Use Spaw from Claude Code and Cursor over MCP

Spaw's MCP server at https://spaw.co/mcp gives AI agents four verification tools with your existing API key, the same billing and the same answers.

Spaw speaks the Model Context Protocol, so an AI agent can verify addresses and inspect domains as tools instead of you pasting curl output into a chat. The server lives at https://spaw.co/mcp, uses streamable HTTP, and authenticates with the same secret API key as the REST API. Agent usage shows up on your Usage page as mcp · key name, so you can see what the agent spent.

Connect Claude Code

Create a secret key on the API keys page. Use a dedicated key for the agent so you can revoke it without touching your servers.
Register the server once:

claude mcp add --transport http spaw https://spaw.co/mcp \
  --header "Authorization: Bearer sk_live_…"

Ask for a verification in plain language, for example "check whether [email protected] can receive mail and tell me the reason if not". Claude Code calls the verify-email tool and reads the answer back.

Connect Cursor

Cursor reads MCP servers from a JSON configuration. Add the server with the same header:

{
  "mcpServers": {
    "spaw": {
      "type": "http",
      "url": "https://spaw.co/mcp",
      "headers": { "Authorization": "Bearer sk_live_…" }
    }
  }
}

Any other client that supports remote MCP servers over HTTP with custom headers can use the same block; Claude Code and Cursor are the two that Spaw documents.

The four tools

Tool	Arguments	What it does
`verify-email`	`email`	One full verification: verdict, reason, risk score and every documented field.
`verify-email-batch`	`emails`, up to 50	Compact per-address rows under the same billing; suppressed addresses answer free.
`domain-intelligence`	`domain`	MX records, mail provider, SPF and DMARC, registration age, disposable and free-provider flags for a whole domain.
`account-balance`	none	The credit balance and monthly grant. Free, useful before a batch.

The fields and reasons are exactly the REST API's, so a reason of catch_all or an smtp_reason of greylisted means the same thing the reference pages describe. An agent that runs out of credits receives a clear tool error naming INSUFFICIENT_CREDITS, never a half answer.

What to do with the verdict

The useful pattern is to let the agent do the reading. Ask it to verify a list of addresses from a file, keep the ones answered deliverable, set aside risky ones with their reasons for a human to look at, and drop the undeliverable ones. Because the batch tool honours your suppression list, addresses that already bounced come back free and marked, and the agent can skip them without a lookup. For a domain the agent has never seen, domain-intelligence is the cheaper first question: it costs one credit only when the domain accepts mail, and it tells the agent whether the domain is a burner or a catch-all before any address is checked.

Limits and safety

Requests share the API's rate limit of 5 per second per account. Use a secret key, never a publishable one: the agent runs on your behalf from a server, and publishable keys only work from a browser on an allowed domain. Keys are shown once at creation and stored hashed; rotate the agent's key from the API keys page if a configuration file leaks.

Cost

Identical to the REST API. A fresh deliverable or risky verdict costs one credit; undeliverable verdicts, invalid input, repeats within seven days and the spaw.test test addresses are free, and the balance tool is always free. Every account gets 10 free lookups a month.