Tomba Agent Plugins
OfficialSupported Platforms
Platform | Plugin Path | Auth Method |
Generic / Multi-agent |
| OAuth / Bearer / API headers |
Claude (Desktop & Code) |
| OAuth 2.0 (automatic) |
Cursor AI |
|
|
VS Code (GitHub Copilot) |
| OAuth / Bearer (prompted) |
Windsurf |
| OAuth / Bearer |
Zed |
| OAuth / Bearer |
ChatGPT (OpenAI API) |
| OAuth (plugin manifest) |
Codeium |
| OAuth / Bearer |
Gemini CLI |
| OAuth / Bearer |
MCP Server
Endpoint:
https://mcp.tomba.io/mcpTransport: Streamable HTTP (JSON-RPC 2.0)
Available Tools
Tool | Description |
| Find all emails for a company domain |
| Discover a person's email via name + company |
| Validate email deliverability, MX, SMTP |
| Get full contact and company profiles |
| Count public emails for a domain |
| Extract author email from article URLs |
| Convert LinkedIn profiles to verified emails |
| Retrieve validated phone numbers |
| Verify phone numbers with carrier details |
| Identify website technology stacks |
| Discover competitor/lookalike companies |
| Query company database by attributes |
All tool definitions are maintained in shared/tools.json as a single source of truth.
Resources
Resource | URI | Description |
Account Info |
| Current account information and usage |
Domain Stats |
| Email statistics for a domain |
Usage Stats |
| API usage statistics |
Prompts
12 pre-built prompts for common workflows:
Prompt | Description |
| Research a company and find key contacts for outreach |
| Analyze competitors including tech stack, team structure, and contacts |
| Verify a list of email addresses |
| Find a specific person's email at a company |
| Find authors and content creators for outreach campaigns |
| Build comprehensive ABM campaigns with multi-stakeholder targeting |
| Research VCs/investors, portfolio companies, and find decision makers |
| Source candidates from target companies for recruiting |
| Identify strategic partners and integration opportunities |
| Conduct industry analysis across multiple companies |
| Build territory plans with account prioritization and stakeholder mapping |
| Comprehensive company analysis for investment, acquisition, or partnership |
Authentication
Method 1: OAuth 2.0 (Recommended)
Just provide the MCP URL — no API keys or headers needed. Your MCP client opens a browser for authorization automatically via RFC 9728 discovery.
{
"mcpServers": {
"tomba": {
"url": "https://mcp.tomba.io/mcp"
}
}
}Supported by: Claude Desktop, and any MCP client with OAuth discovery support.
Method 2: Bearer Token
For clients that don't support OAuth. Encode your credentials as base64:
echo -n 'ta_your_api_key:ts_your_secret_key' | base64Use the result as:
Authorization: Bearer <base64_token>Method 3: API Headers
For Cursor and clients that support custom headers:
X-Tomba-Key: ta_your_api_key
X-Tomba-Secret: ts_your_secret_keySetup
1. Choose Your Auth Method
OAuth (Claude Desktop) — No setup needed. Just add the URL and authorize in your browser when prompted.
API Keys (other clients):
Sign up at app.tomba.io/auth/register
Get your API key (
ta_xxx) and secret (ts_xxx) from app.tomba.io/apiCopy
.env.exampleto.envand fill in your credentials
2. Configure Your Platform
Add to claude_desktop_config.json:
{
"mcpServers": {
"tomba": {
"url": "https://mcp.tomba.io/mcp"
}
}
}Claude Desktop opens your browser automatically for authorization. Tokens refresh silently.
Run:
claude mcp add tomba --transport http --url https://mcp.tomba.io/mcp \
--header "Authorization: Bearer YOUR_BASE64_TOKEN"Add to .cursor/mcp.json:
{
"mcpServers": {
"tomba": {
"url": "https://mcp.tomba.io/mcp",
"transport": "http",
"headers": {
"X-Tomba-Key": "ta_your_api_key",
"X-Tomba-Secret": "ts_your_secret_key"
}
}
}
}Option A — OAuth (if supported):
{
"servers": {
"tomba": {
"type": "http",
"url": "https://mcp.tomba.io/mcp"
}
}
}Option B — Bearer token (prompted):
{
"inputs": [
{
"id": "tomba-bearer",
"type": "promptString",
"description": "Tomba Bearer Token (base64 of ta_api_key:ts_secret_key)",
"password": true
}
],
"servers": {
"tomba": {
"type": "http",
"url": "https://mcp.tomba.io/mcp",
"headers": {
"Authorization": "Bearer ${input:tomba-bearer}"
}
}
}
}Option A — OAuth (if supported):
{
"mcpServers": {
"tomba": {
"serverUrl": "https://mcp.tomba.io/mcp"
}
}
}Option B — Bearer token:
{
"mcpServers": {
"tomba": {
"serverUrl": "https://mcp.tomba.io/mcp",
"transport": "http",
"headers": {
"Authorization": "Bearer YOUR_BASE64_TOKEN"
}
}
}
}Option A — OAuth (if supported):
{
"context_servers": {
"tomba": {
"settings": {
"url": "https://mcp.tomba.io/mcp"
}
}
}
}Option B — Bearer token:
{
"context_servers": {
"tomba": {
"settings": {
"url": "https://mcp.tomba.io/mcp",
"headers": {
"Authorization": "Bearer YOUR_BASE64_TOKEN"
}
}
}
}
}Use the MCP tool type in the OpenAI Responses API:
curl https://api.openai.com/v1/responses \
-H "Authorization: Bearer $OPENAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "gpt-4.1",
"tools": [
{
"type": "mcp",
"server_label": "tomba",
"server_url": "https://mcp.tomba.io/mcp",
"require_approval": "never"
}
],
"input": "Find all emails for tomba.io"
}'Option A — OAuth (if supported):
{
"mcpServers": {
"tomba": {
"url": "https://mcp.tomba.io/mcp"
}
}
}Option B — Bearer token:
{
"mcpServers": {
"tomba": {
"url": "https://mcp.tomba.io/mcp",
"transport": "http",
"headers": {
"Authorization": "Bearer YOUR_BASE64_TOKEN"
}
}
}
}Option A — OAuth (if supported):
{
"mcpServers": {
"tomba": {
"url": "https://mcp.tomba.io/mcp"
}
}
}Option B — Bearer token:
Add to ~/.gemini/settings.json:
{
"mcpServers": {
"tomba": {
"url": "https://mcp.tomba.io/mcp",
"headers": {
"Authorization": "Bearer YOUR_BASE64_TOKEN"
}
}
}
}Rate Limits
Every API response includes rate limit headers:
Header | Description |
| Rate limit policy definition |
| Current remaining quota and reset time |
| Remaining daily requests |
| Remaining requests this minute |
| Seconds until minute limit resets |
Contributing
See CONTRIBUTING.md for guidelines on adding new platform plugins.
License
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/tomba-io/agent-plugins'
If you have feedback or need assistance with the MCP directory API, please join our Discord server