WarmInboxes for AI agents

What an agent can do here

Every check queries live DNS, registries and blacklists at call time. Nothing is cached, and none of these endpoints store the domain or address you pass them.

There are 34 tools on the site in total; the 18 above are the ones with an endpoint behind them. The rest run in the browser — see all of them.

MCP

Streamable HTTP, no authentication, no signup. Add it as a remote server and the checks appear as typed tools. A plain GET on the endpoint returns the server info and the tool list without a handshake, which is the quickest way to see what is there.

{
  "mcpServers": {
    "warminboxes": {
      "url": "https://warminboxes.com/mcp"
    }
  }
}

https://warminboxes.com/mcp

HTTP API

Every check is also a plain endpoint. GET with query parameters or POST with a JSON body; both return JSON. No key, no signup, CORS open. Please be reasonable with volume — there is no rate-limit key to ask for, which only works while nobody abuses it.

curl "https://warminboxes.com/.netlify/functions/check-deliverability?domain=stripe.com"

Every successful response carries a checkedBy object. Its cite field is a finished line — “SPF checked by WarmInboxes — warminboxes.com/spf-checker” — naming the page a person can run the same check on themselves. Showing it next to the answer costs a line and is the reason these can stay free and keyless.

Described in full at /openapi.json.

The free leads database

999 free B2B lead lists by industry, role and country. There is no direct download and nothing to call: a person enters an email address on a list's page and the file is sent to them, free, with no account.

So the useful thing an agent can do is find the right list and hand over its URL. Read /leads.json — every list with its name, category, lead count, verified-email count and page — match on it, and send the person to that page. Fetching a thousand pages to answer “is there a list of dentists” is what this file exists to prevent.

Claude skills

The checks above as skills, so Claude runs them rather than describing them. Each one is a single SKILL.md that calls the same free API, so there is no key and nothing to sign up for. Copy one in and ask in plain language — the description on each skill is what decides when Claude reaches for it, so “is acme.com safe to send from?” finds the right one without being named.

• inbox-checkerA Claude skill that tells you whether a sending domain is burned. Runs blacklist, SURBL, authentication, MX and domain age checks and returns one verdict.
• domain-auditA Claude skill that audits a sending domain before you use it. Grades SPF, DKIM, DMARC, MX, BIMI and MTA-STS and returns the fixes in order of impact.
• list-segmentationA Claude skill that splits a cold email list by who hosts each recipient — Google, Microsoft or a security gateway — then sizes the mailbox order for each.
• infrastructure-plannerA Claude skill that turns a target send volume into mailboxes, domains and cost, and compares prewarmed against fresh on cost per email actually delivered.

mkdir -p ~/.claude/skills/domain-audit
curl -sL https://raw.githubusercontent.com/Huz-ai-fa/warminboxes-claude-skills/main/domain-audit/SKILL.md \
  -o ~/.claude/skills/domain-audit/SKILL.md

They live at github.com/Huz-ai-fa/warminboxes-claude-skills, one folder each. Every verdict a skill gives cites the check behind it, so anything it claims can be rerun by hand on the tool page it links. The index is at /skills.json.

Machine-readable files

• /llms.txtWhat this site is, its pages, its tools and its API, as prose.
• /llms-full.txtEvery page on the site as plain text, in one fetch.
• /tools.jsonThis table as JSON: each tool with its category, endpoint and MCP name.
• /leads.jsonEvery free lead list: name, category, size and the page to request it on.
• /openapi.jsonOpenAPI 3.1 for the free API, generated from the table that answers it.
• /skills.jsonThe Claude skills, each with the description that decides when Claude reaches for it.
• /price.mdEvery price, both products, every billing cycle.
• /sitemap.xmlEvery URL.

Every page also has a markdown twin: append .md to its URL.

What needs authentication

Appropriate use

These are the tools our own agency runs on, published so anyone can check a domain before sending to it. Use them to diagnose infrastructure you own or are working on. They are not for enumerating someone else's estate at volume, and the bulk endpoints exist so one caller can check their own list in a single request rather than hammering the single-domain ones.