22 tools for company data, IP intelligence, website checks and MCP trust, over REST and MCP with one key, prepaid and priced per call in dollars. Everything below is generated from the same registry the API runs on.
GET /api/hub/v1/tools — the public catalogue: every tool with its input schema, price and example. No key needed.
GET /api/hub/v1/openapi.json — an OpenAPI 3.1 document generated from the same registry. No key needed.
Authentication
Send a BusinessMCP API key as Authorization: Bearer mcph_… on every call except the two public documents above. Create keys in the developer portal (sign up free). The same mcph_ key can also reach a BusinessMCP workspace endpoint; a key narrowed to the Data API only never sees workspace data. A missing, revoked or expired key — or one without Data API access — gets 401 with a WWW-Authenticate: Bearer challenge.
Calling a tool
Every tool answers at POST /api/hub/v1/tools/{id}/call with its input as the JSON body. Each also has a readable route, listed with the tool below: a GET route takes its input from the path and the query string, a POST route from the JSON body. Input is validated before anything is charged, so a malformed call is always free.
request_id — Your Idempotency-Key when you sent a valid one, otherwise a generated id. Quote it to support.
tool — The tool’s MCP name.
provider — Who runs the tool: first_party for everything in the catalogue today.
trust_tier — How much we vouch for the tool: first_party for ours.
cost_usd — What this call cost, in dollars, after any refund for a miss.
trial_usd — The part of cost_usd paid by the free trial.
paid_usd — The part of cost_usd taken from your purchased balance.
replayed — True when the Idempotency-Key was seen before: the call ran but was not charged again.
balance_usd — Purchased balance left after the call, when known.
trial_left_usd — Free trial left after the call, when one is live.
REST responses repeat the essentials as headers: x-request-id, x-cost-usd, x-balance-usd, x-trial-left-usd.
Pricing and balance
Every tool has a fixed price in dollars per call, or per item for a bulk tool. A call reserves the most it can cost before it runs, then gives back what it did not use: misses on tools charged only for results, and the whole call if the tool fails on our side. Money goes back to whichever of trial or balance paid it.
The account is prepaid. Add balance on the Billing page of the developer portal in packs from $10; bigger packs add up to 30% bonus balance. There is no subscription and nothing is invoiced afterwards.
Saving a card on the Billing page starts a one-time free trial of $5 free for 7 days. The card is not charged. The trial pays for BusinessMCP’s own tools only; people data and marketplace tools are paid from purchased balance.
A call pays from the trial first, where it applies, then from the balance. When neither covers it, it is refused with 402 quota_exceeded with details.reason: insufficient_balance and an upgrade_url to add balance — never billed later. A key can carry its own monthly spend limit, set on the API keys page of the developer portal.
Free trial
$5
once, for 7 days, on BusinessMCP’s own tools. It starts when you save a card, which is not charged.
Then prepaid balance
Pay $10$10 of balance
Pay $50$55 of balance+$5 bonus (10%)
Pay $200$240 of balance+$40 bonus (20%)
Pay $1,000$1,300 of balance+$300 bonus (30%)
Each call is taken from your balance at the price below. No subscription and no invoice later: an empty balance refuses the call. Any key can carry a monthly spend limit of its own.
Price per tool. Bonus balance from a bigger pack buys more calls; it never changes a price. The trial never pays for people data.
Price
Covered by the $5 trial
What $10 buys
Company lookup
$0.02 per call, only when a result is found
250 calls
500 calls
Bulk company lookup
$0.02 per item, only when a result is found
250 items
500 items
Website status
$0.005 per call, only when a result is found
1,000 calls
2,000 calls
Email pattern
$0.01 per call, only when a result is found
500 calls
1,000 calls
Company search
$0.01 per item, only when a result is found
500 items
1,000 items
IP to company
$0.02 per call, only when a result is found
250 calls
500 calls
Bulk IP to company
$0.02 per item, only when a result is found
250 items
500 items
AI readiness grade
$0.03 per call
166 calls
333 calls
AI crawler access
$0.01 per call
500 calls
1,000 calls
WebMCP check
$0.01 per call
500 calls
1,000 calls
Email authentication check
$0.01 per call
500 calls
1,000 calls
MCP server scan
$0.05 per call
100 calls
200 calls
Lead check
$0.015 per call
333 calls
666 calls
Email verify
$0.002 per call
2,500 calls
5,000 calls
Monitor an MCP server
$0.05 per call
100 calls
200 calls
List MCP monitors
Free
Unlimited
Free
MCP monitor events
Free
Unlimited
Free
Update an MCP monitor
Free
Unlimited
Free
Delete an MCP monitor
Free
Unlimited
Free
People search
$0.08 per item, only when a result is found
None, paid balance only
125 items
Email finder
$0.04 per call, only when a result is found
None, paid balance only
250 calls
Person enrichment
$0.10 per call, only when a result is found
None, paid balance only
100 calls
Idempotency
Send an Idempotency-Key header on a REST call to make a retry free. A key must match ^[A-Za-z0-9._:-]{8,200}$; anything else is ignored and a fresh id is used. A repeat of the same key in the same workspace runs the tool again but is not charged again, and returns meta.replayed: true. The key becomes the call’s request_id. MCP tool calls carry no idempotency key.
