Tomba review, pricing and limits

Choose Tomba when an agent needs emails plus direct phone numbers from one credit pool, and you want OAuth sign-in from Claude Desktop or ChatGPT with no keys to manage. The free plan is only a smoke test. The vendor claims coverage of 450 million contacts across 80 million domains; verify the hit rate on your own segment before committing credits.

Tomba sells email finding and verification, and agents reach it through a remote Model Context Protocol server at mcp.tomba.io, open-sourced as tomba-io/tomba-mcp-server. It exposes 28 tools: domain search, email finder and verifier, author and LinkedIn finders, person and company enrichment, phone finder and validator, technology and similar-domain lookups, company search, and account management.

Maker: Tomba · Protocol: MCP · Auth: api key

Compatible agents: Claude Desktop (OAuth), Claude Code (plugin tomba@tomba, OAuth), ChatGPT (OAuth), Cursor, Windsurf, VS Code Copilot, Zed (header auth), Gemini CLI, Codex (plugin), Codeium, OpenClaw (Contact Intelligence skill), Any MCP client

Required runtime: Any MCP client for the remote server (no local install), Node.js only for the local npx tomba-mcp-server, Any HTTP client for the REST API

About Tomba

Tomba is an email-finding and verification service, founded in 2020, that exposes its whole data API to AI assistants through an open-source MCP server. Where a person would use the browser extension or the Google Sheets add-on, an agent connects to the remote server at mcp.tomba.io and gets typed tools for finding a person's address from a name and domain, listing every address at a company, verifying deliverability with catch-all detection, finding direct phone numbers, enriching a person or a company, and searching companies by industry, size and location. The server also ships resources (domain, email, similar-domain and technology lookups addressable as tomba:// URIs) and 16 pre-built prompt workflows, so an assistant can run a prospecting routine without the user writing API calls.

Authentication fits the client. Claude Desktop and ChatGPT authorise by OAuth in the browser with no keys to manage; Claude Code installs a plugin from the tomba-io marketplace and authenticates the server the same way; Cursor, Windsurf, VS Code, Zed, Gemini CLI and any other MCP client send an X-Tomba-Key and X-Tomba-Secret header pair or a Bearer token to the remote URL. A local npx server over stdio exists for clients that cannot reach remote servers, and the same package runs as a standalone HTTP server. Every call retries up to three times with exponential backoff on rate limits and server errors, and the server is also packaged as a Codex plugin and an OpenClaw skill.

Typical agent jobs: map a target account by domain and rank the addresses by confidence, enrich a CSV of names with verified emails and phone numbers, qualify an inbound lead by checking the address and the domain's status, or build a segment with companies_search filters and reveal the contacts. On HokAI the direct neighbour is Hunter, the other email-finding MCP in the directory; Orthogonal Find Leads covers pay-per-call lead pulls on that gateway, Riveter enriches whole tables with sources, and the Pipedrive MCP Server and Google Sheets skills are where the results usually land.

Billing is one credit pool shared across every endpoint and sized on a slider from a few thousand to two million credits a month, monthly or as a one-time purchase valid for a year; verification credits are bundled free with the finder credits on a plan, phone lookups cost more than email lookups, a search that returns nothing costs nothing, and a repeated lookup of the same target in the same period is not charged again. The vendor states data coverage of several hundred million contacts and GDPR-compliant processing of public business data with opt-outs honoured; an enterprise contract removes the per-second and per-minute rate limits.

The MCP server is public on GitHub and documents its tools, resources, prompts, rate-limit table and retry policy in one README, which is more than most data vendors publish for agents. If you are choosing between email finders, enrichment platforms and lead databases for an agent, Smart Match asks the five questions that decide it.

