com.mambabuilt/mcp-gtm-suite
NPM · @MAMBALABSDEV/MCP-GTM-SUITE
21 Mamba Labs account-intelligence MCP tools in one server: identity, signals, ICP. Clay-ready.
Available components
Last scanned (8 hours ago)
Scores higher than 53% of npm servers
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 19 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability59
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 10833 tokens (~515/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management98
- Stability check failed: the tool surface changed between 1.9.0 and 1.14.0: 0 tool removals, 1 breaking changes, 0 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 21 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 16 Oct 26 0
- Stability: 0.93 → fail ▼ security
- Schema quality: 441 → 515 ▼ functional
- Schema quality: 441 → 508 ▼ functional
- Package version: 1.12.0 → 1.14.0 functional
- Package version: 1.12.0 → 1.13.0 functional
- 15 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Oct 26 +41
- Injection markers: unverified → pass ▲ security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.90 ▲ functional
- Package version: 1.9.0 → 1.12.0 functional
- 12 Oct 26 +1
- Security disclosure: unverified → pass ▲ functional
- Package version: 1.9.0 → 1.12.0 functional
- Package version: 1.10.0 → 1.10.1 functional
- 11 Oct 26 −41
- Stability: 0.80 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Security disclosure: pass → unverified ▼ functional
- Package version: 1.3.0 → 1.10.0 functional
- 4 Oct 26 −3
- Stability: pass → 0.80 functional
- 3 Oct 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@mambalabsdev/mcp-gtm-suite@1.14.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
aggregate_gtm_signals Aggregate GTM Signals ~252
Aggregate a company's GTM signals into one composite score. Runs hiring and tech-stack detection by default, plus funding, events, or workplace when named in sources, in one call and returns a composite score, recommended action, and optional summary as a flat, Clay-ready JSON row. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per call.
| Name | Type | Req | Description |
|---|---|---|---|
| company_domain | string | yes | Bare company domain, e.g. stripe.com |
| explain_mode | boolean | – | If true, the summary becomes a longer, more detailed explanation. |
| include_summary | boolean | – | Include a plain-English gtm_signal_summary. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| sources | array | – | Which signals to aggregate. Defaults to hiring and tech_stack. Each extra source adds one sub actor run to the bill and one dimension to the composite score, which is normalized over the sources sele… |
No output schema declared.
No examples provided.
audit_agent_accessibility Audit Agent Accessibility ~431
Give it a domain and it returns whether an AI agent can read that site, and what the site's policy says, as one flat row of 42 fields across five families: the llms.txt family including llms-full.txt and ai.txt, robots.txt AI crawler policy including the newer Content Signal directives, structured data presence and health across JSON-LD, microdata, Open Graph and canonical, render mode, and machine readable endpoint discovery covering sitemap, OpenAPI, well known files and feeds. Every field is a fact read off a fetch. No model is called at any point, so the same domain returns the same row today and next month unless the site actually changed. Twelve requests per domain, typically 2 to 4 seconds. Built for a technical SEO or growth engineer preparing a site for AI crawlers, or an agency selling that work and needing a before and after audit across a client list. Requires an APIFY_TOKEN and consumes Apify credits. Read only.
| Name | Type | Req | Description |
|---|---|---|---|
| check_endpoints | boolean | – | Probes sitemap, OpenAPI, well known files and feeds. Adds 7 concurrent requests. Default: true. |
| check_structured_data | boolean | – | Parses JSON-LD, microdata, Open Graph and canonical off the homepage. Costs no extra requests. Default: true. |
| checks | array | – | Run only these checks. Omit for all of them. Narrowing narrows the work, and the score is rescaled over the checks selected. |
| domain | string | yes | One company domain, for example vercel.com. Protocol and path are stripped. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| skipCache | string | – | Leave as false to use the 7 day cache. Set to true to re-audit the domain from scratch. Default: "false". |
No output schema declared.
No examples provided.
capture_linkedin_posts_and_commenters Capture LinkedIn Posts and Commenters ~388
Point it at LinkedIn person profiles or company pages and it returns the posts a search engine has indexed for each one, as flat rows: permalink, author, a text excerpt, and the publish date decoded from the post id. No request is sent to LinkedIn and no cookie or account is used. A result counts only when its permalink names the source, so posts are never attributed to the wrong author. Coverage is what the search index holds: posts appear days or weeks after publishing and many never appear. Commenters, reaction counts, comment counts and media are no longer returned (removed 2026-10-12, they came only from LinkedIn pages). Rows carry row_type post or notice; filter on row_type before loading a table. post_id is the activity URN and is stable across runs. Every row carries degraded and degradation_reason. Requires an APIFY_TOKEN and consumes Apify credits. Read only.
| Name | Type | Req | Description |
|---|---|---|---|
| company_urls | array | – | LinkedIn company page URLs, for example https://www.linkedin.com/company/microsoft. Supply this, profile_urls, or both. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| posted_since | string | – | ISO date or timestamp, for example 2026-08-01. Posts published before this are skipped BEFORE anything is charged. Leave empty to take everything the index holds. |
| profile_urls | array | – | LinkedIn person profile URLs, for example https://www.linkedin.com/in/williamhgates. Country subdomains such as uk.linkedin.com are fine. Supply this, company_urls, or both. |
No output schema declared.
