# mcp.md

_Last updated: 2026-08-15_
_Version: 1.0.0 - canonical: https://encrata.com/ai/mcp.md_

Encrata ships a hosted MCP (Model Context Protocol) server so AI assistants can run lookups as native tools - no glue code. This is the single source of truth for the MCP server URL and tool list.

- **Server URL**: `https://mcp.encrata.com/mcp`
- **Auth**: `Authorization: Bearer <ENCRATA_API_KEY>` - get a key via https://encrata.com/auth.md
- **Docs**: https://docs.encrata.com/mcp-server

Auth is API-key only for this surface. There is no OAuth or dynamic client registration flow.

## Configuration

Add to your MCP client config (Claude Desktop, Cursor, VS Code, or any MCP-compatible runtime):

```json
{
  "mcpServers": {
    "encrata": {
      "url": "https://mcp.encrata.com/mcp",
      "headers": { "Authorization": "Bearer $ENCRATA_API_KEY" }
    }
  }
}
```

## Available tools

| Tool | What it does |
|------|--------------|
| `email_validity` | Deliverability verdict (`valid` / `invalid` / `disposable` / `accept_all` / `unknown`) |
| `email_identity` | Full person profile from an email address |
| `email_breaches` | Known data-breach exposure for an address |
| `password_breaches` | Password breach check (`sha1` preferred; `password` accepted) |
| `bulk_email_validity` | Validate a list of email addresses in one synchronous call |

Each tool returns structured JSON with clear, human-readable field labels.

## Usage notes

- Tool calls consume the same credits as direct API calls (see https://encrata.com/pricing). Identical requests within 24 hours are served free from cache.
- The server is stateless: every request must carry the bearer key. Keys are scoped to one workspace.
- Rate limits mirror the REST API; the server returns MCP-standard errors your client will surface.
- `password_breaches` input: prefer `sha1` (uppercase hex SHA-1) so raw passwords never leave the caller.
- Example prompt once connected: *"Look up ada@figma.com and tell me their job title, company and breach exposure."*