Analyze company domains to determine whether they run cold email outbound and what infrastructure they use.
Fingerprint outbound infrastructure for a single domain or batch of domains.
Return a verdict: program, light, none, or unknown, with confidence and quotable evidence.
Detect lookalike sending domains, registration clusters, sending platforms, inbox providers, warmup signals, and infrastructure vendors.
Report deliverability posture via SPF, DKIM, and DMARC status.
Optionally run a separately billed blacklist/health-score check with check_deliverability.
Tune scanning with scan_sending_domains, sending_domain_depth, skipCache, timeouts, probe limits, and max_charge_usd.
Use it as a read-only MCP tool with an APIFY_TOKEN; runs consume Apify credits per domain analyzed.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-outbound-infrastructure-fingerprint fingerprint outbound infrastructure for acme.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server for the Mamba Labs Outbound Stack Detector actor on Apify.
Give it a company domain. It tells your agent whether that company runs cold email outbound, and on what stack.
fingerprint_outbound_infrastructureInput | Type | Notes |
| string | One company domain. |
| string[] | Batch. Takes precedence over |
| boolean | Default true. The strongest signal and the slowest step. |
|
| Default |
| boolean | Default false. Adds a separately billed blacklist check and health score. |
| boolean | Ignore the 7 day result cache. |
| integer | 10 to 300, default 80. Cap on candidate sending domains probed per company. |
| integer | 3000 to 20000, default 9000. Per HTTP request timeout. |
| integer | 1000 to 15000, default 4000. Per DNS lookup timeout. |
| number | Optional spending cap for this call, in USD. The actor stops before any charge that would take the run past this amount and keeps every row already charged. |
Returns a flat row per domain: runs_outbound (program, light, none, unknown), confidence, sending_domains[], registration_clusters[], sending_platforms[], inbox_provider, warmup_detected, infrastructure_vendors[], spf_status, dkim_status, dmarc_policy, and an evidence[] array of quotable strings.
Related MCP server: Domain Deliverability Checker MCP Server
A real outbound program does not send from the domain the business runs on. It buys lookalikes (getcompany.com, company-mail.com, trycompany.co), gives them their own mail tenant, and redirects their web root at the real site. That redirect is the attribution handle, and finding those domains is the part nobody else does.
Measured on nine live domains: 6 of 6 detected on companies that demonstrably run outbound, 0 false positives of 3 on controls.
Two honest limits. When the brand token is an ordinary English word (Gong, Clay, Ramp), lookalike patterns collide with unrelated businesses that legitimately own them; the actor sets brand_is_common_word and caps confidence rather than reporting a confident none. And sending-platform recall is partial by design: Instantly, Smartlead, Lemlist, Apollo and Salesloft connect over OAuth to a customer's own mailbox and publish no SPF include host at all, so an empty sending_platforms tells you little while a populated one is solid.
You pay per event on Apify, billed to your own Apify account. Prices from the live pricing record, read 2026-10-16:
Event | Price per event (USD) | Fires when |
| $0.00005 | Charged once when the run starts. |
| $0.004 on the Free plan, down to $0.0034 on higher Apify plans | Charged once per domain analyzed. Domains that return no outbound signals, or that do not resolve, still count as analyzed and are charged. |
The actor's Apify page carries the current prices. Running this server consumes Apify credits.
{
"mcpServers": {
"mamba-outbound-infrastructure-fingerprint": {
"command": "npx",
"args": ["-y", "@mambalabsdev/mcp-outbound-infrastructure-fingerprint"],
"env": { "APIFY_TOKEN": "your-apify-token" }
}
}
}Get a token at console.apify.com/account/integrations. Read-only; consumes Apify credits per domain analyzed.
This tool is also exposed by the GTM Suite umbrella server, alongside the rest of the Mamba Labs GTM actors, if you would rather run one server than many.
Built by Mamba Labs.
Given a company domain, determine whether that company runs cold email outbound and on what stack. Returns a runs_outbound verdict of program (a deliberate cold outbound setup), light (one weak signal), none, or unknown, plus the evidence behind it. The strongest signal is the lookalike sending domains a real outbound program leaves behind: domains like getcompany.com or company-mail.com that carry their own mail and redirect back to the primary site. Also returns the inbox provider (Google Workspace, Microsoft 365 and others) for the primary domain and each sending domain, any detected sending platform (Outreach, Salesloft, Lemlist, Instantly, Smartlead, Apollo and more), registration clusters showing sending domains bought on the same day, cold email infrastructure vendors, and deliverability posture (SPF, DKIM, DMARC). Note that sending platform recall is partial by design: sequencers that connect over OAuth to a customer's own mailbox leave no DNS trace, so an empty sending_platforms means little while a populated one is solid. Public DNS and HTTP redirects only, no login, no mailbox access. Returns flat Clay-ready JSON. Read-only; requires an APIFY_TOKEN and consumes Apify credits per domain analyzed.
Inputs: domain, domains, skipCache, check_deliverability, +2 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 1 tool
With only one tool, there is no possibility of confusion or overlap. The tool's purpose is clearly defined and distinct.
The single tool name follows a clear verb_noun pattern ('fingerprint_outbound_infrastructure'), and with only one tool there is no inconsistency to evaluate.
The server contains only one tool, which is slightly below the typical 3-15 range, but the tool is comprehensive and serves a very narrow, specific purpose, making the single-tool count reasonable.
The tool covers the full scope of outbound infrastructure fingerprinting: detecting sending domains, inbox providers, sending platforms, registration clusters, infrastructure vendors, and deliverability posture. No obvious gaps are apparent for the stated purpose.
Email posture for any domain: can it receive mail, can it be spoofed? MX, SPF and DMARC.
Cold email platform that protects your domains: manage outbound campaigns, automated warmup, lead lists, and inbox replies
Email-domain intelligence: MX capability, provider, disposable status, SPF, DMARC, and MTA-STS.
Cold email infrastructure: buy domains, create SMTP mailboxes, set DNS, run warming, read mail.