No examples provided.
classify_contact Classify Contact ~607
One contact in, one classified row out. Give it a job title and it returns the department, the seniority level, a seniority_rank from 1 to 12 you can filter with a comparison, and classification_rule, the named rule that fired, so every decision is auditable. The classification is a deterministic rule table: it needs no API key, calls no model, and returns the same answer for the same title every time. Only job_title is required. full_name and company_domain are read only when verify_position is on, which checks whether the person is still listed on their employer's own website and adds roughly 3 seconds and 9 requests per contact. The optional LLM fallback for titles the rules cannot place runs on your own key, set as the LLM_API_KEY secret environment variable on your own copy of the actor, and only the title is ever sent, never the person's name. With no key set those titles come back null rather than failing the row. This actor does not discover people: the name and title come from you. Requires an APIFY_TOKEN and consumes Apify credits. Read only.
| Name | Type | Req | Description |
|---|---|---|---|
| company_domain | string | – | Only needed for position verification. The company's website domain, with or without https. |
| full_name | string | – | Only needed for position verification. Classification works without it. This name is never sent to any language model. |
| job_title | string | yes | The contact's job title, exactly as you hold it. Classified by deterministic rules with no API key needed. |
| llm_model | string | – | Model id passed straight through to the provider. Only read when the LLM fallback is on. Default: "gpt-4o-mini". |
| llm_provider | string | – | Which provider your LLM_API_KEY belongs to. Only read when the LLM fallback is on. Default: "openai". |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| skipCache | string | – | Set to true to ignore cached results and classify from scratch. Default: "false". |
| use_llm_fallback | boolean | – | Off by default. When on, titles the rules cannot place are sent to your own model using the LLM_API_KEY secret environment variable you set on your copy of this Actor. Only the title is sent, never t… |
| verify_position | boolean | – | Check whether the person is still listed on their employer's own website. Off by default. Adds roughly 3 seconds and 9 requests per contact, and needs both the name and the domain. Default: false. |
No output schema declared.
No examples provided.
detect_ai_tooling Detect AI Tooling ~419
Given a company domain, determine how far that company has gone with AI. Returns an ai_maturity tier of none, declared (says AI but nothing observable is running), deployed (AI tooling is live on the site), or commercialized (the pricing page charges for AI via credits, tokens, an add-on, an AI-named plan, or a per-outcome price), plus the detected AI vendors, validated llms.txt status, robots.txt AI-crawler policy, and the evidence behind the verdict. A domain behind a bot challenge returns blocked=true at low confidence rather than a false negative. Returns flat, Clay-ready JSON. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per domain analyzed.
| Name | Type | Req | Description |
|---|---|---|---|
| check_pricing | boolean | – | Fetch and score the pricing page. Default true. Setting this false is faster but caps the result at 'deployed', because 'commercialized' can only be proven on a pricing page. |
| domain | string | – | Company domain to analyze, without https or www, e.g. intercom.com. |
| domains | array | – | Batch mode: several company domains analyzed in one call. Takes precedence over domain. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| request_timeout_ms | integer | – | Per-request timeout in milliseconds. 3000 to 20000. Default: 9000. |
| skipCache | boolean | – | Force a fresh analysis and ignore the 7 day result cache. |
| vendors | array | – | Report only these AI vendors. Omit to report every one. Detection is unchanged, so filtering costs nothing extra. The ai_maturity verdict, llms.txt, robots.txt, and pricing reads are site wide and ne… |
No output schema declared.
No examples provided.
detect_gtm_tech_stack Detect GTM Tech Stack ~302
Detect which GTM tools a company uses from its public website. Returns CRM, sequencer, and marketing automation signals with per-tool boolean flags as a flat, Clay-ready JSON row. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per call.
| Name | Type | Req | Description |
|---|---|---|---|
| company_domain | string | – | Deprecated alias for domain, accepted by the actor for older callers. Prefer domain. |
| crawl_additional_pages | boolean | – | Crawl up to 2 extra pages for better coverage. Defaults to true when omitted. |
| domain | string | – | Bare company domain, e.g. stripe.com. Supply this, company_domain or url. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| skipCache | boolean | – | By default a clean detection is cached for 7 days and reused. Set true to force a fresh detection. |
| technologies | array | – | Report only these tools. Omit to report every detectable tool. Only tools with a client side fingerprint are selectable. Detection is unchanged, so filtering costs nothing extra. |
| url | string | – | Deprecated alias for domain, accepted by the actor as a full company website URL. Prefer domain. |
No output schema declared.
