22 tools for company data, IP intelligence, website checks and MCP trust, over REST and MCP with one key, billed per call in credits. Everything below is generated from the same registry the API runs on.
GET /api/hub/v1/tools — the public catalogue: every tool with its input schema, price and example. No key needed.
GET /api/hub/v1/openapi.json — an OpenAPI 3.1 document generated from the same registry. No key needed.
Authentication
Send a BusinessMCP API key as Authorization: Bearer mcph_… on every call except the two public documents above. Create keys in the developer portal (sign up free). The same mcph_ key can also reach a BusinessMCP workspace endpoint; a key narrowed to the Data API only never sees workspace data. A missing, revoked or expired key — or one without Data API access — gets 401 with a WWW-Authenticate: Bearer challenge.
Calling a tool
Every tool answers at POST /api/hub/v1/tools/{id}/call with its input as the JSON body. Each also has a readable route, listed with the tool below: a GET route takes its input from the path and the query string, a POST route from the JSON body. Input is validated before anything is charged, so a malformed call is always free.
request_id — Your Idempotency-Key when you sent a valid one, otherwise a generated id. Quote it to support.
tool — The tool’s MCP name.
provider — Who runs the tool: first_party for everything in the catalogue today.
trust_tier — How much we vouch for the tool: first_party for ours.
credits_charged — What this call cost, after any refund for a miss.
free_credits — The part of credits_charged taken from the free monthly allowance.
billable_credits — The part that will be invoiced.
replayed — True when the Idempotency-Key was seen before: the call ran but was not charged again.
free_remaining — Free credits left this month, when known.
cap_remaining — Billable credits left under the monthly cap, when known.
REST responses repeat the essentials as headers: x-request-id, x-credits-charged, x-credits-free-remaining, x-credits-cap-remaining.
Credits and billing
A call reserves the most it can cost before it runs (for a bulk tool, the price per item times the number of items), then refunds what it did not use: misses on tools charged only for results, and the whole call if the tool fails on our side.
The first 1,000 credits each calendar month (UTC) are free for BusinessMCP’s own tools and are never invoiced. Past them, a call needs billing turned on in the developer portal, or it is refused with 402.
Billable credits are invoiced monthly on graduated tiers, up to the account’s monthly cap. A key can carry its own lower cap.
Every month
1,000
free credits for BusinessMCP’s own tools, reset on the 1st (UTC). No card needed until you go past them.
After that, graduated
First 100,000 billable credits$2.00 per 1,000 credits
100,001 to 1,000,000 billable credits$1.20 per 1,000 credits
Above 1,000,000 billable credits$0.80 per 1,000 credits
A new paying account is capped at 50,000 billable credits a month ($100 at the first tier) until you change it — anywhere from 1,000 to 50,000,000. Keys can carry a cap of their own.
Price per tool. A credit is the unit every tool is priced in; the list price is at the first graduated tier.
Price
Covered free each month
List price per 1,000
Company lookup
1 credit per call, only when a result is found
1,000 calls
$2.00 per 1,000 calls
Bulk company lookup
1 credit per item, only when a result is found
1,000 items
$2.00 per 1,000 items
Website status
1 credit per call, only when a result is found
1,000 calls
$2.00 per 1,000 calls
Email pattern
2 credits per call, only when a result is found
500 calls
$4.00 per 1,000 calls
Company search
2 credits per item, only when a result is found
500 items
$4.00 per 1,000 items
IP to company
1 credit per call
1,000 calls
$2.00 per 1,000 calls
Bulk IP to company
1 credit per item
1,000 items
$2.00 per 1,000 items
AI readiness grade
5 credits per call
200 calls
$10.00 per 1,000 calls
AI crawler access
2 credits per call
500 calls
$4.00 per 1,000 calls
WebMCP check
2 credits per call
500 calls
$4.00 per 1,000 calls
Email authentication check
2 credits per call
500 calls
$4.00 per 1,000 calls
MCP server scan
5 credits per call
200 calls
$10.00 per 1,000 calls
Lead check
3 credits per call
333 calls
$6.00 per 1,000 calls
Email verify
1 credit per call
1,000 calls
$2.00 per 1,000 calls
Monitor an MCP server
5 credits per call
200 calls
$10.00 per 1,000 calls
List MCP monitors
Free
Unlimited
Free
MCP monitor events
Free
Unlimited
Free
Update an MCP monitor
Free
Unlimited
Free
Delete an MCP monitor
Free
Unlimited
Free
People search
10 credits per item, only when a result is found
100 items
$20.00 per 1,000 items
Email finder
15 credits per call, only when a result is found
66 calls
$30.00 per 1,000 calls
Person enrichment
10 credits per call, only when a result is found
100 calls
$20.00 per 1,000 calls
Idempotency
Send an Idempotency-Key header on a REST call to make a retry free. A key must match ^[A-Za-z0-9._:-]{8,200}$; anything else is ignored and a fresh id is used. A repeat of the same key in the same workspace runs the tool again but is not charged again, and returns meta.replayed: true. The key becomes the call’s request_id. MCP tool calls carry no idempotency key.
