# Use Spaw from Claude Code and Cursor over MCP

Spaw's MCP server at https://spaw.co/mcp gives AI agents four verification tools with your existing API key, the same billing and the same answers.

Updated: 2026-09-03

Spaw speaks the Model Context Protocol, so an AI agent can verify addresses and inspect domains as tools instead of you pasting curl output into a chat. The server lives at `https://spaw.co/mcp`, uses streamable HTTP, and authenticates with the same secret API key as the REST API. Agent usage shows up on your Usage page as `mcp · key name`, so you can see what the agent spent.

## Connect Claude Code

1. Create a secret key on the API keys page. Use a dedicated key for the agent so you can revoke it without touching your servers.
2. Register the server once:

```bash
claude mcp add --transport http spaw https://spaw.co/mcp \
  --header "Authorization: Bearer sk_live_…"
```

3. Ask for a verification in plain language, for example "check whether mia@acme.com can receive mail and tell me the reason if not". Claude Code calls the `verify-email` tool and reads the answer back.

## Connect Cursor

Cursor reads MCP servers from a JSON configuration. Add the server with the same header:

```json
{
  "mcpServers": {
    "spaw": {
      "type": "http",
      "url": "https://spaw.co/mcp",
      "headers": { "Authorization": "Bearer sk_live_…" }
    }
  }
}
```

Any other client that supports remote MCP servers over HTTP with custom headers can use the same block; Claude Code and Cursor are the two that Spaw documents.

## The four tools

| Tool | Arguments | What it does |
| --- | --- | --- |
| `verify-email` | `email` | One full verification: verdict, reason, risk score and every documented field. |
| `verify-email-batch` | `emails`, up to 50 | Compact per-address rows under the same billing; suppressed addresses answer free. |
| `domain-intelligence` | `domain` | MX records, mail provider, SPF and DMARC, registration age, disposable and free-provider flags for a whole domain. |
| `account-balance` | none | The credit balance and monthly grant. Free, useful before a batch. |

The fields and reasons are exactly the REST API's, so a `reason` of `catch_all` or an `smtp_reason` of `greylisted` means the same thing the reference pages describe. An agent that runs out of credits receives a clear tool error naming `INSUFFICIENT_CREDITS`, never a half answer.

## What to do with the verdict

The useful pattern is to let the agent do the reading. Ask it to verify a list of addresses from a file, keep the ones answered `deliverable`, set aside `risky` ones with their reasons for a human to look at, and drop the `undeliverable` ones. Because the batch tool honours your suppression list, addresses that already bounced come back free and marked, and the agent can skip them without a lookup. For a domain the agent has never seen, `domain-intelligence` is the cheaper first question: it costs one credit only when the domain accepts mail, and it tells the agent whether the domain is a burner or a catch-all before any address is checked.

## Limits and safety

Requests share the API's rate limit of 5 per second per account. Use a secret key, never a publishable one: the agent runs on your behalf from a server, and publishable keys only work from a browser on an allowed domain. Keys are shown once at creation and stored hashed; rotate the agent's key from the API keys page if a configuration file leaks.

## Cost

Identical to the REST API. A fresh deliverable or risky verdict costs one credit; undeliverable verdicts, invalid input, repeats within seven days and the `spaw.test` test addresses are free, and the balance tool is always free. Every account gets 10 free lookups a month.

Reference: https://spaw.co/integrations/mcp