No examples provided.
enrich_company_firmographics Enrich Company Firmographics ~279
Enrich a company domain into structured firmographics: employee band, industry, HQ, founded year, revenue estimate, logo, and description, with source provenance. Parsed from the company's schema.org/Organization JSON-LD and HTML meta tags and returned as a flat, Clay-ready JSON row with a source_signals array and a data_completeness score. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per call.
| Name | Type | Req | Description |
|---|---|---|---|
| batchSize | number | – | Domains enriched concurrently per wave in batch mode. Default 5, maximum 10. |
| company_name | string | – | Optional company name, used as a fallback label when the page does not expose one. |
| domain | string | – | Bare company domain to enrich, e.g. stripe.com. Provide this or domains. |
| domains | array | – | List of bare domains for batch processing. Takes precedence over domain. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| skipCache | boolean | – | Force a fresh enrichment and ignore the 7 day result cache. |
No output schema declared.
No examples provided.
fingerprint_outbound_infrastructure Fingerprint Outbound Infrastructure ~595
Given a company domain, determine whether that company runs cold email outbound and on what stack. Returns a runs_outbound verdict of program (a deliberate cold outbound setup), light (one weak signal), none, or unknown, with the evidence behind it. The strongest signal is the lookalike sending domains a real program leaves behind: domains like getcompany.com or company-mail.com that carry their own mail and redirect back to the primary site. Also returns the inbox provider (Google Workspace, Microsoft 365 and others) for the primary domain and each sending domain, any detected sending platform (Outreach, Salesloft, Lemlist, Instantly, Smartlead, Apollo and more), registration clusters showing sending domains bought on the same day, cold email infrastructure vendors, and SPF, DKIM and DMARC posture. Sending platform recall is partial by design: sequencers that connect over OAuth to a customer's own mailbox leave no DNS trace, so an empty sending_platforms means little while a populated one is solid. Public DNS and HTTP redirects only. Returns flat, Clay-ready JSON. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per domain analyzed.
| Name | Type | Req | Description |
|---|---|---|---|
| check_deliverability | boolean | – | Add a blacklist check and a 0-100 health score by running the separate Domain Deliverability Checker actor, which bills its own per-domain rate on top of this one. Default false. SPF, DKIM and DMARC… |
| dns_timeout_ms | integer | – | Per-DNS-lookup timeout in milliseconds. |
| domain | string | – | Company domain to analyze, without https or www, e.g. smartlead.ai. |
| domains | array | – | Batch mode: several company domains analyzed in one call. Takes precedence over domain. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| max_sending_domain_probes | integer | – | Cap on how many candidate sending domains are probed per company. Lower it to bound run time on companies with many lookalike domains. |
| request_timeout_ms | integer | – | Per-HTTP-request timeout in milliseconds. |
| scan_sending_domains | boolean | – | Scan for lookalike sending domains. Default true. The strongest signal and the slowest step; turning it off caps the verdict at what platform and deliverability signals alone can prove. |
| sending_domain_depth | string | – | deep (default) checks .com, .co, .io, .net and .org. standard drops .net and .org. |
| skipCache | boolean | – | Force a fresh analysis and ignore the 7 day result cache. |
No output schema declared.
No examples provided.
get_company_changes Get Company Changes ~382
Monitor a company domain for changes across hiring, tech stack, funding, firmographics, and social since the last run. Returns only what changed as typed change events in flat, Clay-ready JSON. Pass sources to watch fewer than all five sources and min_severity to drop minor changes; each source left out is one fewer sub actor run on the bill. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per call.
| Name | Type | Req | Description |
|---|---|---|---|
| company_name | string | – | Optional company name hint, used when the domain does not match the brand name, e.g. Deel for deel.com. |
| domain | string | yes | Company domain to monitor, without https or www, e.g. stripe.com. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| min_severity | string | – | Report only changes at or above this severity. low reports every change and is the default. high keeps leadership moves, funding, acquisitions, and a CRM or sequencer appearing or disappearing. |
| previous_snapshot | object | – | Snapshot object returned by a prior run. Supply it and it is the baseline instead of stored state, which is what makes a scheduled run cheap. |
| sources | array | – | Which sources to monitor. Omit for all five. Each source left out is one fewer sub actor run per company, so a single source watch is billed for one source, not five. |
| sub_actor_timeout_secs | integer | – | Per-child run timeout in seconds. Children run in parallel, so total wall time is about the slowest child. Default: 300. |
No output schema declared.
No examples provided.
get_funding_press_signals Get Funding and Press Signals ~248
Scan Google News and PR wires for funding rounds, executive moves, product launches, and acquisitions at any company domain. Returns deduplicated, dated events in flat Clay-ready JSON. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per call.
| Name | Type | Req | Description |
|---|---|---|---|
| company_name | string | – | Optional company name hint, used when the domain does not match the brand name, e.g. Deel for deel.com. |
| domain | string | yes | Company domain to scan, without https or www, e.g. stripe.com. |
| lookback_days | integer | – | How far back to search, in days. Default 365. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| signal_types | array | – | Report only these event types. Omit for every type. Narrowing also narrows the search: a funding only run issues one news query instead of four. |
No output schema declared.