Errors
A failure is { ok: false, error: { code, message, hint?, retryable, upgrade_url?, details? } }. Retry only when retryable is true. When a charge is refused, upgrade_url is the page that fixes it.
400 invalid_input — the input failed validation. Never charged.
401 — missing, invalid or revoked key, or a key without Data API access.
402 quota_exceeded — the charge was refused; see the reasons below.
403 not_permitted — Data API access is suspended for the account.
503 upstream_failed / backend_unavailable — the tool or our billing did not answer. Nothing is kept: a charged call is refunded. Retryable.
500 unavailable — the tool is switched off for maintenance. Retryable.
{
"ok": false,
"error": {
"code": "quota_exceeded",
"message": "This month's 1,000 free credits are used up.",
"hint": "Add a card to keep going. Free credits reset on the 1st (UTC).",
"retryable": false,
"upgrade_url": "https://businessmcp.com/developers/billing",
"details": {
"reason": "free_exhausted"
}
}
}
Why a charge is refused, from details.reason.
Reason
HTTP
Code
When
upgrade_url
free_exhausted
402
quota_exceeded
The free monthly credits are used up and billing is not turned on.
Yes
card_required
402
quota_exceeded
The tool is never covered by free credits (people data, marketplace tools) and billing is off.
Yes
cap_reached
402
quota_exceeded
The account’s monthly credit cap would be exceeded.
Yes
key_cap_reached
402
quota_exceeded
This key’s own monthly credit cap would be exceeded.
Yes
people_cap
402
quota_exceeded
The daily limit on people records is reached.
No
account_suspended
403
not_permitted
Hub access is suspended for the workspace.
No
kill_switch
503
unavailable
The tool or its provider is switched off for maintenance. Retryable.
No
Rate limits and timeouts
600 calls a minute per key.
3,000 calls a minute per account, across all its keys.
60 calls a minute per key for the heavier tools — those priced at 5 credits or more, and every bulk tool: company_bulk_lookup, company_search, ip_bulk_lookup, ai_readiness_grade, mcp_server_scan, mcp_monitor_create, people_search, email_finder, person_enrich.
Each tool has a deadline — 12 seconds unless listed otherwise below. A call that misses it fails with upstream_failed and is refunded.
MCP
The MCP endpoint registers every tool under its MCP name, plus hub_search_tools (find a tool by what it does, free) and hub_call_tool (call any tool by id). It takes a bearer key only. A result is the same { data, meta } as REST, as JSON text; a failure comes back with isError: true and the same error object.
Both name the server businessmcp. If a workspace endpoint already uses that name in the same client, give this entry another one, such as businessmcp-hub.
Claude.ai and ChatGPT accept OAuth only, so they cannot hold a bearer key. They reach the same tools, billed the same way, through a BusinessMCP workspace endpoint, which carries hub_company_lookup, hub_ip_lookup, hub_lead_check, hub_email_auth_check, hub_ai_readiness, hub_search_tools, hub_call_tool. See add your endpoint to Claude.ai and ChatGPT.
Usage
GET /api/hub/v1/usage returns the calling account’s month so far. It is free.
period_start — The first day of the current billing month (UTC).
free_allowance / free_used / free_remaining — The free monthly credits and how many are spent.
billing_active — Whether a card is on file, i.e. whether calls past the allowance are allowed.
billable_used — Billable credits used this month.
monthly_cap_credits — The account’s monthly cap on billable credits.
estimated_invoice_usd — What billable_used costs under the graduated tiers.
status — The account’s Hub status.
by_tool — Calls and net credits per tool this month.
by_transport — Calls this month by how they arrived: rest, mcp or assistant.
Look up a company by its domain (a URL or work email also works) in our company store. Returns name, industry, employee range, founding year, location (ISO-2 country), company phone, LinkedIn page, a short description and whether the website answers. Brand platforms such as google.com are returned name-only. Charged only when a company is found.
GET/api/hub/v1/companies/{domain}
also POST /api/hub/v1/tools/fp.company.lookup/call
Look up to 100 company domains at once. Returns one entry per input domain, in order, with found=false for unknown domains. Charged one credit per company found; misses are refunded.
