com.mambabuilt/mcp-b2b-prospect-engine
NPM · @MAMBALABSDEV/MCP-B2B-PROSPECT-ENGINE · SCANNED SEP 20
Enrich companies, discover hiring signals and find verified contacts in one actor.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 37 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability55
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1410 tokens (~1410/item across 1 items; 1 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management80
- Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 1 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 1 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the com.mambabuilt/mcp-b2b-prospect-engine server?
com.mambabuilt/mcp-b2b-prospect-engine runs locally as an npm package, launched with npx -y @mambalabsdev/mcp-b2b-prospect-engine. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @mambalabsdev/mcp-b2b-prospect-engine
claude mcp add com-mambabuilt-mcp-b2b-prospect-engine -- npx -y @mambalabsdev/mcp-b2b-prospect-engine
{
"mcpServers": {
"com-mambabuilt-mcp-b2b-prospect-engine": {
"command": "npx",
"args": [
"-y",
"@mambalabsdev/mcp-b2b-prospect-engine"
]
}
}
} {
"servers": {
"com-mambabuilt-mcp-b2b-prospect-engine": {
"command": "npx",
"args": [
"-y",
"@mambalabsdev/mcp-b2b-prospect-engine"
]
}
}
} codex mcp add com-mambabuilt-mcp-b2b-prospect-engine -- npx -y @mambalabsdev/mcp-b2b-prospect-engine
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-mambabuilt-mcp-b2b-prospect-engine": {
"type": "local",
"command": [
"npx",
"-y",
"@mambalabsdev/mcp-b2b-prospect-engine"
],
"enabled": true
}
}
} openclaw mcp add com-mambabuilt-mcp-b2b-prospect-engine --command npx --arg -y --arg @mambalabsdev/mcp-b2b-prospect-engine
mcp_servers:
com-mambabuilt-mcp-b2b-prospect-engine:
command: "npx"
args: ["-y", "@mambalabsdev/mcp-b2b-prospect-engine"] {
"McpServers": {
"com-mambabuilt-mcp-b2b-prospect-engine": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@mambalabsdev/mcp-b2b-prospect-engine"
]
}
}
} assistant mcp add com-mambabuilt-mcp-b2b-prospect-engine -t stdio -c npx -a -y @mambalabsdev/mcp-b2b-prospect-engine
{
"mcpServers": {
"com-mambabuilt-mcp-b2b-prospect-engine": {
"command": "npx",
"args": [
"-y",
"@mambalabsdev/mcp-b2b-prospect-engine"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 −3
- Stability: pass → 0.80 functional
- 19 Sept 26 +1
- Stability: 0.97 → pass security
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 −3
- Stability: pass → 0.80 functional
- 12 Sept 26 +1
- Stability: 0.97 → pass security
- 10 Sept 26 −1
- Stability: pass → 0.93 functional
- 9 Sept 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@mambalabsdev/mcp-b2b-prospect-engine@1.0.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
run_prospect_engine Run Prospect Engine ~1,410
A composed prospecting actor with four modes. enrich_companies resolves identity, firmographics, LinkedIn and social for each domain or company name you supply, and needs no vendor key at all. discover_jobs finds who is hiring for your keywords and resolves the real employer behind each posting, including postings a job board placed on an employer's behalf. find_contacts finds people at the companies you name, with optional email discovery and verification. full runs discovery, enrichment, ICP scoring and then contact discovery, passing only the companies at or above min_icp_score through to the contact stage. Every row comes back flat and Clay ready with per field provenance. Vendor keys are yours: you supply them, those vendors bill you directly, and the per event price covers the actor only. discover_jobs and full require a SerpApi key, which is a different vendor from the Serper key that powers people search. Note that this actor is a pass through wrapper over the live actor, so any classification behavior you see is the actor's own. Requires an APIFY_TOKEN and consumes Apify credits. Read only: it enriches and discovers, it writes nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| bounceban_api_key | string | – | Your BounceBan key. Second verifier, used for the catch-all case. |
| company_names | array | – | One name per line. Used when you have a name but no domain. |
| company_size_max | string | – | Drop companies above this headcount. Same condition as the minimum. |
| company_size_min | string | – | Drop companies below this headcount. Only takes effect once headcount is known, so it applies in full mode and to any discovery row that carried an employee count. Discovery alone does not enrich. |
| country | string | – | Two letter country code for job search, for example us or gb. Default: "us". |
| departments | array | – | marketing, sales, engineering, product, finance, hr, operations, legal. |
| domains | array | – | One domain per line. Used by enrich_companies and find_contacts. |
| exclude_marketplaces | string | – | true to drop Upwork, Fiverr, Freelancer and similar gig listings. Default: "true". |
| exclude_staffing | string | – | true to drop postings from staffing and recruitment agencies. Default: "true". |
