com.mambabuilt/mcp-b2b-prospect-engine
NPM · @MAMBALABSDEV/MCP-B2B-PROSPECT-ENGINE
Enrich companies, discover hiring signals and find verified contacts in one actor.
Available components
Last scanned (2 hours ago)
Scores higher than 53% of npm servers
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 19 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability56
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1943 tokens (~1943/item across 1 items; 1 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 1 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 1 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 31 Oct 26 0
- Stability: 0.97 → pass security
- 30 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- Stability: 0.97 → pass security
- 23 Oct 26 0
- Stability: pass → 0.97 functional
- 17 Oct 26 0
- Stability: 0.97 → pass security
- 16 Oct 26 +1
- Known CVEs: pass → unverified ▼ security
- Dependency health: 0.85 → unverified ▼ functional
- Package version: 1.1.1 → 1.2.0 functional
- Package version: 1.1.1 → 1.1.2 functional
- 14 Oct 26 +41
- Injection markers: unverified → pass ▲ security
- Schema quality: 1410 → 1867 ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.90 ▲ functional
- Package version: 1.0.2 → 1.1.1 functional
- 12 Oct 26 +1
- Security disclosure: unverified → pass ▲ functional
- Package version: 1.0.2 → 1.1.1 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@mambalabsdev/mcp-b2b-prospect-engine@1.2.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
run_prospect_engine Run Prospect Engine ~1,943
A composed prospecting actor with four modes. enrich_companies resolves identity, firmographics, LinkedIn and social for each domain or company name you supply, and needs no vendor key at all. discover_jobs finds who is hiring for your keywords and resolves the real employer behind each posting, including postings a job board placed on an employer's behalf. find_contacts finds people at the companies you name, with optional email discovery and verification. full runs discovery, enrichment, ICP scoring and then contact discovery, passing only the companies at or above min_icp_score through to the contact stage. Every row comes back flat and Clay ready with per field provenance. Vendor keys are yours: you supply them, those vendors bill you directly, and the per event price covers the actor only. discover_jobs and full require a SerpApi key, which is a different vendor from the Serper key that powers people search. Use it when you need companies, hiring signals, or contacts in one flat table. Do not use it to verify a single email you already have (that is the Work Email Waterfall) or to score a list you already enriched (that is the ICP Fit Scorer). Cost controls: max_results and max_pages bound discovery, target_contacts bounds contacts per company, target_roles skips paid lookups for non-matching contacts, and max_spend_usd caps your own vendor spend. Requires an APIFY_TOKEN and consumes Apify credits. Read only: it enriches and discovers, it writes nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| bounceban_api_key | string | – | Your BounceBan key. Second verifier, used for the catch-all case. |
| brand_voice | string | – | How the opener should sound. Leave empty and it writes plainly and directly. |
| claude_api_key | string | – | Your own Anthropic key, used for position verification and the personalized opener. Both steps are skipped when it is absent. Never stored. |
| company_concurrency | string | – | How many companies to work at once. Simultaneous provider calls are this times contact_concurrency; 6 x 3 = 18 sits under the tightest documented provider ceiling. Default: "6". |
| company_names | array | – | One name per line. Used when you have a name but no domain. |
| company_size_max | string | – | Drop companies above this headcount. Same condition as the minimum. |
| company_size_min | string | – | Drop companies below this headcount. Only takes effect once headcount is known, so it applies in full mode and to any discovery row that carried an employee count. Discovery alone does not enrich. |
| contact_concurrency | string | – | How many contacts to enrich at once within one company. The email waterfall itself always runs in order. Default: "3". |
| country | string | – | Two letter country code for job search, for example us or gb. Default: "us". |
| deny_tokens | array | – | Whole words that disqualify a contact even when the title matched a target role, for example product refuses Product Owner and keeps Production Editor. Applies even when no target roles are set. |
| departments | array | – | marketing, sales, engineering, product, finance, hr, operations, legal. |
| domains | array | – | One domain per line. Used by enrich_companies and find_contacts. |
| exclude_marketplaces | string | – | true to drop Upwork, Fiverr, Freelancer and similar gig listings. Default: "true". |
| exclude_staffing | string | – | true to drop postings from staffing and recruitment agencies. Default: "true". |
| extra_exclude_names | array | – | Any company whose name contains one of these is excluded. |
| extra_marketplaces | array | – | Additional marketplace names to filter out. |
| fetch_posting_page | string | – | true to open the job posting when the description alone does not identify the employer. Slower, and it is what catches a job board posting on an employer's behalf. Default: "true". |
| findymail_api_key | string | – | Your Findymail key. First provider in the email waterfall. |
| icp_preset | string | – | Which scoring model to apply. "editorial_services" scores for a seller of managed copy editing and proofreading. "generic_b2b" scores on hiring intent, employer resolvability and headcount with no se… |
