Use FindLeadEmails in Cursor, Claude and other AI agents

Claude, ChatGPT, Codex, VS Code, Cursor, Windsurf, and other clients that speak MCP authorization can connect without a pasted key. The server publishes protected-resource metadata at /.well-known/oauth-protected-resource and authorization server metadata at /.well-known/oauth-authorization-server. A tool call with no credential returns HTTP 401 with a WWW-Authenticate header so the client starts sign-in.

You sign in with your existing FindLeadEmails account, pick the workspace, and approve. The app then calls tools with a short-lived access token for that workspace. Credits are spent the same way as an API key. Revoke the app any time on the Developers page. API keys keep working on the same URL, and listing tools still does not need a credential.

Sign in and open Developers. Create a key, copy it when it is shown, and paste it as the header Authorization: Bearer YOUR_API_KEY on every tool call. Only a hash is stored, so a lost key cannot be displayed again — rotate it on that page to get a new value. Clients that support OAuth can skip this step.

Open Settings, then Connectors, then Add custom connector. Paste https://www.findleademails.com/api/mcp. Choose Sign in when needed, and keep Use Claude's published identity.

Sign in with OAuth by installing the server URL with no Authorization header. Cursor starts sign-in on the first tool call.

Add to Cursor

That button is Cursor's install deeplink (cursor://anysphere.cursor-deeplink/mcp/install). name is findleademails, and config is the base64 of {"url":"https://www.findleademails.com/api/mcp"}. Cursor asks before it installs. The same entry written by hand:

{
  "mcpServers": {
    "findleademails": {
      "url": "https://www.findleademails.com/api/mcp"
    }
  }
}

Project config goes in .cursor/mcp.json. A file at ~/.cursor/mcp.json applies to every project. To use an API key instead, add headers and paste the key into Authorization, replacing YOUR_API_KEY.

{
  "mcpServers": {
    "findleademails": {
      "url": "https://www.findleademails.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

To keep the key out of the file, Cursor will substitute ${env:FINDLEADEMAILS_API_KEY} inside headers.

Sign in with OAuth by adding the remote URL and no API key. When the app offers Connectors, use the same steps as Claude: Settings, Connectors, Add custom connector, paste https://www.findleademails.com/api/mcp, choose Sign in when needed, and keep Use Claude's published identity. A config file can hold the URL on its own:

{
  "mcpServers": {
    "findleademails": {
      "url": "https://www.findleademails.com/api/mcp"
    }
  }
}

If that build only runs a local command, bridge with mcp-remote via npx (Node.js 18 or newer) and paste an API key. The header is passed without a space after the colon because some clients split arguments on spaces; the bearer value, which contains a space, lives in env. Paste the API key there as Bearer YOUR_API_KEY so the bridge sends it as the Authorization header.

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json. Windows: %APPDATA%\Claude\claude_desktop_config.json. If the file is missing, enable it under Settings → Developer. Quit and reopen Claude Desktop after saving.

{
  "mcpServers": {
    "findleademails": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://www.findleademails.com/api/mcp",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Add the server without a key, then open /mcp and choose Authenticate.

claude mcp add --transport http findleademails https://www.findleademails.com/api/mcp

--transport http is the remote HTTP transport. To send an API key instead, add --header and replace YOUR_API_KEY:

claude mcp add --transport http findleademails https://www.findleademails.com/api/mcp --header "Authorization: Bearer YOUR_API_KEY"

Sign in with OAuth. The install link uses https://vscode.dev/redirect/mcp/install with name=findleademails and a urlencoded config of {"type":"http","url":"https://www.findleademails.com/api/mcp"}. Omitting headers is what starts sign-in.

Add to VS Code

The same entry in .vscode/mcp.json:

{
  "servers": {
    "findleademails": {
      "type": "http",
      "url": "https://www.findleademails.com/api/mcp"
    }
  }
}

To use an API key, keep the top-level servers object and type "http". When VS Code prompts, paste the API key. It is sent as the Authorization header.

{
  "inputs": [
    {
      "type": "promptString",
      "id": "findleademails-api-key",
      "description": "Paste your FindLeadEmails API key. It is sent as Authorization: Bearer YOUR_API_KEY.",
      "password": true
    }
  ],
  "servers": {
    "findleademails": {
      "type": "http",
      "url": "https://www.findleademails.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${input:findleademails-api-key}"
      }
    }
  }
}

A portable .mcp.json at the workspace root uses mcpServers instead of servers and does not prompt with ${input:…}. In that file, paste the key directly into headers.Authorization as Bearer YOUR_API_KEY.

Sign in with OAuth by setting serverUrl and leaving out headers. Cascade reads mcp_config.json. On macOS and Linux that file is ~/.config/devin/mcp_config.json (or $XDG_CONFIG_HOME/devin/mcp_config.json). On Windows it is %APPDATA%\devin\mcp_config.json. Open it from the Cascade panel's actions menu.

{
  "mcpServers": {
    "findleademails": {
      "serverUrl": "https://www.findleademails.com/api/mcp"
    }
  }
}

To use an API key, add headers and paste the key into Authorization.