No examples provided.
map_company_event_presence Map Company Event Presence ~522
Give it a company domain. It returns the third party conferences and trade shows that company publicly says it attends, with a year for each where one can be resolved, as one flat row. The search runs against the company's own domain, which is what stops a brand collision returning another company's events. The company's own conference is reported separately and is never mixed into the attendance list. It finds events for roughly 2 companies in 10, and an empty row is an honest empty row rather than a guess: read coverage, fetch_status and queries_failed to tell a company with no published events apart from a search that could not see. Events dated outside the years you ask for are still returned and flagged, so filter on event year rather than assuming the input filtered for you. This is not an events database and not an exhibitor list: it takes a company and reports what that company publishes. Requires an APIFY_TOKEN and consumes Apify credits. Read only.
| Name | Type | Req | Description |
|---|---|---|---|
| company_name | string | – | Improves matching when the brand differs from the domain stem, for example Gong for gong.io. Derived from the domain when left empty. |
| domain | string | yes | A single company domain, for example 6sense.com. Protocol and path are stripped. |
| include_own_events | boolean | – | Reports whether the company runs its own conference as a separate field. It is never mixed into the attendance list. Default: true. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| max_queries | string | – | Between 1 and 5. Each query costs roughly 0.8 seconds plus a 1.3 second pause. 2 is the measured sweet spot: search engines refuse a third query from the same container almost every time, and the thi… |
| skipCache | string | – | false uses the 21 day result cache. true forces a fresh look. Default: "false". |
| years | string | – | Comma separated, for example 2025,2026. Events dated outside this set are still returned and flagged. Sent as a string so it works from Clay. Default: "2025,2026". |
No output schema declared.
No examples provided.
map_company_social_presence Map Company Social Presence ~307
Map a company's social media presence across LinkedIn, X, Instagram, Facebook, and YouTube. Returns profile URLs and follower counts in flat Clay-ready JSON. Profiles are discovered from the company's own homepage links, a web search fallback, and pattern guessing, then validated against the company. Follower counts are extracted where public; X is URL-only (its count needs login) and Instagram and Facebook counts are best-effort. Provide at least one of company_domain or company_name. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per call.
| Name | Type | Req | Description |
|---|---|---|---|
| company_domain | string | – | Bare company domain, e.g. stripe.com. Provide this or company_name. |
| company_name | string | – | Optional company name. Improves search accuracy and disambiguation. Provide this or company_domain. |
| includeFollowerCounts | boolean | – | Fetch profile pages to extract follower counts (default true). Set false for URLs only, which is cheaper. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| platforms | array | – | Which platforms to map. Defaults to all five. |
| skipCache | boolean | – | Force a fresh lookup and ignore the 7 day result cache. |
No output schema declared.
No examples provided.
monitor_public_awards Monitor Public Awards ~618
Pick a public award register and a time window and it returns the companies that won public work in it, one flat row per winning company rather than one per award, with award count, total value, largest award, awarding body, award date, a deep link to the source record, and a resolved company domain. Five registers are covered: US federal contracts and US federal grants from USASpending, NIH SBIR and STTR from NIH RePORTER, and UK Contracts Finder and UK Find a Tender. This reports awards that have already been made, so it is not a tender feed and will not tell you what is open to bid on. US federal data lags about two days, so a one day window on a US register returns little or nothing. Winners are sorted by total award value and max_entities is the hard cap on billed rows. Requires an APIFY_TOKEN and consumes Apify credits. Read only.
| Name | Type | Req | Description |
|---|---|---|---|
| domain_confidence_floor | string | – | How sure the actor has to be before it gives you a domain. Strict returns fewer domains and almost no wrong ones. Loose returns the most domains and about a third of them are wrong. Default: "standar… |
| exclude_government_recipients | boolean | – | Drops winners that are themselves government, universities, or public authorities. Leave this on for the grant registers or you get state departments of education instead of companies. Default: true. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| max_entities | string | – | Hard cap on billed rows. 1 to 1000. Winners are sorted by total award value, and the run log says how many were dropped. Sent as a string so it works from Clay. Default: "100". |
| min_award_value | string | – | Drops awards below this amount in the register's own currency. Set to 0 to keep everything. Sent as a string so it works from Clay. Default: "100000". |
| register | string | yes | Which award register to read. US federal contracts and grants come from USASpending, NIH SBIR and STTR from NIH RePORTER, and the two UK registers from Contracts Finder and Find a Tender. Default: "u… |
| resolve_domains | boolean | – | Looks up each winner's website. Turning it off makes the run roughly 20x faster and returns recipient_domain as null with domain_status not_attempted. Default: true. |
| window_days | string | – | How many days back from today to read awards for. 1 to 90. US federal data lags about two days, so do not use a one day window on the US registers. Sent as a string so it works from Clay. Default: "7… |
No output schema declared.