Key Features

• Tools, resources and prompts in one server: The remote server covers discovery, verification, enrichment, phone, domain intelligence, company search and account management, plus tomba:// resources and 16 ready-made prospecting prompts.
• OAuth where the client allows it: Claude Desktop, ChatGPT and the Claude Code plugin authorise in the browser; other clients send key and secret headers or a Bearer token.
• Catch-all verification with scores: The verifier returns a confidence score on catch-all domains where other tools return unknown, per the vendor.
• Phone finder and validator: Direct dials from an email, domain or LinkedIn URL, and validation with line type and carrier, alongside the email tools.
• Retries and timeouts built in: Every call times out at 120 seconds and retries 429 and 5xx responses up to 3 times with exponential backoff.
• Open-source server: tomba-io/tomba-mcp-server on GitHub, installable via npx, as a Claude Code plugin, a Codex plugin or an OpenClaw skill.
• Credit recovery flags: create_flag reports hard bounces and invalid data so the credit is refunded.

Use Cases

• Account mapping before outreach: Run domain_search on the target, read confidence scores and sources, then email_verifier on the shortlist and phone_finder for the two decision makers.
• CSV enrichment with phone numbers: For each name and domain row, email_finder then email_enrichment, adding a direct dial with phone_finder where the deal size justifies the higher credit cost.
• Inbound lead triage: Check domain_status for webmail or disposable domains, verify the address, and pull company_enrichment so the agent can score the lead before replying.
• Segment building and reveal: companies_search with industry, size and city filters returns matching companies; the agent then reveals contacts for the ones that fit and saves them with create_lead.

Install

/plugin marketplace add tomba-io/tomba-mcp-server && /plugin install tomba@tomba

Requirements

• A Tomba account (app.tomba.io); the API key and secret live under the dashboard's API settings for header-based clients
• For OAuth clients (Claude Desktop, Claude Code plugin, ChatGPT): authenticate the tomba server in the browser when prompted; no keys in config
• Credits on the account; a plan includes verification credits alongside the finder credits

Actions

Domain Search

Lists every email address Tomba has found for a domain, paginated, with confidence and sources.

{ "domain": "tomba.io", "limit": 10, "page": 1 }

• domain (string) — required: Company domain.
• limit (number): Addresses per page.
• page (number): Page number.

Email Finder

Returns the most likely professional email for a person from their name and company domain.

{ "domain": "example.com", "firstName": "John", "lastName": "Doe" }

• domain (string) — required: Employer domain.
• firstName (string) — required: Given name.
• lastName (string) — required: Family name.

Email Verifier

Checks an address for deliverability, catch-all status and presence in Tomba's database.

{ "email": "b.mohamed@tomba.io" }

• email (string) — required: Address to verify.

Author Finder

Finds the author of an article and their email from the article URL.

{ "url": "https://example.com/article" }

• url (string) — required: Article URL.

LinkedIn Finder

Returns the verified email behind a LinkedIn profile URL.

{ "url": "https://linkedin.com/in/johndoe" }

• url (string) — required: LinkedIn profile URL.

Email Count

Reports how many addresses Tomba holds for a domain, split by type and department.

{ "domain": "stripe.com", "type": "personal" }

• domain (string) — required: Domain to count.

Email Sources

Lists the web pages where an address was found.

{ "email": "press@tomba.io" }

• email (string) — required: Address to trace.

Email Format

Returns the address patterns a domain uses, for example first.last.

{ "domain": "zapier.com" }

• domain (string) — required: Domain to inspect.

Email Enrichment

Adds contact and company data to an email address.

{ "email": "hello@tomba.io" }

• email (string) — required: Address to enrich.

Person Enrichment

Returns a person's name, position and social profiles from an email.

{ "email": "sales@notion.so" }

• email (string) — required: The person's address.

Company Enrichment

Returns industry, size, location and socials for a company domain.

{ "domain": "airwallex.com" }

• domain (string) — required: Company domain.

Combined Enrichment

Person plus company enrichment in a single call from an email.

{ "email": "ceo@example.org" }

• email (string) — required: Address to enrich fully.

Phone Finder

Finds direct phone numbers from an email, a domain or a LinkedIn profile.

{ "domain": "notion.so" }

• email (string): Contact's address.
• domain (string): Company domain.
• linkedin (string): LinkedIn profile URL.

Phone Validator

Validates a phone number and returns format, line type and carrier.

{ "phone": "+213667945402" }

• phone (string) — required: Number in international format.

