Skip to content

SignupBouncer

by signupbouncer.com · remote · no sign-in to list tools · v1.1.1 · published by com.signupbouncer

An API that checks new signups for disposable emails and repeat accounts.

Deletes · 1Changes · 2
CompareRegistry entry

6 tools: 1 can delete or cancel things, 2 change things and 3 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http checker https://signupbouncer.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnexplain_reason

    The server marks "explain_reason" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "explain_reason" says "explain": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Deletes or cancels 1Claude Code: deny
  • update_rulesNeeds an API key.No findings

    Why it is in this group

    • The name "update_rules" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Needs an API key. Changes the Rules settings of one of your apps, which changes live signup blocking for that app: the next real signups are scored and refused under the new settings. Send only the settings to change. The others stay as they are. Setting mode to "enforce" starts refusing signups marked block, and "shadow" stops refusing any. If one value is wrong, nothing changes and the answer says which. Returns the app's rules afterwards, with the settings that changed. Confirm the change with the user first. A key made for one app changes that app, so leave out "app". An older all-apps key needs "app".

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Changes things 2Claude Code: ask
  • check_emailChecks one email address, and optionally the signup's IP address, the way SignupBouncer checks a new signup.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Checks one email address, and optionally the signup's IP address, the way SignupBouncer checks a new signup. Returns the result as "verdict" (allow, challenge or block), a 0-100 score, the reasons with their reason codes, the normalised inbox (Gmail dots and +tags folded) and the IP's network. When the domain looks like a typo of a big mail provider (gmial.com), "suggestion" holds the corrected address. Looks up the domain's mail servers live. Every reason is listed, including ones only paid plans count. Nothing sent is stored.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • explain_reasonExplains a SignupBouncer reason code (for example disposable_domain, burner_mx, repeat_inbox, datacenter_ip): what it means, how many points it adds or whether it blocks alone, and…1 finding

    Why it is in this group

    • The name "explain_reason" says "explain": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "explain_reason" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "explain_reason" says "explain": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Explains a SignupBouncer reason code (for example disposable_domain, burner_mx, repeat_inbox, datacenter_ip): what it means, how many points it adds or whether it blocks alone, and the lowest plan on which it counts. Without a code, lists every code.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 3Claude Code: allow
  • get_rulesNeeds an API key.No findings

    Why it is in this group

    • The name "get_rules" says "get": a word for reading.
    Description, as the server wrote it
    Needs an API key. Returns the Rules settings of one of your apps: shadow or enforce mode, the challenge and block score cutoffs, what a challenge does in the Supabase and Ory hooks, the message a refused person sees, the "Why was this refused?" link, the velocity thresholds and the setting of each check. The context part lists your plan, the checks that need a higher plan, the values each check takes and the defaults. A key made for one app reads that app, so leave out "app". An older all-apps key needs "app".

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • integration_guideReturns the steps and the copy-paste code that checks new signups with SignupBouncer in one stack: supabase (a hook, no code), ory (a web hook, no code), fetch (any TypeScript serv…No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns the steps and the copy-paste code that checks new signups with SignupBouncer in one stack: supabase (a hook, no code), ory (a web hook, no code), fetch (any TypeScript server), nextjs, express, hono, python, firebase or better-auth. Use it when the user is building or changing a signup, register or auth flow. The code reads the API key from SIGNUPBOUNCER_API_KEY. The call has a 1.5-second limit, and any failure lets the signup through.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • lookup_burner_domainSays whether a domain is on SignupBouncer's disposable (burner) email list, only on an old burner list (a challenge, not a block), a known relay service or a free subdomain mail se…No findings

    Why it is in this group

    • The name "lookup_burner_domain" says "lookup": a word for reading.
    Description, as the server wrote it
    Says whether a domain is on SignupBouncer's disposable (burner) email list, only on an old burner list (a challenge, not a block), a known relay service or a free subdomain mail service, or a known real mailbox provider, and when our harvester observed it. Uses only the loaded lists, no DNS lookup, so a brand-new burner domain on a burner mail server is caught only by check_email. Accepts a domain or an email address.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http checker https://signupbouncer.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__checker__lookup_burner_domain",
      "mcp__checker__integration_guide",
      "mcp__checker__get_rules"
    ],
    "ask": [
      "mcp__checker__check_email",
      "mcp__checker__explain_reason"
    ],
    "deny": [
      "mcp__checker__update_rules"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as checker. Review it before you use it.