Report whether a company website answers, as last measured by our crawler: live, offline or unknown, when it was checked, and the domain it redirects to when it moved. Useful for cleaning a CRM of dead accounts before outreach. An unknown status is never reported as offline.
GET/api/hub/v1/companies/{domain}/status
also POST /api/hub/v1/tools/fp.company.liveness/call
Return the email address format a company uses (for example {first}.{last}), how confident we are in it, whether it was validated by a live mailbox check, whether the domain accepts mail (MX) and whether it is a catch-all domain that accepts any address. Company-level data only: no person is returned. Charged only when a pattern is known.
GET/api/hub/v1/companies/{domain}/email-pattern
also POST /api/hub/v1/tools/fp.company.email_pattern/call
Search our company store for prospects by industry or vertical, country (ISO-2 or name), city and employee range, optionally only companies with a phone number. Returns up to 25 companies per call with the same fields as company_lookup. For more, call again with the domains you already have in exclude_domains; more_available says whether the store likely holds further matches. Companies whose website is offline are excluded. Charged per company returned.
POST/api/hub/v1/companies/search
also POST /api/hub/v1/tools/fp.company.search/call
Deadline 20s · 60 calls a minute per key
Input
industrystringOptional · max 80 chars — An industry or vertical, e.g. "dental clinic", "logistics", "saas".
keywordsstring[]Optional · 0–5 items — Extra category words matched against the structured industry and category fields only.
countrystringOptional · max 60 chars — ISO-2 code or country name, e.g. "US" or "germany".
citystringOptional · max 60 chars
employees_minintegerOptional
employees_maxintegerOptional
has_phonebooleanOptional — Only companies with a known phone number.
limitintegerOptional
exclude_domainsstring[]Optional · 0–200 items — Domains you already have, to get different companies on the next call.
Resolve a public IP address against our nightly IP graph. Returns a verdict (company, non_business, low_confidence, unidentified), the network class (business, isp, mobile, hosting, vpn, tor, education, government), the company name and domain when the verdict is company, and flags for hosting, CDN edges and secure-egress/SASE ranges, whose addresses belong to their customers rather than the vendor. Trust company.domain only when verdict is company.
Grade how ready a website is for AI crawlers and agents: robots.txt access, llms.txt, structured data, metadata and sitemap, scored 0–100 with a letter grade and a fix list. If the homepage cannot be read, the call fails and is refunded rather than graded.
GET/api/hub/v1/sites/{domain}/ai-readiness
also POST /api/hub/v1/tools/fp.site.ai_readiness/call
Check which AI crawlers and agents a website allows in robots.txt, and whether it publishes llms.txt. When robots.txt could not be read, `allowed` is null rather than a guess.
GET/api/hub/v1/sites/{domain}/ai-crawlers
also POST /api/hub/v1/tools/fp.site.ai_crawlers/call
Check whether a website carries a live WebMCP origin-trial token and registers tools for browser agents. Reads the served HTML only and does not run JavaScript; the note says what that means for the result.
{
"ok": true,
"domain": "acme.com",
"reachable": true,
"verdict": "none",
"note": "We read the served HTML only."
}
Email authentication check
id fp.site.email_authmcp email_auth_check
2 credits per call
Check a domain’s email authentication: MX, SPF, DMARC policy and DKIM on common selectors, each graded pass, warn, fail or unknown with the fix. A DNS lookup we could not complete is reported as unknown, never as fail.
GET/api/hub/v1/sites/{domain}/email-auth
also POST /api/hub/v1/tools/fp.site.email_auth/call
Connect to a remote MCP server (initialize + tools/list) and report whether it is live, needs auth or is not MCP, its server name and version, and every tool with a security scan of its name and description: hidden instructions, exfiltration requests, tool shadowing, credential reads and similar. Each tool gets a fingerprint you can pin to detect a later silent change. A bearer token, if given, is used once and never stored.
POST/api/hub/v1/mcp/scan
also POST /api/hub/v1/tools/fp.mcp.probe/call
Deadline 20s · 60 calls a minute per key
Input
urlstringRequired · URL · max 2,000 chars
bearerstringOptional · max 4,000 chars — Optional bearer token for a server that requires auth. Used for this call only and never stored.
Score an inbound lead before it reaches your CRM: email domain age (RDAP), whether it accepts mail, disposable or free-mail provider, gibberish local part, the network class of the submitting IP (hosting, VPN, Tor) and headless-browser signals. Returns a band (ok, suspect, spam) with the reasons. Use it to FLAG a lead for review, never to silently drop one: an unknown fact counts as zero, so a lookup failure never makes a lead look worse.