{
  "mcpServers": {
    "findleademails": {
      "serverUrl": "https://www.findleademails.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

To keep the key out of the file, replace the header value with Bearer ${env:FINDLEADEMAILS_API_KEY}. Devin Local, the default agent in new tabs, stores MCP servers in the Devin CLI config instead of this file.

In ChatGPT, open Settings, then Connectors, and add a custom connector. Paste https://www.findleademails.com/api/mcp and sign in when ChatGPT asks. Pick the workspace whose credits the connector should spend.

In Codex, add the same URL and authenticate. The CLI command does not include an API key:

codex mcp add findleademails --url https://www.findleademails.com/api/mcp

An API key still works if the client asks for a bearer token. Send Authorization: Bearer YOUR_API_KEY.

Install the extension from github.com/findleademails/findleademails-mcp. It points Gemini CLI at this server. Sign in when the client asks, or set the API key the extension requests.

gemini extensions install https://github.com/findleademails/findleademails-mcp

Add a remote server with type streamableHttp and no API key so Cline can sign in with OAuth. Paste an Authorization header only if you want to use a key.

{
  "mcpServers": {
    "findleademails": {
      "url": "https://www.findleademails.com/api/mcp",
      "type": "streamableHttp"
    }
  }
}

On a Pro, Max, or Enterprise account, open Connectors, add a custom remote connector, and choose the API key option rather than OAuth. The server URL is below. Paste the API key so the connector sends it as a request header. If the form asks for the header name, use Authorization with the value Bearer YOUR_API_KEY.

URL: https://www.findleademails.com/api/mcp
Header: Authorization: Bearer YOUR_API_KEY

On grok.com, open Connectors, choose New Connector, then Custom, and enter the server URL. When Grok asks for authentication, paste the API key so requests carry Authorization: Bearer YOUR_API_KEY. Business and Enterprise workspaces need an admin to provision custom connectors first.

The xAI API sends the authorization field as the header Authorization: Bearer <token>. Paste the API key itself into authorization, without the word Bearer.

{
  "type": "mcp",
  "server_url": "https://www.findleademails.com/api/mcp",
  "server_label": "findleademails",
  "authorization": "YOUR_API_KEY"
}

The Grok CLI takes the header directly. Paste the API key into that header:

grok mcp add --transport http findleademails https://www.findleademails.com/api/mcp --header "Authorization: Bearer YOUR_API_KEY"

A client that takes a remote server as a URL plus headers uses this shape. Paste the API key into the Authorization header. If that client's own docs use different keys, follow those docs.

{
  "mcpServers": {
    "findleademails": {
      "url": "https://www.findleademails.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

The server is listed in the official MCP registry, Glama, cursor.directory, and GitHub.

Listing tools does not need a key. The handler requires both Accept values on a POST. A success comes back as a server-sent event: message whose data line is the JSON-RPC result listing the 6 tools. No session header is required, and nothing is charged.

curl https://www.findleademails.com/api/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

A tool call needs the key. Paste it as the Authorization header. Without that header the server answers HTTP 401 with {"error":"invalid_token","error_description":"No authorization provided. A free FindLeadEmails account includes free credits. Create one at https://www.findleademails.com/signup, then connect https://www.findleademails.com/api/mcp and sign in with OAuth. Or send Authorization: Bearer <your API key>."} and the tool does not run.

curl https://www.findleademails.com/api/mcp \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"verify_email","arguments":{"email":"jane.doe@company.com"}}}'

Each tool takes the same fields as the matching REST route. verify_email wants one email. A single lookup wants first_name, last_name, and company_domain. A LinkedIn company page URL can stand in for the domain; resolving it costs 1 credit only when it finds a match, separate from the lookup.

find_emails_bulk is synchronous and capped. Above that cap it returns batch_too_large with max_rows. get_job_results pages with cursor until next_cursor is null, and it can be read while the job is still running.

Billing is the same wallet as the dashboard and the REST API. A verified result costs 1 credit. A catch-all is free — the domain accepts every address, so no specific mailbox can be confirmed. A miss (not_found) is free, and so is a repeat lookup of someone already found. A predicted result is free when verification ran but could not reach a verdict. verify_email costs 1 credit only when that mailbox is confirmed valid. Invalid, catch-all, unknown, and a repeat check of the same address are free.

create_job reserves one credit per row up front and refunds the unused portion as rows resolve. Credits never expire.

find_email, verify_email, find_emails_bulk, and create_job use the same per-workspace ceilings as the synchronous REST endpoints. The numbers are on Rate limits. Reading a job's status or results is not rate limited.

A failed tool call is not an HTTP error from the agent's point of view. The tool result is flagged as an error and its text is JSON { "error", "code", ... }.

Listing tools does not require a credential. Before a tool runs, a missing or rejected credential is HTTP 401. The JSON body tells an API-key client what header to send, and WWW-Authenticate includes resource_metadata so an OAuth client can sign in. After a valid credential, a POST without Accept: application/json, text/event-stream is HTTP 406.