Copy page

Remote MCP Server

Remote MCP Server - Introduction

Welcome to the Remote MCP Server powered by Tomba.io, a comprehensive Model Context Protocol (MCP) server that provides advanced email discovery, verification, and enrichment capabilities through a streamlined HTTP transport interface.

What is Remote MCP Server?

The Remote MCP Server is a cloud-hosted implementation of the Model Context Protocol that allows you to access Tomba.io's powerful email intelligence tools without the need for local installation or configuration. By leveraging our remote infrastructure, you get instant access to:

• 12 Professional Tools for email discovery and verification
• 3 Resources for comprehensive data access
• 12 Pre-built Prompts for common use cases
• OAuth 2.0 Authentication — no API keys needed for Claude Desktop
• Real-time Processing with high availability
• Scalable Infrastructure that grows with your needs

Key Advantages of Remote MCP

Instant Setup

No installation, no dependencies, no configuration files. Claude Desktop users just add the URL — OAuth authentication happens automatically in the browser.

Always Up-to-Date

Our remote server is continuously updated with the latest features, bug fixes, and API improvements without any action required on your part.

MCP Tools & Capabilities

The Remote MCP Server exposes 12 professional tools that let any MCP-compatible AI assistant discover, verify, and enrich contact data through natural-language prompts. Every tool accepts structured parameters and returns typed JSON — no scraping, no prompt-crafting.

#	Tool	What it does
1	domain_search	Find every email address associated with a company domain.
2	email_finder	Find a person's email by first name, last name, and company domain.
3	email_verifier	Check deliverability, MX, SMTP, disposable/role status, and catch-all for any email.
4	email_enrichment	Return full contact + company profile from an email address.
5	email_count	Return the number of public emails available for a given domain.
6	author_finder	Extract the author's email from any article, blog post, or URL.
7	linkedin_finder	Resolve a LinkedIn profile URL to a verified email address.
8	phone_finder	Find validated phone numbers from an email, domain, or LinkedIn URL.
9	phone_validator	Validate a phone number and return country, carrier, and line type.
10	technology_finder	Detect the full tech stack a website uses.
11	similar_finder	Return companies similar to a given domain (lookalike audiences, ABM).
12	companies_search	Search Tomba's company database by name, industry, size, and more.

See the complete tool reference for parameter schemas, response shapes, and example prompts for every tool.

Streamable HTTP Transport

The Remote MCP Server uses Streamable HTTP Transport for real-time, bidirectional communication. This modern approach provides:

• Server-Sent Events (SSE) for real-time notifications
• JSON-RPC 2.0 for structured API communication
• Session Management for stateful interactions
• WebSocket-like Experience over standard HTTP

Connection Endpoint

Code
https://mcp.tomba.io/mcp

This single endpoint handles all MCP operations through different HTTP methods:

• POST - Send JSON-RPC requests
• GET - Receive real-time notifications via SSE
• DELETE - Terminate sessions cleanly

Agent Skills

Install the Tomba MCP skill to help AI assistants effectively use the Tomba tools:

Code
npx skills add https://mcp.tomba.io

The skill provides:

• Domain knowledge for email discovery and verification
• Best practices for lead generation workflows
• Authentication setup guidance
• Tool usage examples and patterns

View the skill catalog: https://mcp.tomba.io/.well-known/skills/index.json

Authentication Methods

The Tomba MCP Server supports three authentication methods:

Method 1: OAuth 2.0 (Recommended)

Just provide the MCP URL — no API keys or headers needed. Your MCP client opens a browser for authorization automatically via RFC 9728 OAuth discovery.

Code
{
    "mcpServers": {
        "tomba": {
            "url": "https://mcp.tomba.io/mcp"
        }
    }
}

How it works:

1. Your MCP client connects to the server
2. Server responds with WWW-Authenticate header pointing to OAuth metadata
3. Client discovers authorization endpoints via /.well-known/oauth-protected-resource
4. Browser opens for you to sign in and authorize
5. Client receives a JWT access token and uses it automatically
6. Tokens refresh silently — no re-authorization needed

Supported by: Claude Desktop, and any MCP client with OAuth discovery support.

OAuth Scopes:

Scope	Access
read	Account info, email count, basic lookups
search	Domain search, email finder, LinkedIn
verify	Email verification
enrich	Email and company enrichment
leads	Lead management
account	Account settings and API keys

Method 2: Bearer Token

For clients that don't support OAuth. Encode your API credentials as base64:

Code
# Create bearer token
echo -n "ta_your_api_key:ts_your_secret_key" | base64

Use in the Authorization header:

Code
Authorization: Bearer dGFfeW91cl9hcGlfa2V5OnRzX3lvdXJfc2VjcmV0X2tleQ==

Example:

Code
curl -X POST https://mcp.tomba.io/mcp \
  -H "Authorization: Bearer dGFfeW91cl9hcGlfa2V5OnRzX3lvdXJfc2VjcmV0X2tleQ==" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Method 3: Custom Headers

Send credentials as separate headers (used by Cursor):

Code
X-Tomba-Key: ta_your_api_key
X-Tomba-Secret: ts_your_secret_key

Getting API Keys

1. Sign up at app.tomba.io
2. Navigate to Settings → API Keys
3. Copy your API Key (starts with ta_) and Secret Key (starts with ts_)

Rate Limits & Quotas

Rate limits depend on your subscription plan. Every API response includes rate limit information in the headers.

Standard Headers (RFC 9110)

Code
RateLimit-Policy: "rps";q=8;w=1, "daily";q=4000;w=86400
RateLimit:        "rps";r=7;t=1, "daily";r=3842;t=64802

Field	Description
q	Quota — total requests allowed in the window
w	Window — time window in seconds
r	Remaining — requests left in the window
t	Time remaining — seconds until window resets

Custom Tracking Headers

Header	Description	Example
x-second-rate-limit	Total per-second request limit	8
x-minute-rate-limit	Total per-minute request limit	150
x-daily-rate-limit	Total daily request limit	4000
x-minute-request-left	Remaining requests for the minute	142
x-daily-request-left	Remaining requests for the day	3842
x-minute-reset-seconds	Seconds until minute limit resets	45
x-daily-reset-seconds	Seconds until daily limit resets	64802

When the limit is exceeded, the API returns 429 Too Many Requests. Check x-minute-reset-seconds to know when to retry.

Managing Connected Apps

View and revoke authorized OAuth applications at:

Settings → Connected Apps — app.tomba.io/settings/connected-apps

This page shows all third-party applications that have access to your Tomba account, with the ability to revoke access per app.