No examples provided.
push_leads_to_sequencer Push Leads to Sequencer ~726
Push enriched lead rows into an existing Instantly or Smartlead campaign. Maps common Clay column names onto each sequencer's own field names, optionally drops leads below a minimum ICP score, optionally deduplicates against the leads already in the destination campaign, and sends the rest in batches. Returns one flat summary row: how many leads were received, dropped for having no usable email, dropped by the ICP gate, dropped as duplicates, eligible, actually created by the sequencer, skipped by the sequencer, and failed, plus the vendor's own error message per failed address. The campaign must already exist; this does not create campaigns or write sequence copy. Set dry_run true to get back the exact request payload that would be sent without creating a single lead and without being charged, which is the safe way to check a mapping against a new campaign. Billing is per lead the sequencer confirms it created, so gated, duplicate, skipped, failed and dry-run leads are all free. Instantly uses API v2 and needs a v2 key; Smartlead uses API v1. Requires an APIFY_TOKEN and consumes Apify credits. This WRITES to your sequencer campaign unless dry_run is true.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | Your Instantly v2 API key or your Smartlead API key. An Instantly v1 key will not work: v1 was deprecated on January 19, 2026. Required for any run that calls the sequencer. A dry run with deduplicat… |
| campaign_id | string | yes | The target campaign in the sequencer. It must already exist. Instantly campaign IDs are UUIDs; Smartlead campaign IDs are numeric. |
| custom_variables | array | – | Extra column names to pass through as custom variables under their own name. Columns that are neither mapped nor listed here are dropped. |
| dataset_id | string | – | An Apify dataset ID from an upstream run, for example the output of score_icp_fit. Used only when leads is empty. |
| deduplicate | boolean | – | Read the campaign's existing leads first and drop any email already there. Default true. This is a read, so it needs an API key even on a dry run. |
| dry_run | boolean | – | Run every step, return the exact payload that would be sent, and make zero write calls. Creates no leads and charges nothing. Default false. |
| field_mapping | object | – | Override the default Clay column to sequencer field map. Keys are your column names, values are the sequencer field names. Set a value to an empty string to drop that column. A target the sequencer d… |
| leads | array | – | Lead rows to push. Each row needs an email at minimum. Takes precedence over dataset_id when both are set. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| min_icp_score | integer | – | Drop leads whose icp_score is below this number. Default 0, which pushes everything. Rows with no icp_score are always kept. |
| sequencer | string | yes | Which sequencer to push to. Instantly uses API v2, Smartlead uses API v1. |
No output schema declared.
No examples provided.
resolve_company_identity Resolve Company Identity ~414
Resolve any combination of company name, domain, or LinkedIn URL into one canonical company identity: the name, primary domain, and LinkedIn company URL, each with a 0-100 confidence score plus an overall score and a match method. Cross-checks the inputs you give it, resolves the ones you do not, and flags conflicts (a domain and a LinkedIn slug that disagree) instead of merging them. A LinkedIn URL the actor finds is returned only when verified against the company site or the name, with the reason in linkedin_verification. Provide at least one of company_name, domain, or linkedin_url. Use this to reconcile or deduplicate records you already hold; use resolve_linkedin_url instead when you only need the LinkedIn company URL for a domain or name. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per call.
| Name | Type | Req | Description |
|---|---|---|---|
| company_name | string | – | Company name, e.g. Stripe. Provide at least one of company_name, domain, or linkedin_url. |
| domain | string | – | Bare company domain, e.g. stripe.com. The strongest canonical key when provided. |
| linkedin_url | string | – | LinkedIn company URL (https://www.linkedin.com/company/stripe) or bare slug (stripe). |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| minLinkedinConfidence | string | – | A LinkedIn page the actor finds is returned only when its linkedin_confidence is at least this value, 0 to 100. Default "70". A LinkedIn URL you provide is always returned as given. Sent as a string… |
| skipCache | boolean | – | Force a fresh resolution and ignore the 7 day result cache. |
No output schema declared.
No examples provided.
resolve_legal_entity Resolve Legal Entity ~632
Give it a company domain and it returns the registered legal entity behind it: legal name, company number, jurisdiction, status, entity type, LEI and VAT number, as one flat row with a full audit trail of what was rejected and why. Three registers are queried: UK Companies House, GLEIF and SEC EDGAR. Register search endpoints are fuzzy and always return something, so by default a record is accepted only when the normalized legal names are identical. That is why roughly 6 domains in 10 resolve rather than 10 in 10, and why a null here is a trustworthy answer rather than a gap. Read match_method, match_confidence and rejected_candidates before acting on a match. Setting match_strictness to fuzzy will hand you a confidently wrong company on most domains and should be treated as a research mode, not a default. This is not a company database and not a credit or risk product. Requires an APIFY_TOKEN and consumes Apify credits. Read only.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | A single company domain, for example monzo.com. Protocol and path are stripped. |
| jurisdiction_hint | string | – | ISO-2 country code, for example GB or US. Narrows which registers are queried and cuts latency. Leave empty to query every register. |
| legal_name_hint | string | – | Skips the domain lookup and goes straight to the registers with this name. Use it when you already have the legal name and just want the register record. |
| match_strictness | string | – | exact accepts a register record only when the normalized legal names are equal, which is the default and the recommendation. fuzzy returns the best scoring candidate with a confidence below 100 and a… |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| sec_requester_email | string | yes | Required. Your own working email address. Sent to the SEC with your name in the User-Agent of each EDGAR request, in the form the SEC asks for. Nothing else uses it. |
| sec_requester_name | string | yes | Required. Your own name or your company's name. The SEC requires every automated request to EDGAR to identify the requester by name and email, and the actor sends yours, never a default. |
| skipCache | string | – | false uses the cache: 90 days for a resolved company, 7 days for a null. true forces a fresh look. Default: "false". |
| validate_vat | boolean | – | Runs any VAT number found on the company's own pages through the EU VIES service and returns the name VIES holds for it, as a cross-check against the register name. Default: true. |
No output schema declared.
