Cold Leads MCP server
Cold Leads MCP server enables B2B outreach CRM operations such as email verification, lead search, contact/conversation/template/campaign management, lead intelligence, website capture, and keyless agent onboarding.
verify_email: verify an address (syntax, disposable, role, MX, SMTP; 1 credit).search_leads: find contacts in your CRM by company domain (free).Contact management: list, import (up to 100 rows), update contacts.
Conversations: read synced threads, send messages after explicit approval.
Templates & campaigns: list/save templates, create/launch campaign drafts after human confirmation.
Lead intelligence: get context, next actions, schedule follow-ups, view agent activity.
Workspace & website: get info, set up website lead capture.
Agent onboarding: provision account, get Stripe payment link, check status to retrieve API key once after payment.
Hosted demo server available without an API key (sample workspace, no sending).
Generates Stripe payment links for Cold Leads Business plan subscriptions during agent-assisted account provisioning, allowing the human owner to complete payment on Stripe.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Cold Leads MCP serververify sarah@acme.com and check if it's catch-all"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Cold Leads MCP server
Model Context Protocol server for Cold Leads, the B2B outreach CRM. It exposes the hosted workspace tools to local MCP clients (Claude Desktop, Claude Code, Cursor, Windsurf, VS Code): contacts, imports, synced conversations, templates, campaigns, website capture, lead search, and verification. Without an API key, it can also ask the human owner to approve a subscription.
npx -y @coldleads/mcp-serverTry it without a key
The hosted demo server has the same tools over a sample workspace (fictional contacts on .example domains). It never sends e-mail and uses no credits:
claude mcp add --transport http coldleads-demo https://coldleads.app/api/mcp/demoThen ask: "Verify these three contacts and prepare outreach drafts. Don't send anything until I approve. Jana Dvořák jana.dvorak@ridgeline.example, info@harborlane.example, Piotr Kowalski piotr@quillmetrics.example". Any client that supports remote (Streamable HTTP) MCP servers can use the same URL. A complete agent built on it: cold-leads-ai-sales-agent.
Demo limits:
Limit | Value |
Session | 24 hours from its start (not extended), visible only to that session |
Contacts | 10, including the 4 sample contacts |
Templates | 1 of your own (besides the sample template; update it with |
Campaign drafts | 1 |
Text length | notes 100 characters, template body 500, message 200 |
Requests | 120 per minute and 20 new sessions per hour per IP address |
Verification | sample results for the three demo prospects; other addresses get syntax, disposable-domain and role checks only (no MX or mailbox check) |
Sending | never: |
Related MCP server: Email Verifier MCP Server
Tools
Tool | What it does | Cost |
| Verification of one address: syntax, disposable domain, role account and MX records, plus an SMTP mailbox and catch-all check when Cold Leads can open an SMTP connection to the recipient's mail server (otherwise | 1 credit |
| Contacts already in your Cold Leads CRM for a company domain, with an optional role keyword: e-mail, name, company, stage, tags, verification status and a | free |
| List, import up to 100 parsed contact rows per call, and update contacts in your own workspace. Imports deduplicate, skip global DNC entries and do not send e-mail. CSV/XLSX parsing is done by the assistant. | free |
| Read mailbox-synced contact conversations or send one e-mail after explicit approval of recipient and content. Opt-outs, bounces and DNC are blocked. | sender/provider limits |
| Review, create and update workspace templates; content screening applies. | free |
| Inspect campaigns, prepare drafts and audience estimates, and launch only after human review and explicit confirmation. | plan and recipient limits |
| Everything known about one lead (contactability, history, last reply class, next action); the queue of replies waiting for an answer and due follow-ups; set a contact's next action (never sends e-mail); the audit log of API and MCP calls. | free |
| Read non-secret workspace/mailbox status or generate a public-only form key/snippet for your website. Website submissions are inquiry leads, not automatic cold-outreach consent. | free |
| For agents without a key: creates a pending account for the human owner and returns a Stripe payment link for the Business plan. The human decides and pays. | — |
| After the owner paid: returns the API key exactly once (with the | — |
Responses are compact JSON in a text block. An illustrative result for an address whose mailbox could not be checked (example.com is reserved for documentation):
{"status":"success","email":"jane.doe@example.com","validity":"valid","catch_all":null,"score":75,"reasons":["smtp_unreachable"],"disposable":false,"role_account":false}Errors come back as tool results with isError: true, for example {"status":"error","error":"rate_limited","message":"…","http_status":429,"retry_after_seconds":60}.