Errors
A failure is { ok: false, error: { code, message, hint?, retryable, upgrade_url?, details? } }. Retry only when retryable is true. When a charge is refused, upgrade_url is the page that fixes it.
400 invalid_input — the input failed validation. Never charged.
401 — missing, invalid or revoked key, or a key without Data API access.
402 quota_exceeded — the charge was refused; see the reasons below.
403 not_permitted — Data API access is suspended for the account.
The balance (and any live free trial) does not cover the call. People data and marketplace tools are paid from purchased balance only.
Yes
key_cap_reached
402
quota_exceeded
This key’s own monthly spend limit would be exceeded.
Yes
people_cap
402
quota_exceeded
The daily limit on people records is reached.
No
account_suspended
403
not_permitted
Hub access is suspended for the workspace.
No
kill_switch
503
unavailable
The tool or its provider is switched off for maintenance. Retryable.
No
Rate limits and timeouts
600 calls a minute per key.
3,000 calls a minute per account, across all its keys.
60 calls a minute per key for the heavier tools — those priced at $0.03 a call or more, and every bulk tool: company_bulk_lookup, company_search, ip_bulk_lookup, ai_readiness_grade, mcp_server_scan, mcp_monitor_create, people_search, email_finder, person_enrich.
Each tool has a deadline — 12 seconds unless listed otherwise below. A call that misses it fails with upstream_failed and is refunded.
MCP
The MCP endpoint registers every tool under its MCP name, plus hub_search_tools (find a tool by what it does, free) and hub_call_tool (call any tool by id). It takes a bearer key only. A result is the same { data, meta } as REST, as JSON text; a failure comes back with isError: true and the same error object.
Both name the server businessmcp. If a workspace endpoint already uses that name in the same client, give this entry another one, such as businessmcp-hub.
Claude.ai and ChatGPT accept OAuth only, so they cannot hold a bearer key. They reach the same tools, billed the same way, through a BusinessMCP workspace endpoint, which carries hub_company_lookup, hub_ip_lookup, hub_lead_check, hub_email_auth_check, hub_ai_readiness, hub_search_tools, hub_call_tool. See add your endpoint to Claude.ai and ChatGPT.
Usage
GET /api/hub/v1/usage returns the calling account’s balance, trial and month so far. It is free. Amounts are integer mills ($0.001).
period_start — The first day of the current calendar month (UTC), which the spend and call counts below cover.
balance_mills — Purchased balance left, in mills ($0.001). It can be below zero after a refunded pack, which refuses paid calls.
trial_left_mills / trial_expires_at — Free trial left, in mills, and when it ends (null if no trial was ever granted).
spent_mills — Spent this month, trial and balance together, in mills.
status — The account’s Hub status: active or suspended.
by_tool — Per tool this month: calls, and mills spent net of refunds.
by_transport — Calls this month by how they arrived: rest, mcp or assistant.
Look up a company by its domain (a URL or work email also works) in our company store. Returns name, industry, employee range, founding year, location (ISO-2 country), company phone, LinkedIn page, a short description and whether the website answers. Brand platforms such as google.com are returned name-only. Charged only when a company is found.
GET/api/hub/v1/companies/{domain}
also POST /api/hub/v1/tools/fp.company.lookup/call
Look up to 100 company domains at once. Returns one entry per input domain, in order, with found=false for unknown domains. Charged per company found; misses are refunded.
Report whether a company website answers, as last measured by our crawler: live, offline or unknown, when it was checked, and the domain it redirects to when it moved. Useful for cleaning a CRM of dead accounts before outreach. An unknown status is never reported as offline.
GET/api/hub/v1/companies/{domain}/status
also POST /api/hub/v1/tools/fp.company.liveness/call
Return the email address format a company uses (for example {first}.{last}), how confident we are in it, whether it was validated by a live mailbox check, whether the domain accepts mail (MX) and whether it is a catch-all domain that accepts any address. Company-level data only: no person is returned. Charged only when a pattern is known.