No examples provided.
resolve_linkedin_url Resolve LinkedIn URL ~463
Resolve a company domain or name to its LinkedIn company URL, with a 0-100 confidence_score, social links, and optional firmographics from search snippets, as a flat, Clay-ready JSON row. A URL is returned only when verified: the company homepage links it, or its name is identical to the name the company site declares or the company_name you pass; otherwise linkedin_company_url is null and verification says why. No request is sent to LinkedIn. Provide at least one of company_domain or company_name. Use this when the LinkedIn company URL is the answer you need; use resolve_company_identity instead to cross-check a name, domain, and LinkedIn URL you already hold and get a canonical identity with conflicts flagged. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per call.
| Name | Type | Req | Description |
|---|---|---|---|
| company_domain | string | – | Bare company domain, e.g. stripe.com. Required if company_name is not provided. |
| company_name | string | – | Company name. Required if company_domain is not provided. |
| includeFirmographics | string | – | When "true", also reads employee count, industry, HQ, follower count and description from search result snippets about the LinkedIn company page. No request is sent to LinkedIn. Fields no snippet sta… |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| minConfidenceScore | string | – | A LinkedIn page is returned only when its match score is at least this value, 0 to 100. Default "70". Raise it for fewer, surer answers; lower it for more answers and more wrong ones. Sent as a strin… |
| skipCache | string | – | When "false", the default, a successful resolution is cached for 7 days and reused. Set "true" to force a fresh resolution. Sent as a string for Clay compatibility. |
No output schema declared.
No examples provided.
scan_gtm_hiring_signals Scan GTM Hiring Signals ~391
Scan company career pages to detect GTM hiring activity. Returns sales, marketing, and revenue operations job postings across Greenhouse, Lever, and Ashby as a flat, Clay-ready JSON row. Use this for a go-to-market hiring verdict (is the company building its sales and marketing team, and how fast); use scan_job_board_keywords instead to count open roles in categories or keywords you choose, including non-GTM roles. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per call.
| Name | Type | Req | Description |
|---|---|---|---|
| ats_slug | string | – | Optional ATS board slug override when it differs from the domain. |
| domain | string | yes | Bare company domain, e.g. stripe.com |
| include_role_details | boolean | – | When true, include the full per-role detail array (title, department, location, url). Default: false. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| mode | string | – | Processing mode. "single" scores the domain. "velocity" compares this run against previous_gtm_role_count and previous_run_date. "batch" is an actor-level mode this single-call tool supplies no list… |
| previous_gtm_role_count | integer | – | GTM role count from the previous run for this domain, used in velocity mode to compute the delta. |
| previous_run_date | string | – | ISO date of the previous run for this domain, used in velocity mode to report days between runs. |
| role_filter | array | – | Optional list of GTM role keywords to filter on. Defaults to the built-in list. |
No output schema declared.
No examples provided.
scan_job_board_keywords Scan Job Board Keywords ~318
Scan a company's job board for roles in chosen categories across Greenhouse, Lever, Ashby, Workday, and Rippling. Returns matched role counts and titles per category as a flat, Clay-ready JSON row. Use this when you choose the role categories or keywords (engineering, finance, a product name in a job ad); use scan_gtm_hiring_signals instead for the fixed sales and marketing hiring verdict. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per call.
| Name | Type | Req | Description |
|---|---|---|---|
| company_domain | string | yes | Bare company domain, e.g. stripe.com |
| custom_keywords | array | – | Keyword strings to match when Custom is included in role_categories. |
| enable_fallback | boolean | – | Fall back to a pre-indexed job database when the live ATS cascade finds nothing. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| previous_roles_detected | string | – | Comma-separated matched role titles from a previous run, to compute deltas. |
| previous_run_date | string | – | ISO date of the previous run, e.g. 2026-03-15. |
| role_categories | array | yes | One or more of: GTM, Engineering, Finance, Operations, Executive, Custom. |
No output schema declared.
No examples provided.
score_icp_fit Score ICP Fit ~1,944
Score a company against your ideal customer profile (ICP) using weighted signals. Returns a 0 to 100 icp_score, an A to D icp_tier, and a per-signal breakdown as a flat, Clay-ready JSON row. Define your ICP with a template, scoring_config, or plain-English icp_description (which requires llm_api_key). Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per call.