Domain Status

Tells whether a domain is a webmail or disposable provider.

{ "domain": "gmail.com" }

• domain (string) — required: Domain to classify.

Autocomplete

Suggests company names with their domains and logos from a partial query.

{ "query": "grab" }

• query (string) — required: Partial company name.

Similar Finder

Finds companies similar to or competing with a domain.

{ "domain": "hunter.io" }

• domain (string) — required: Reference domain.

Technology Finder

Reveals the technology stack a website runs.

{ "domain": "shopify.com" }

• domain (string) — required: Website domain.

Location

Counts a domain's employees by country.

{ "domain": "grab.com" }

• domain (string) — required: Company domain.

Companies Search

Searches companies by natural-language query and filters for city, industry, size, revenue and more; one credit reveals up to fifty.

{ "filters": { "location_city": { "include": ["san francisco"] }, "industry": { "include": ["technology"] }, "size": { "include": ["51-200", "201-500"] } } }

• query (string): Natural-language description.
• filters (object): include and exclude lists for location_city, location_country, industry, size, revenue and other fields.

Account Info

Returns the plan, remaining credits and limits for the authenticated account.

{}

Usage Info

Returns API usage statistics across all endpoints.

{ }

List Flags

Lists data flags you submitted, with status and any credit refunds.

{
}

Create Flag

Reports incorrect data such as a hard bounce so the credit can be recovered.

{ "email": "bounced@example.com", "reason": "hard_bounce" }

• email (string) — required: The address to flag.
• reason (string): Why the data was wrong.

List Leads

Lists saved leads, optionally filtered by domain.

{ "domain": "notion.so" }

• domain (string): Filter by company domain.

Create Lead

Adds a contact to a leads list.

{ "email": "jane@example.com", "full_name": "Jane Tan", "company": "Example" }

• email (string) — required: Lead's address.
• full_name (string): Lead's name.
• company (string): Employer.

List Keys

Lists the account's API keys.

{   }

Get Logs

Returns recent API request logs for the account.

{ "limit": 20 }

• limit (number): Entries to return.

How to Invoke

Remote MCP server at https://mcp.tomba.io/mcp (OAuth for Claude Desktop, ChatGPT and Claude Code's plugin; X-Tomba-Key and X-Tomba-Secret headers or Authorization: Bearer base64(key:secret) for other clients) exposing 28 tools, 7 resources and 16 prompts; a local npx tomba-mcp-server over stdio or HTTP; or the REST API documented at docs.tomba.io/api.

Pricing

One credit pool across all endpoints, chosen on a slider (tomba.io/pricing, read 11 October 2026). Growth starts at 5,000 credits; the page's example is 10,000 credits for $89 a month, split 5,000 finder and search credits plus 5,000 verification credits bundled free, at $8.90 per 1,000 credits; the slider runs to 2,000,000. Pay as you go buys the same credits once with 12 months validity; yearly billing gives 3 months free. Scale 300k is self-serve at 300,000 credits a month. Enterprise is $2,499 a month on an annual contract: uncapped API access, 100,000 API calls a day, custom endpoints, SSO, audit log. Credit costs: 1 credit per valid email found, verified or enriched, per similar-domain or technology lookup and per phone validated; 1 credit reveals up to 50 companies; 5 credits per phone lookup. No charge when no result is found; duplicate lookups in the same month are free. A free plan exists (rate-limited to 5 requests a day); its credit allowance is not stated on the pricing page.

Strengths

• Searches that return nothing cost nothing, and repeated lookups in the same month are free, which suits agents that retry.
• The server's rate-limit table, retry policy and every tool are documented publicly in one README.
• Verification credits come bundled with finder credits on a plan, so verifying what you find is not a second bill.

Weaknesses

• The free plan is limited to 5 requests a day, which is too little for anything beyond a smoke test.
• Rate limits on the self-serve plans are per second and per minute; only plans of 50,000 credits and above or Enterprise lift them.
• Phone lookups cost five times an email lookup, so an agent that always asks for a phone number burns credits quickly.

View the official Tomba skill page