GET/api/hub/v1/companies/{domain}/email-pattern
also POST /api/hub/v1/tools/fp.company.email_pattern/call
Search our company store for prospects by industry or vertical, country (ISO-2 or name), city and employee range, optionally only companies with a phone number. Returns up to 25 companies per call with the same fields as company_lookup. For more, call again with the domains you already have in exclude_domains; more_available says whether the store likely holds further matches. Companies whose website is offline are excluded. Charged per company returned.
POST/api/hub/v1/companies/search
also POST /api/hub/v1/tools/fp.company.search/call
Deadline 20s · 60 calls a minute per key
Input
industrystringOptional · max 80 chars — An industry or vertical, e.g. "dental clinic", "logistics", "saas".
keywordsstring[]Optional · 0–5 items — Extra category words matched against the structured industry and category fields only.
countrystringOptional · max 60 chars — ISO-2 code or country name, e.g. "US" or "germany".
citystringOptional · max 60 chars
employees_minintegerOptional
employees_maxintegerOptional
has_phonebooleanOptional — Only companies with a known phone number.
limitintegerOptional
exclude_domainsstring[]Optional · 0–200 items — Domains you already have, to get different companies on the next call.
Resolve a public IP address against our nightly IP graph. Returns a verdict (company, non_business, low_confidence, unidentified), the network class (business, isp, mobile, hosting, vpn, tor, education, government), the company name and domain when the verdict is company, and flags for hosting, CDN edges and secure-egress/SASE ranges, whose addresses belong to their customers rather than the vendor. Trust company.domain only when verdict is company.
Resolve up to 100 public IP addresses at once. Returns one result per input IP, in order. Charged per IP that names a company; every other verdict is free.
Grade how ready a website is for AI crawlers and agents: robots.txt access, llms.txt, structured data, metadata and sitemap, scored 0–100 with a letter grade and a fix list. If the homepage cannot be read, the call fails and is refunded rather than graded.
GET/api/hub/v1/sites/{domain}/ai-readiness
also POST /api/hub/v1/tools/fp.site.ai_readiness/call
Check which AI crawlers and agents a website allows in robots.txt, and whether it publishes llms.txt. When robots.txt could not be read, `allowed` is null rather than a guess.
GET/api/hub/v1/sites/{domain}/ai-crawlers
also POST /api/hub/v1/tools/fp.site.ai_crawlers/call
Check whether a website carries a live WebMCP origin-trial token and registers tools for browser agents. Reads the served HTML only and does not run JavaScript; the note says what that means for the result.
{
"ok": true,
"domain": "acme.com",
"reachable": true,
"verdict": "none",
"note": "We read the served HTML only."
}
Email authentication check
id fp.site.email_authmcp email_auth_check
$0.01 per call
Check a domain’s email authentication: MX, SPF, DMARC policy and DKIM on common selectors, each graded pass, warn, fail or unknown with the fix. A DNS lookup we could not complete is reported as unknown, never as fail.
GET/api/hub/v1/sites/{domain}/email-auth
also POST /api/hub/v1/tools/fp.site.email_auth/call
Connect to a remote MCP server (initialize + tools/list) and report whether it is live, needs auth or is not MCP, its server name and version, and every tool with a security scan of its name and description: hidden instructions, exfiltration requests, tool shadowing, credential reads and similar. Each tool gets a fingerprint you can pin to detect a later silent change. A bearer token, if given, is used once and never stored.
POST/api/hub/v1/mcp/scan
also POST /api/hub/v1/tools/fp.mcp.probe/call
Deadline 20s · 60 calls a minute per key
Input
urlstringRequired · URL · max 2,000 chars
bearerstringOptional · max 4,000 chars — Optional bearer token for a server that requires auth. Used for this call only and never stored.
Score an inbound lead before it reaches your CRM: email domain age (RDAP), whether it accepts mail, disposable or free-mail provider, gibberish local part, the network class of the submitting IP (hosting, VPN, Tor) and headless-browser signals. Returns a band (ok, suspect, spam) with the reasons. Use it to FLAG a lead for review, never to silently drop one: an unknown fact counts as zero, so a lookup failure never makes a lead look worse.