Requirements
A Cold Leads secret API key (
sk_…) from Settings → API keys. The API is included in the Business plan (10,000 verification and API credits a month; extra packs available).Node.js 20 or newer (CI tests 20 and 22).
No key yet? Start the server without one and let your agent call
provision_account_and_get_payment_link— see Agent onboarding.
Setup
Claude Desktop
claude_desktop_config.json (Settings → Developer → Edit Config):
{
"mcpServers": {
"coldleads": {
"command": "npx",
"args": ["-y", "@coldleads/mcp-server"],
"env": { "COLDLEADS_API_KEY": "sk_your_secret_key" }
}
}
}Cursor / Windsurf
~/.cursor/mcp.json (Cursor) or ~/.codeium/windsurf/mcp_config.json (Windsurf) — the same mcpServers block as above.
Claude Code
claude mcp add coldleads --env COLDLEADS_API_KEY=sk_your_secret_key -- npx -y @coldleads/mcp-serverVS Code
.vscode/mcp.json:
{
"servers": {
"coldleads": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@coldleads/mcp-server"],
"env": { "COLDLEADS_API_KEY": "sk_your_secret_key" }
}
}
}Hosted endpoint (no install)
Clients that support remote servers can connect directly with a secret key:
{
"mcpServers": {
"coldleads": {
"url": "https://coldleads.app/api/mcp",
"headers": { "Authorization": "Bearer sk_your_secret_key" }
}
}
}The stdio server discovers workspace tools from https://coldleads.app/api/mcp and forwards their calls to the hosted MCP service, so the hosted and local tools use the same account, policy and sending safeguards. It also includes keyless onboarding tools. ChatGPT connects to the hosted endpoint with OAuth 2.1; enable Developer mode in ChatGPT, add the endpoint, sign in to Cold Leads and review the requested access. Other remote MCP clients can use the API-key header shown above.
Docker
docker build -t coldleads-mcp-server .
docker run -i --rm -e COLDLEADS_API_KEY=sk_your_secret_key coldleads-mcp-serverConfiguration
Variable | Default | Purpose |
| — | Secret API key ( |
|
| API base URL (for local development against a Cold Leads dev server). |
Agent onboarding without a key
The agent calls
provision_account_and_get_payment_linkwith the owner's e-mail.It shows the returned
checkout_urlto the human. The human reviews the plan and price on the secure Stripe page and decides whether to pay. The API gives the agent no way to pay, and the agent is told never to open or pay the link.The agent polls
check_provisioning_statuswithsession_idandclaim_tokenevery 15–30 seconds.After payment the first call returns
api_keyonce; this server switches to it immediately. Store it asCOLDLEADS_API_KEYfor the next start.The owner receives an e-mail to open the Cold Leads web app, where they can manage the subscription or rotate the key.
Only a request that carries the claim_token can collect the key; a status lookup without it never returns the key.
Responsible use
A verified address is not consent. You need a lawful basis to contact each person.
Never e-mail leads with
do_not_contact: true(opted out, bounced or on the do-not-contact list).Limits: 120 requests per minute per key; each verification costs 1 credit.
Development
npm ci
npm run build
npm test # schema, server and stdio child-process tests
COLDLEADS_API_KEY_FILE=path/to/key COLDLEADS_API_BASE=http://localhost:3000 node scripts/smoke.mjs # live checksLicense
MIT © 2026 Anton Tkachenko
Available Tools
4 toolscheck_provisioning_statusCheck the owner's payment and get the API keyAInspect
Checks an account created with provision_account_and_get_payment_link. Returns status pending_payment, active, expired or suspended. When active, the first call with the claim_token returns api_key exactly once: store it securely as COLDLEADS_API_KEY and send it as Authorization: Bearer . Poll every 15–30 seconds while pending_payment.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | session_id returned by provision_account_and_get_payment_link. | |
| claim_token | Yes | claim_token returned by provision_account_and_get_payment_link. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial behavior beyond the annotations: the api_key is returned exactly once on the first call with claim_token, must be stored securely, and is used as a Bearer token. This one-time-secret semantics is critical and is consistent with idempotentHint=false, which the description effectively explains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences with zero filler: purpose and status values first, then the critical one-time key behavior, then polling cadence. Front-loaded and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description compensates by enumerating all status values and describing what an active status returns. Auth usage and secret handling are covered, so an agent has everything needed to call and act on the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning: claim_token is single-use and its first consumption yields the api_key. session_id semantics are left to the schema, which already documents it as coming from the provisioning tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Checks') plus the resource ('an account created with provision_account_and_get_payment_link') and enumerates the possible return states (pending_payment, active, expired, suspended). It ties itself directly to the sibling tool that creates the resource, so it is distinguishable from verify_email, search_leads, and the provisioning tool without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete operational guidance: poll every 15-30 seconds while pending_payment, and make the claim call once active. It does not explicitly state when to use this versus any alternative or what to do on 'expired'/'suspended', so it falls just short of full when/when-not coverage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
provision_account_and_get_payment_linkSet up Cold Leads for the human ownerAInspect