| extra_exclude_names | array | – | Any company whose name contains one of these is excluded. |
| extra_marketplaces | array | – | Additional marketplace names to filter out. |
| fetch_posting_page | string | – | true to open the job posting when the description alone does not identify the employer. Slower, and it is what catches a job board posting on an employer's behalf. Default: "true". |
| findymail_api_key | string | – | Your Findymail key. First provider in the email waterfall. |
| icp_preset | string | – | Which scoring model to apply. "editorial_services" scores for a seller of managed copy editing and proofreading. "generic_b2b" scores on hiring intent, employer resolvability and headcount with no se… |
| icypeas_api_key | string | – | Your Icypeas key. Runs on Findymail misses. |
| include_email | string | – | true to run the email waterfall. Needs an Icypeas or Prospeo key, which you supply and are billed for directly. Default: "false". |
| include_social | string | – | true to resolve Facebook, Instagram, X and YouTube alongside LinkedIn. Default: "true". |
| job_titles | array | – | Titles to search for when finding contacts. |
| keywords | array | – | Roles to search for. Used by discover_jobs and full. Example: copy editor, proofreader, content editor. Default: ["copy editor", "proofreader", "content editor"]. |
| location | string | – | Optional location filter for job search, for example New York. |
| lookback_days | string | – | Drop postings older than this many days. Sent as a string because Clay sends every field as a string. Default: "30". |
| max_pages | string | – | 1 to 5. Each page is one SerpAPI call, so this is the main cost dial on discovery. Default: "1". |
| max_results | string | – | Cap on postings returned per run. Keeps a broad keyword set from running away. Default: "25". |
| min_icp_score | string | – | In full mode, only companies scoring at or above this go on to contact discovery. Default 45: at 25 the filter passed every keyword-discovered editorial posting, because 25 is the floor such a postin… |
| mode | string | – | What to run. enrich_companies resolves identity, firmographics, LinkedIn and social for each company. discover_jobs finds who is hiring for your keywords and resolves the real employer from the job d… |
| new_postings_only | string | – | true to return only postings not seen in a previous run. Default: "false". |
| previous_run_date | string | – | YYYY-MM-DD watermark for delta detection when the cross-run cache is unavailable. |
| prospeo_api_key | string | – | Your Prospeo key. Runs on the residual after Findymail and Icypeas. |
| remote_only | string | – | true to keep only postings flagged remote by the board. Default: "false". |
| reoon_api_key | string | – | Your Reoon key. First email verification provider. |
| score_icp | string | – | true to score every row against the ICP rules and tier it A to D. Default: "true". |
| seniority | array | – | c_level, vp, director, manager, senior. |
| serpapi_key | string | – | Your SerpApi key. Required by discover_jobs and full. Distinct from a Serper key: different vendor. |
| serper_api_key | string | – | Your Serper.dev key. Powers people search in find_contacts, which is the highest-coverage layer. Without it the free fallback is measurably poor. |
| signal_taxonomy | array | – | Override the default signal types. Each entry is an object with type, strength, title_keywords, and optional also_keywords and description_keywords. |
| skip_cache | string | – | true to ignore the 7 day cross-run cache and recompute everything. Default: "false". |
| source_timeout_secs | string | – | 5 to 120. A source that exceeds this is marked degraded and the run continues. Default: "30". |
| target_contacts | string | – | 1 to 25. Default: "3". |
| verify_email | string | – | true to verify each address. Needs a Reoon or BounceBan key. Default: "true". |
No output schema declared.
No examples provided.
What is the com.mambabuilt/mcp-b2b-prospect-engine server?
com.mambabuilt/mcp-b2b-prospect-engine is listed in the public MCP registry as com.mambabuilt/mcp-b2b-prospect-engine. Enrich companies, discover hiring signals and find verified contacts in one actor. This page covers its npm package (@mambalabsdev/mcp-b2b-prospect-engine).
Is the com.mambabuilt/mcp-b2b-prospect-engine server safe to use?
com.mambabuilt/mcp-b2b-prospect-engine scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.mambabuilt/mcp-b2b-prospect-engine server expose?
com.mambabuilt/mcp-b2b-prospect-engine exposes 1 tool: run_prospect_engine. Their descriptions and schemas cost roughly 1,410 tokens of context every time the server is loaded.
Is the com.mambabuilt/mcp-b2b-prospect-engine server still maintained?
com.mambabuilt/mcp-b2b-prospect-engine is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the com.mambabuilt/mcp-b2b-prospect-engine server under?
com.mambabuilt/mcp-b2b-prospect-engine declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.