POST/api/hub/v1/leads/check
also POST /api/hub/v1/tools/fp.lead.check/call
Deadline 15s
Input
emailstringOptional · email · max 320 chars
ipstringOptional · max 45 chars
user_agentstringOptional · max 1,000 chars
bot_signalsobjectOptional · fields: webdriver, noLanguages, noChrome, headlessUa — Client signals from the browser that submitted the form, if you collect them.
Check whether an email address can receive mail before you send to it: well-formed syntax, a live mail server (MX) on the domain, whether the domain is catch-all, disposable or a free-mail provider, whether it is a shared role inbox (info@, sales@), and whether the local part fits the company address format we know. Returns a verdict of undeliverable, risky, domain_ok or unknown with the reasons. No mail server is contacted, so domain_ok means the domain accepts mail, not that this exact mailbox exists. The address is not stored.
{
"email": "jane.doe@acme.com",
"verdict": "domain_ok",
"reasons": [
"The domain accepts mail. The mailbox itself was not contacted."
],
"checks": {
"syntax": true,
"mx": [
"aspmx.l.google.com"
],
"catch_all": false,
"disposable": false,
"free_mail": false,
"role": false,
"fits_company_pattern": true,
"company_pattern": "{first}.{last}"
}
}
Monitor an MCP server
id fp.mcp.monitor.createmcp mcp_monitor_create
$0.05 per call
Start monitoring a remote MCP server. The first check pins a fingerprint of every tool; after that the server is checked hourly, every 6 hours or daily, and you are alerted (in-app, email, Slack and the alert.raised webhook) when it goes down, recovers, adds or removes a tool, or changes a tool definition without notice, which is how a trusted server turns hostile. A tool whose description trips a blocking security rule is flagged at once. Creating a monitor costs the baseline scan; each scheduled check costs $0.002, and a monitor pauses itself if the balance runs out.
POST/api/hub/v1/mcp/monitors
also POST /api/hub/v1/tools/fp.mcp.monitor.create/call
Deadline 25s · 60 calls a minute per key
Input
urlstringRequired · URL · max 2,000 chars
intervalstringOptional — hourly, 6h or daily. Each scheduled check costs $0.002.
bearerstringOptional · max 4,000 chars — Optional bearer token for a server that requires auth. Stored encrypted and used only for these checks.
Read the event history of your MCP monitors, newest first: baseline, down, recovered, tool_added, tool_removed, tool_changed, blocking_finding and paused, each with its detail. Pass monitor_id for one monitor. Free.
GET/api/hub/v1/mcp/monitors/events
also POST /api/hub/v1/tools/fp.mcp.monitor.events/call
Change how often a monitor checks, pause or resume it (resuming also restarts a monitor that paused for billing or repeated failures), or replace or remove its stored bearer token. Free.
POST/api/hub/v1/mcp/monitors/{monitor_id}
also POST /api/hub/v1/tools/fp.mcp.monitor.update/call
Deadline 12s
Input
monitor_idstringRequired · uuid
intervalstringOptional
statusstringOptional — paused stops checks and charges; active resumes, including a monitor paused for billing.
bearervalueOptional — A new bearer token, or null to remove the stored one.
List named people at a company domain, decision-makers first (c_level, vp, director) unless you pass seniority. Filter by department or a title substring. Returns name, title, seniority, department, LinkedIn profile, work email with its status (valid, catch_all or unknown) and location. People in the EU, EEA, UK or Switzerland, people we cannot place, and anyone who opted out are never returned. Charged per person returned; the rest of the limit is refunded.
POST/api/hub/v1/people/search
also POST /api/hub/v1/tools/fp.people.search/call
Deadline 12s · 60 calls a minute per key · paid from purchased balance only; never covered by the free trial
Find the work email for a named person at a company domain. Returns the stored address with its status when we hold the person, otherwise the company email pattern applied to the name (email_status "pattern": built, never checked, verify before sending). Never returns people in the EU, EEA, UK or Switzerland, companies we cannot place, or opted-out addresses. Charged only when an address is returned.
POST/api/hub/v1/people/email-finder
also POST /api/hub/v1/tools/fp.people.email_finder/call
Deadline 12s · 60 calls a minute per key · paid from purchased balance only; never covered by the free trial
Look up one person by work email or by LinkedIn profile URL. Returns name, title, seniority, department, employer domain, LinkedIn profile and work email with its status. Never returns people in the EU, EEA, UK or Switzerland, people we cannot place, or anyone who opted out. Charged only when a person is found.
POST/api/hub/v1/people/enrich
also POST /api/hub/v1/tools/fp.people.enrich/call
Deadline 12s · 60 calls a minute per key · paid from purchased balance only; never covered by the free trial