| Name | Type | Req | Description |
|---|---|---|---|
| company_domain | string | yes | The primary domain of the company to score, e.g. clay.com |
| company_name | string | – | Optional display name of the company. |
| crm_detected | string | – | Whether any CRM was detected. Accepts a boolean-like string ("true"/"false") or any non-empty CRM name (e.g. "Salesforce"). Sent as a string for Clay compatibility and coerced to boolean at runtime.… |
| employee_band | string | – | Firmographic employee band from the Company Firmographic Enricher (Actor ID YlUtLWjfPpqykmB8g), e.g. "201-500". Scores via employee_band_match when it is in target_employee_bands. |
| fetch_signals | boolean | – | If true, the actor runs the GTM Hiring Signal Scraper and the GTM Tech Stack Signal Scraper for this company before scoring and fills any hiring or tech stack signal not supplied. Both bill your Apif… |
| founded_year | string | – | Year the company was founded, from the Company Firmographic Enricher (Actor ID YlUtLWjfPpqykmB8g). Carried for reference; not currently scored. Accepts a numeric string (e.g. "2015"). |
| funded_within_days | integer | – | Optional. How recent a funding round must be to count for the recently_funded signal, in days. Defaults to 540 (18 months). |
| funding_stage | string | – | Funding stage (e.g. seed, series_a, series_b, growth). Used to infer recently_funded. |
| gtm_hiring_signal | string | – | Whether the company is actively hiring for GTM/sales roles. Accepts a boolean-like string ("true"/"false"). Sent as a string for Clay compatibility and coerced to boolean at runtime. |
| gtm_role_count | string | – | Number of open GTM/sales roles. Scores via the gtm_role_count_strong signal when at or above min_gtm_roles (default 2). Accepts a numeric string (e.g. "8"). Sent as a string for Clay compatibility an… |
| has_linkedin | string | – | Whether a company LinkedIn page was found, from the Company Social Presence Mapper (Actor ID 4k6CCemkgBDz18m2h) or the Domain to LinkedIn URL Resolver (Actor ID 3HtnSaqPHOg1Qg5gx). Contributes to soc… |
| has_twitter | string | – | Whether a company X/Twitter profile was found, from the Company Social Presence Mapper (Actor ID 4k6CCemkgBDz18m2h). Contributes to social_presence. Accepts a boolean-like string. |
| headcount | string | – | Current employee headcount. Accepts a numeric string (e.g. "3000"). Sent as a string for Clay compatibility and coerced to integer at runtime. |
| headcount_in_range | boolean | – | Override: whether headcount is in your target range. |
| headcount_max | integer | – | Maximum headcount for the headcount_in_range signal. |
| headcount_min | integer | – | Minimum headcount for the headcount_in_range signal. |
| hq_location | string | – | Headquarters location from the Company Firmographic Enricher (Actor ID YlUtLWjfPpqykmB8g). Carried for reference; not currently scored. |
| icp_description | string | – | Plain-English ICP description. Requires llm_api_key. |
| include_explanation | boolean | – | If true, adds a score_explanation string to the output. |
| industry | string | – | The company's industry (from the Company Firmographic Enricher, Actor ID YlUtLWjfPpqykmB8g). |
| industry_match | boolean | – | Override: whether the company's industry matches your target list. |
| job_count | string | – | Number of open jobs found, from the Job Board Keyword Signal Scanner (Actor ID 4DvqpvhMR74NLcDDY). Scores via active_hiring_volume when at or above min_job_count (default 3). Accepts a numeric string. |
| keyword_match_count | string | – | Number of target-keyword matches found, from the Job Board Keyword Signal Scanner (Actor ID 4DvqpvhMR74NLcDDY). Scores via keyword_signal_match when at or above min_keyword_matches (default 1). Accep… |
| last_funding_date | string | – | ISO date of last funding round (legacy field; latest_funding_date is preferred). Used to auto-detect recently_funded if the boolean is not set. |
| latest_funding_amount | string | – | Dollar amount of the latest funding round (from C1 when it ships). Scores via well_funded when at or above min_funding_amount (default 1000000). Accepts a numeric string (e.g. "50000000"). |
| latest_funding_date | string | – | ISO date of the latest funding round (from C1 Funding & Press Signal Scanner when it ships). Drives recently_funded against funded_within_days. |
| llm_api_key | string | – | Your OpenAI or Anthropic key, used only with icp_description. |
| llm_provider | string | – | LLM provider for icp_description: openai or anthropic. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| min_score_to_output | integer | – | If set, rows scoring below this threshold are skipped from output (not pushed to dataset). Skipped rows are logged only. |
| previous_score | integer | – | Previous ICP score for this company. If provided, output includes score_change and score_trend fields. |
| recently_funded | boolean | – | Override: whether the company was recently funded (within funded_within_days, default 540). |
| revenue_estimate | string | – | Estimated annual revenue in dollars from the Company Firmographic Enricher (Actor ID YlUtLWjfPpqykmB8g). Scores via revenue_in_range. Accepts a numeric string (e.g. "50000000"). Coerced to integer at… |
| scoring_config | object | – | JSON object of scoring weights. |
| seq_tool_detected | string | – | Whether a sales sequencing tool (Outreach, SalesLoft, Apollo, Lemlist) was detected. Accepts a boolean-like string ("true"/"false") or any non-empty tool name (e.g. "Outreach"). Sent as a string for… |
| social_platforms_found | string | – | Number of official social platforms found, from the Company Social Presence Mapper (Actor ID 4k6CCemkgBDz18m2h). Scores via social_presence when at or above min_social_platforms (default 2). Accepts… |
| target_industries | string | – | Comma-separated list of target industries for the industry_match signal. |
| tech_stack | string | – | Comma-separated list of technologies. Used to auto-detect CRM/sequencing tools if booleans are not set. |
| template | string | – | Name of a prebuilt scoring config. |
| tier_thresholds | object | – | Optional. Minimum score for each tier as { "tier_a": number, "tier_b": number, "tier_c": number }. Scores at or above tier_a are A, tier_b are B, tier_c are C, else D. Defaults to 80 / 60 / 40. |
| total_followers | string | – | Total social followers across platforms, from the Company Social Presence Mapper (Actor ID 4k6CCemkgBDz18m2h). Scores via strong_social_following when at or above min_total_followers (default 1000).… |
| uses_clay | string | – | Whether the company uses Clay. Accepts a boolean-like string ("true"/"false"). Sent as a string for Clay compatibility and coerced to boolean at runtime. |
| uses_hubspot | string | – | Whether the company uses HubSpot. Accepts a boolean-like string ("true"/"false"). Sent as a string for Clay compatibility and coerced to boolean at runtime. |
| uses_salesforce | string | – | Whether the company uses Salesforce. Accepts a boolean-like string ("true"/"false"). Sent as a string for Clay compatibility and coerced to boolean at runtime. |
No output schema declared.
