h) that opens this verification in the web app — useful for visual steps like reviewing the logo or copying DNS records. Optionally emails it.

explain_term#

Plain-English explanation of a term such as BIMI, VMC, CMC, DMARC, SPF, DKIM, selector, alignment, SVG Tiny P/S.

contact_support#

Sends a message to the VerifiedInbox team (a human replies by email within one business day). Include the user's email.

send_feedback#

Sends feedback or a feature request to the VerifiedInbox team.

get_account#

Organizations, environment (live/test), every domain with its status and pending actions, and recent orders.

claim_application#

Atomically moves a guest draft (application_id + guest_token) into the signed-in account. If the account already has the domain, keeps the more advanced one and reports which.

create_checkout#

Creates a Stripe checkout link for the chosen plan. Only a human can pay: give the link to the user, and confirm the price first (see get_estimate).

submit_business_details#

Legal company details + the applicant (starts business registration verification). Requires payment. jurisdiction is the US state code like us_de.

get_business_status#

Business verification status, matched registry record and applicant authority.

approve_logo#

Approves the exact inbox-ready logo the user reviewed (pass converted_sha256 from get_logo_status). Ask the user to look at the preview first (create_resume_link helps).

get_dns_records#

Every DNS record the user must add (ownership TXT, DMARC at the right rollout stage, BIMI) with copy-paste values and live status from the authoritative nameservers. The user adds them at their DNS provider.

verify_dns#

Re-checks the DNS records right now (and watches closely for the next minutes).

verify_dkim_selectors#

Checks DKIM selectors the user provides. Needed only when the common selectors we try automatically found no key; the user's email provider shows the selector in its DKIM settings.

create_test_message#

Returns an address the user sends a real email to; we then report SPF/DKIM/DMARC alignment on that actual message. Free. Also finds the DKIM key when the common selectors didn't: an aligned signature on the test email is added to the email security report.

get_test_message_result#

Result of the test email: SPF, DKIM, DMARC alignment and findings.

get_certificate#

Certificate status timeline, prerequisites (with the step that fixes each), the latest final check, actions the issuer needs from the user, validity and renewal dates.

run_final_check#

Re-verifies live everything the certificate issuer checks (domain, email protection, logo, company, trademark, DNS records). Runs automatically before the order is submitted and daily during the issuer's review; anything that fails marks its step attention and holds the order.

order_certificate#

Submits the certificate order (normally automatic once prerequisites are met). Safe to call repeatedly.

reissue_certificate#

Requests a reissue (e.g. after a logo change). Re-checks domain ownership first.

renew_certificate#

Starts the renewal early (renewal is otherwise automatic 45 days before expiry).

revoke_certificate#

PERMANENTLY revokes the certificate; the logo disappears from inboxes. Only with explicit user confirmation: confirm must be exactly "REVOKE ".

confirm_inbox_display#

Records that the user saw their logo (and checkmark for VMC) in a mailbox such as Gmail — the final 'display observed' outcome.

list_orders#

Orders and payments for the account.

* required.

Resources and prompts#

• verifiedinbox://get-started: the full get-started guide.
• verifiedinbox://glossary: the glossary.
• Prompt verify_my_domain(domain): starts the guided flow.

Errors#

Tool failures return isError: true with a clear message and next_actions (for example: sign in, pay, add a DNS record). Rate limits include retry_after_seconds.

What your assistant won't do#

By design, assistants can't pay, can't change your DNS, and need your explicit confirmation to revoke a certificate. You approve your logo yourself. See Security.