Use only when no working Cold Leads API key is available (other Cold Leads tools return missing_api_key or bad_api_key) and the human wants to use Cold Leads. Creates a pending Cold Leads account for the human owner's e-mail and returns a Stripe payment link for the Business plan with API access (price in plan.price, billed monthly until cancelled). Show checkout_url to the human and let them decide; never open, pay or share the link yourself. Keep claim_token secret, then call check_provisioning_status until status is active to receive the API key once.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | No | Name of your agent or product; shown to the human on the payment page. | |
| owner_email | Yes | E-mail address of the human who will own and pay for the Cold Leads account. | |
| callback_url | No | Optional https URL that receives a signed POST when the owner has paid (no secrets in the payload). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnlyHint=false, destructiveHint=false, idempotentHint=false, openWorldHint=true), and the description adds substantial non-derivable detail: the account is created in a pending state, billing is monthly until cancelled, checkout_url must not be opened or paid by the agent, and claim_token must be kept secret. This is exactly the extra context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The critical usage condition is front-loaded in the first clause, and every sentence is directive rather than filler. It is dense and somewhat long, and it mixes input instructions with output-handling rules, but nothing is redundant with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden and does so: it names checkout_url, claim_token, and plan.price, and describes the full async flow through check_provisioning_status to the eventual API key. An agent has everything needed to invoke and follow through correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and all three parameters (agent_id, owner_email, callback_url) are documented in the schema itself. The description references plan.price, checkout_url, and claim_token, but these are outputs rather than inputs, so it adds no input semantics beyond the schema — the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb chain and resource: 'Creates a pending Cold Leads account for the human owner's e-mail and returns a Stripe payment link.' It is clearly distinct from the siblings (verify_email, search_leads, check_provisioning_status), which are named or implied by function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit precondition for use: 'Use only when no working Cold Leads API key is available (other Cold Leads tools return missing_api_key or bad_api_key).' It also states what to do afterward — 'call check_provisioning_status until status is active' — so the agent knows both entry and exit conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_leadsSearch leads by company domainARead-onlyIdempotentInspect
Search the leads already in your Cold Leads CRM for a target company domain: contact e-mail, name, company, phone, stage, tags, verification status and a do_not_contact flag. Covers only contacts in your own workspace (Cold Leads has no third-party lead database). Free, uses no credits.
| Name | Required | Description | Default |
|---|---|---|---|
| role | No | Optional keyword such as sales, ceo or marketing, matched against the contact's name, e-mail local part, tags, notes and type. | |
| limit | No | Maximum number of leads to return (1–50, default 10). | |
| domain | Yes | Company domain, e.g. example.com. A URL or an e-mail address is reduced to its domain. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive and closed-world, so the safety profile is covered. The description adds genuine non-annotation context: the workspace-only data scope and the fact that it consumes no credits. It stops short of describing result formatting or truncation behavior when limit is hit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the action and data scope front-loaded, followed by the cost/scope caveat. The field enumeration doubles as a return-value summary, so nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully lists the returned fields, and it covers the workspace scope and cost model. Minor gaps remain around result ordering and behavior when the limit truncates a large domain's lead set.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so domain, role and limit are all fully documented in the schema, including domain normalization and the 1–50 limit range. The description adds no parameter-level detail beyond that, which is the expected baseline when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb + resource + scope: 'Search the leads already in your Cold Leads CRM for a target company domain,' and enumerates the returned fields. It is clearly distinguishable from the sibling tools (verify_email, provision_account_and_get_payment_link), which are about verification and provisioning rather than retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly bounds usage: 'Covers only contacts in your own workspace (Cold Leads has no third-party lead database)' and notes it is free. This tells the agent when NOT to expect results, but it never names an alternative tool or a condition under which a sibling should be used instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_emailVerify an e-mail addressARead-onlyIdempotentInspect
Verifies an e-mail address: syntax, disposable domain, role account and MX records, plus an SMTP mailbox and catch-all check when Cold Leads can open an SMTP connection to the recipient's mail server (otherwise reasons contains smtp_unreachable and catch_all is null). Returns validity (valid, risky or invalid), a score and reason codes. Usually answers within a few seconds; costs 1 credit.
