
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
Mail7 MCP server - email validation, SPF and full domain mail-config checks as tools for AI assistants.
Email validation for AI assistants. This is an MCP server that gives Claude, Cursor, Windsurf, Cline and any other MCP client four tools: verify a single address, clean a list, check a domain's SPF record, and audit a domain's whole mail configuration.
Honest by design: Mail7 answers Valid, Not Valid or Unknown, and the tool descriptions tell the model in plain words that Unknown means "could not be verified", not "bad". An assistant using this server will not silently delete addresses it could not check.
Node 18+ required. No install step - the server runs through npx.
Claude Code
claude mcp add mail7 --env MAIL7_API_KEY=your_key -- npx -y mail7-mcp
Claude Desktop (claude_desktop_config.json), Cursor (~/.cursor/mcp.json),
and most other clients use the same shape:
{
"mcpServers": {
"mail7": {
"command": "npx",
"args": ["-y", "mail7-mcp"],
"env": { "MAIL7_API_KEY": "your_key" }
}
}
}
Get an API key at mail7.net/account. The server also runs without one, but anonymous callers are limited to 5 checks per minute and a 25-address free bulk sample - not enough for real work.
| Variable | Default | Purpose |
|---|---|---|
MAIL7_API_KEY | - | Raises rate limits, unlocks full bulk validation |
MAIL7_BASE_URL | https://mail7.net/api | Override the API endpoint |
| Tool | What it does |
|---|---|
validate_email | One address: syntax, MX, disposable-domain check, live SMTP mailbox probe |
validate_emails | Up to 50 addresses per call, with a Valid / Not Valid / Unknown summary |
check_domain | Full mail-config audit graded A-F: MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC, BIMI |
check_spf | SPF record, mechanisms, lookup count and misconfigurations |
Ask your assistant things like:
sales@acme.com a real mailbox?"ourdomain.com."validate_email and validate_emails return structured content alongside the text, so
a client that supports structured tool output gets typed fields:
{
"email": "user@example.com",
"status": "Unknown", // "Valid" | "Not Valid" | "Unknown"
"valid": null, // true | false | null (null = Unknown)
"formatValid": true,
"mxValid": true,
"smtpValid": false,
"is_disposable": false,
"details": "Server accepts all addresses (catch-all) - status unknown"
}
check_domain returns a compact graded summary with a fix for every problem. To see the
raw records of one part, call it again with section set to mx, spf, dkim,
dmarc, mta_sts, tls_rpt, dnssec, bimi or domain.
Every address is a live SMTP conversation, so a check takes seconds, not milliseconds.
validate_emails caps at 50 addresses per call on purpose - call it repeatedly with the
next chunk rather than pushing a whole file through one call, and never run two calls in
parallel (the API serialises one bulk job per client).
npm install
npm run build # -> dist/
node dist/index.js # speaks MCP over stdio
MIT. Part of the Mail7 integrations.
FAQs
Mail7 MCP server - email validation, SPF and full domain mail-config checks as tools for AI assistants.
We found that mail7-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.