| icypeas_api_key | string | – | Your Icypeas key. Runs on Findymail misses. |
| include_email | string | – | true to run the email waterfall. Needs an Icypeas or Prospeo key, which you supply and are billed for directly. Default: "false". |
| include_social | string | – | true to resolve Facebook, Instagram, X and YouTube alongside LinkedIn. Default: "true". |
| job_titles | array | – | Titles to search for when finding contacts. |
| keywords | array | – | Roles to search for. Used by discover_jobs and full. Example: copy editor, proofreader, content editor. Default: ["copy editor", "proofreader", "content editor"]. |
| location | string | – | Optional location filter for job search, for example New York. |
| lookback_days | string | – | Drop postings older than this many days. Sent as a string because Clay sends every field as a string. Default: "30". |
| max_charge_usd | number | – | Optional. The actor's own spend cap for this run, in USD. The run stops before a charge would take its total past this amount, writes one notice row saying so, and keeps every row already charged. Le… |
| max_pages | string | – | 1 to 5. Each page is one SerpAPI call, so this is the main cost dial on discovery. Default: "1". |
| max_results | string | – | Cap on postings returned per run. Keeps a broad keyword set from running away. Default: "25". |
| max_spend_usd | string | – | Stop making paid vendor calls once this much of your own vendor spend (Findymail, Icypeas, Prospeo, BounceBan) is committed, and return everything completed so far. Caps your vendor bills, not the Ap… |
| min_icp_score | string | – | In full mode, only companies scoring at or above this go on to contact discovery. Default 45: at 25 the filter passed every keyword-discovered editorial posting, because 25 is the floor such a postin… |
| mode | string | – | What to run. enrich_companies resolves identity, firmographics, LinkedIn and social for each company. discover_jobs finds who is hiring for your keywords and resolves the real employer from the job d… |
| new_postings_only | string | – | true to return only postings not seen in a previous run. Default: "false". |
| personalize | string | – | true to write a one or two sentence opener per contact that has an address, referencing something specific about the company. Needs claude_api_key; skipped without it. Default: "true". |
| previous_run_date | string | – | YYYY-MM-DD watermark for delta detection when the cross-run cache is unavailable. |
| prospeo_api_key | string | – | Your Prospeo key. Runs on the residual after Findymail and Icypeas. |
| remote_only | string | – | true to keep only postings flagged remote by the board. Default: "false". |
| score_icp | string | – | true to score every row against the ICP rules and tier it A to D. Default: "true". |
| seniority | array | – | c_level, vp, director, manager, senior. |
| serpapi_key | string | – | Your SerpApi key. Required by discover_jobs and full. Distinct from a Serper key: different vendor. |
| serper_api_key | string | – | Your Serper.dev key. Powers people search in find_contacts, which is the highest-coverage layer. Without it the free fallback is measurably poor. |
| signal_taxonomy | array | – | Override the default signal types. Each entry is an object with type, strength, title_keywords, and optional also_keywords and description_keywords. |
| skip_cache | string | – | true to ignore the 7 day cross-run cache and recompute everything. Default: "false". |
| source_timeout_secs | string | – | 5 to 120. A source that exceeds this is marked degraded and the run continues. Default: "30". |
| target_contacts | string | – | 1 to 25. Default: "3". |
| target_roles | array | – | Only enrich contacts whose title plausibly matches one of these roles. Filters after discovery and before any paid email lookup, so a non-matching contact costs nothing. Leave empty to keep every con… |
| verify_email | string | – | true to verify each address. Needs a BounceBan key. Default: "true". |
| verify_position | string | – | true to ask a model whether each contact's title on record is consistent and plausibly current, from the supplied evidence only. Needs claude_api_key; skipped without it. Contacts found on the compan… |
No output schema declared.
No examples provided.
How do I install the com.mambabuilt/mcp-b2b-prospect-engine server?
com.mambabuilt/mcp-b2b-prospect-engine runs locally as an npm package, launched with npx -y @mambalabsdev/mcp-b2b-prospect-engine. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @mambalabsdev/mcp-b2b-prospect-engine
claude mcp add com-mambabuilt-mcp-b2b-prospect-engine -- npx -y @mambalabsdev/mcp-b2b-prospect-engine
What is the com.mambabuilt/mcp-b2b-prospect-engine server?
com.mambabuilt/mcp-b2b-prospect-engine is listed in the public MCP registry as com.mambabuilt/mcp-b2b-prospect-engine. Enrich companies, discover hiring signals and find verified contacts in one actor. This page covers its npm package (@mambalabsdev/mcp-b2b-prospect-engine).
Is the com.mambabuilt/mcp-b2b-prospect-engine server safe to use?
com.mambabuilt/mcp-b2b-prospect-engine scores 76 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.mambabuilt/mcp-b2b-prospect-engine server expose?
com.mambabuilt/mcp-b2b-prospect-engine exposes 1 tool: run_prospect_engine. Their descriptions and schemas cost roughly 1,943 tokens of context every time the server is loaded.
Is the com.mambabuilt/mcp-b2b-prospect-engine server still maintained?
com.mambabuilt/mcp-b2b-prospect-engine is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the com.mambabuilt/mcp-b2b-prospect-engine server under?
com.mambabuilt/mcp-b2b-prospect-engine declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.