| Name | Required | Description | Default |
|---|---|---|---|
| Yes | The e-mail address to verify, e.g. anna@example.com. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover safety (readOnly, idempotent, non-destructive), and the description adds substantial behavior beyond that: the conditional SMTP/catch-all logic, the smtp_unreachable reason and null catch_all fallback, the tri-state validity output, the score, the typical latency, and the 1-credit cost. This is exactly the kind of context annotations cannot provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the checks performed and the return shape, packed into three dense but purposeful sentences. The parenthetical on SMTP fallback is slightly heavy but earns its place by explaining the null catch_all case.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description appropriately explains the return values (validity, score, reason codes) and the fallback behavior. Cost and latency expectations are also disclosed. An agent has everything needed to decide whether and how to call this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the single parameter is already documented, and the 0-params baseline logic does not strictly apply. The description does not add syntax/format detail beyond the schema, but it enriches understanding by implying what gets evaluated against that input. Baseline 3-4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the specific action (verifies an e-mail address) and enumerates exactly what is checked (syntax, disposable domain, role account, MX records, SMTP mailbox, catch-all). This is a precise verb+resource statement that clearly distinguishes it from the lead-search and provisioning siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied: you call this to validate an address before relying on it. However, the description offers no explicit when-to-use vs alternatives guidance and does not explain how this relates to the sibling tools (e.g. whether to verify before provisioning). Adequate but with a clear gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v1.0.2- Changed
search_leads1 field changed- changed
Input schema / properties / domain / descriptionPrevious value: -"Company domain, e.g. acme.com. A URL or an e-mail address is reduced to its domain."New value: +"Company domain, e.g. example.com. A URL or an e-mail address is reduced to its domain."
- Changed
verify_email1 field changed- changed
Input schema / properties / email / descriptionPrevious value: -"The e-mail address to verify, e.g. anna@acme.com."New value: +"The e-mail address to verify, e.g. anna@example.com."
4 tool updates
v1.0.0- First observed
check_provisioning_status - First observed
provision_account_and_get_payment_link - First observed
search_leads - First observed
verify_email
TDQS
Scored across 4 tools
Each tool targets a distinct action: search_leads reads the local CRM, verify_email validates an address, and the two provisioning tools handle account creation versus status/API-key retrieval. The onboarding pair shares a domain but their descriptions clearly separate their roles, so an agent can pick correctly.
Names are consistently snake_case and predominantly verb_noun (search_leads, verify_email, check_provisioning_status). Only provision_account_and_get_payment_link is an unusually long compound, a minor deviation but still verb-led and readable.
Four tools is lean but each earns its place: one read, one verification, and a two-step account onboarding flow. Slightly thin for a CRM-style server but well-scoped rather than padded.
The domain spans leads, verification, and onboarding, but the lead surface only offers search — there is no create/update/delete or tag/stage management, so agents cannot populate or mutate the CRM. Core read+verify workflows work, but lifecycle coverage for leads has notable gaps.
Maintenance
Related MCP Connectors
Email finder + verifier for AI agents: find work emails by name and company, check deliverability.
Email verification and domain intelligence for AI agents. MX, RDAP, SSL checks. 25 free credits.
Search companies, enrich contacts, and reveal emails and phones from your AI agent.
Email verification for AI agents: verify addresses and lists, check credits, manage integrations.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to verify email addresses through a multi-signal probabilistic pipeline, returning confidence scores and honest statuses (safe/risky/invalid/unknown) with evidence.Apache 2.0
- FlicenseNot gradedqualityBmaintenanceEnables AI agents to verify email addresses in real-time, checking syntax, DNS, MX records, and SMTP handshake, returning verdicts and deliverability scores without sending actual emails.-
- AlicenseAqualityAmaintenanceEnables AI agents to verify email addresses and receive a 'send', 'hold', or 'kill' verdict with the reason, while also managing signup and credits programmatically.52MIT

Mailveri MCP Serverofficial
AlicenseAqualityCmaintenanceEnables AI assistants to verify email deliverability and check mailbox existence, manage bulk verification batches, and monitor verification credit balances directly from chat.61MIT