POST/api/hub/v1/leads/check
also POST /api/hub/v1/tools/fp.lead.check/call
Deadline 15s
Input
emailstringOptional · email · max 320 chars
ipstringOptional · max 45 chars
user_agentstringOptional · max 1,000 chars
bot_signalsobjectOptional · fields: webdriver, noLanguages, noChrome, headlessUa — Client signals from the browser that submitted the form, if you collect them.
Check whether an email address can receive mail before you send to it: well-formed syntax, a live mail server (MX) on the domain, whether the domain is catch-all, disposable or a free-mail provider, whether it is a shared role inbox (info@, sales@), and whether the local part fits the company address format we know. Returns a verdict of undeliverable, risky, domain_ok or unknown with the reasons. No mail server is contacted, so domain_ok means the domain accepts mail, not that this exact mailbox exists. The address is not stored.
{
"email": "jane.doe@acme.com",
"verdict": "domain_ok",
"reasons": [
"The domain accepts mail. The mailbox itself was not contacted."
],
"checks": {
"syntax": true,
"mx": [
"aspmx.l.google.com"
],
"catch_all": false,
"disposable": false,
"free_mail": false,
"role": false,
"fits_company_pattern": true,
"company_pattern": "{first}.{last}"
}
}
Monitor an MCP server
id fp.mcp.monitor.createmcp mcp_monitor_create
5 credits per call
Start monitoring a remote MCP server. The first check pins a fingerprint of every tool; after that the server is checked hourly, every 6 hours or daily, and you are alerted (in-app, email, Slack and the alert.raised webhook) when it goes down, recovers, adds or removes a tool, or changes a tool definition without notice, which is how a trusted server turns hostile. A tool whose description trips a blocking security rule is flagged at once. Creating a monitor costs the baseline scan; each scheduled check costs 1 credit, and a monitor pauses itself if the account cannot be charged.
POST/api/hub/v1/mcp/monitors
also POST /api/hub/v1/tools/fp.mcp.monitor.create/call
Deadline 25s · 60 calls a minute per key
Input
urlstringRequired · URL · max 2,000 chars
intervalstringOptional — hourly, 6h or daily. Each scheduled check costs 1 credit.
bearerstringOptional · max 4,000 chars — Optional bearer token for a server that requires auth. Stored encrypted and used only for these checks.
Read the event history of your MCP monitors, newest first: baseline, down, recovered, tool_added, tool_removed, tool_changed, blocking_finding and paused, each with its detail. Pass monitor_id for one monitor. Free.
GET/api/hub/v1/mcp/monitors/events
also POST /api/hub/v1/tools/fp.mcp.monitor.events/call
Change how often a monitor checks, pause or resume it (resuming also restarts a monitor that paused for billing or repeated failures), or replace or remove its stored bearer token. Free.
POST/api/hub/v1/mcp/monitors/{monitor_id}
also POST /api/hub/v1/tools/fp.mcp.monitor.update/call
Deadline 12s
Input
monitor_idstringRequired · uuid
intervalstringOptional
statusstringOptional — paused stops checks and charges; active resumes, including a monitor paused for billing.
bearervalueOptional — A new bearer token, or null to remove the stored one.
List named people at a company domain, decision-makers first (c_level, vp, director) unless you pass seniority. Filter by department or a title substring. Returns name, title, seniority, department, LinkedIn profile, work email with its status (valid, catch_all or unknown) and location. People in the EU, EEA, UK or Switzerland, people we cannot place, and anyone who opted out are never returned. Charged per person returned; the rest of the limit is refunded.
POST/api/hub/v1/people/search
also POST /api/hub/v1/tools/fp.people.search/call
Deadline 12s · 60 calls a minute per key · needs billing on; never covered by free credits
Find the work email for a named person at a company domain. Returns the stored address with its status when we hold the person, otherwise the company email pattern applied to the name (email_status "pattern": built, never checked, verify before sending). Never returns people in the EU, EEA, UK or Switzerland, companies we cannot place, or opted-out addresses. Charged only when an address is returned.
POST/api/hub/v1/people/email-finder
also POST /api/hub/v1/tools/fp.people.email_finder/call
Deadline 12s · 60 calls a minute per key · needs billing on; never covered by free credits
Look up one person by work email or by LinkedIn profile URL. Returns name, title, seniority, department, employer domain, LinkedIn profile and work email with its status. Never returns people in the EU, EEA, UK or Switzerland, people we cannot place, or anyone who opted out. Charged only when a person is found.
POST/api/hub/v1/people/enrich
also POST /api/hub/v1/tools/fp.people.enrich/call
Deadline 12s · 60 calls a minute per key · needs billing on; never covered by free credits