No examples provided.
track_publication_cadence Track Publication Cadence ~595
Given a company domain, measure how much long-form work that company publishes and whether the rate is rising or falling. Returns post counts for the last 30 days, 90 days and 12 months, a monthly average, and a cadence_trend of accelerating, steady, declining, dormant or unknown, with the percent change behind it. The trend compares the last 90 days against the prior 275 days, both normalized to posts per month. Also returns the blog URL, the format mix (blog posts, guides, reports, case studies, whitepapers, podcasts, videos, press releases, research), the number of distinct bylines, and how the post list was discovered. This measures EDITORIAL output volume, not product changelogs: a release feed is detected and rejected rather than counted. Publication dates are read from the post pages, because sitemap lastmod was measured to be a modification date running later than publication by a median of 151 to 1653 days. When a site's date field tracks edits rather than publication, date_source_reliable comes back false and every count is nulled rather than reported wrong, so read that field before quoting a number. Counts are a census when the archive fits the page budget and a scaled even sample otherwise, flagged by counts_are_estimate. Public sitemaps, feeds and pages only. Returns flat, Clay-ready JSON. Reads public data and writes nothing; requires an APIFY_TOKEN and consumes Apify credits per domain analyzed.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | – | Company domain to analyze, without https or www, e.g. zapier.com. |
| domain_time_budget_ms | integer | – | Hard wall-clock ceiling per domain, default 75000. When nearly spent the crawl stops and the row is returned with partial_result true rather than timing out. |
| domains | array | – | Batch mode: several company domains analyzed in one call. Takes precedence over domain. |
| max_charge_usd | number | – | Optional spending cap for this call, in USD, passed to the actor as max_charge_usd. The run stops before any charge that would take it past this amount and keeps every row already charged. Leave empt… |
| max_pages_to_date | integer | – | How many post pages to fetch per domain for dating. Default 400. Above this cap the counts are estimated from an even sample and counts_are_estimate is set true. |
| max_sitemap_fetches | integer | – | Cap on how many sitemap files are fetched per domain. Lower it to bound run time on deeply nested sitemap indexes. |
| page_concurrency | integer | – | How many pages are fetched concurrently within one domain. |
| request_timeout_ms | integer | – | Per-HTTP-request timeout in milliseconds. |
| skipCache | boolean | – | Force a fresh crawl and ignore the 3 day result cache. |
No output schema declared.
No examples provided.
How do I install the com.mambabuilt/mcp-gtm-suite server?
com.mambabuilt/mcp-gtm-suite runs locally as an npm package, launched with npx -y @mambalabsdev/mcp-gtm-suite. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @mambalabsdev/mcp-gtm-suite
claude mcp add com-mambabuilt-mcp-gtm-suite -- npx -y @mambalabsdev/mcp-gtm-suite
What is the com.mambabuilt/mcp-gtm-suite server?
com.mambabuilt/mcp-gtm-suite is listed in the public MCP registry as com.mambabuilt/mcp-gtm-suite. 21 Mamba Labs account-intelligence MCP tools in one server: identity, signals, ICP. Clay-ready. This page covers its npm package (@mambalabsdev/mcp-gtm-suite).
Is the com.mambabuilt/mcp-gtm-suite server safe to use?
com.mambabuilt/mcp-gtm-suite scores 76 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.mambabuilt/mcp-gtm-suite server expose?
com.mambabuilt/mcp-gtm-suite exposes 21 tools: scan_gtm_hiring_signals, detect_gtm_tech_stack, aggregate_gtm_signals, scan_job_board_keywords, resolve_linkedin_url, and 16 more. Their descriptions and schemas cost roughly 10,833 tokens of context every time the server is loaded.
Is the com.mambabuilt/mcp-gtm-suite server still maintained?
com.mambabuilt/mcp-gtm-suite is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the com.mambabuilt/mcp-gtm-suite server under?
com.mambabuilt/mcp-gtm-suite declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.