Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

GBG Loqate - Reach

REMOTE · REACH.PROD.FABRIC.GBGPLATFORMS.COM

Verify addresses, email addresses, and phone numbers with confidence scores.

0 this week 87 Trust /100

Last scanned (20 hours ago)

Scores higher than 94% of remote servers

Reachable. Last reached 4 Nov 2026.

Category CRM and Sales

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security80
Transport & Reachability100
Schema Quality & AI Usability74
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4139 tokens (~376/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 28 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 15 Sept 26 0
    • Server version: 0.16.4 → 0.17.0 functional
  • 12 Sept 26 0
    • Schema quality: 2834 → 4139 ▼ functional
    • Server version: 0.15.3 → 0.16.4 functional
    • New tool “verify_address_batch” functional
    • New tool “verify_contact_batch” functional
    • New tool “verify_email_batch” functional
    • New tool “verify_phone_batch” functional
    • “verify_address” added an optional parameter “contact” cosmetic
    • “verify_address” added an optional parameter “department” cosmetic
    • “verify_address” added an optional parameter “forename” cosmetic
    • “verify_address” added an optional parameter “full_name” cosmetic
    • “verify_address” added an optional parameter “function” cosmetic
    • “verify_address” added an optional parameter “id” cosmetic
    • “verify_address” added an optional parameter “middle_name” cosmetic
    • “verify_address” added an optional parameter “surname” cosmetic
    • “verify_contact” added an optional parameter “contact” cosmetic
    • “verify_contact” added an optional parameter “department” cosmetic
    • “verify_contact” added an optional parameter “forename” cosmetic
    • “verify_contact” added an optional parameter “full_name” cosmetic
    • “verify_contact” added an optional parameter “function” cosmetic
    • “verify_contact” added an optional parameter “id” cosmetic
    • “verify_contact” added an optional parameter “middle_name” cosmetic
    • “verify_contact” added an optional parameter “surname” cosmetic
    • “verify_address” reworded the description of “dependent_locality” cosmetic
    • “verify_address” reworded the description of “latitude” cosmetic
    • “verify_address” reworded the description of “longitude” cosmetic
    • “verify_address” reworded the description of “organization” cosmetic
    • “verify_address” reworded the description of “post_box” cosmetic
    • “verify_address” reworded the description of “sub_building” cosmetic
    • “verify_address” reworded the description of “sub_building_floor” cosmetic
    • “verify_address” reworded the description of “super_administrative_area” cosmetic
    • “verify_contact” reworded the description of “dependent_locality” cosmetic
    • “verify_contact” reworded the description of “latitude” cosmetic
    • “verify_contact” reworded the description of “longitude” cosmetic
    • “verify_contact” reworded the description of “organization” cosmetic
    • “verify_contact” reworded the description of “post_box” cosmetic
    • “verify_contact” reworded the description of “sub_building” cosmetic
    • “verify_contact” reworded the description of “sub_building_floor” cosmetic
  • 9 Sept 26 0
    • Server version: 0.15.2 → 0.15.3 functional
    • Tool “verify_phone” changed its title: Verify Phone Number cosmetic
    • Tool “list_policies” changed its title: List Policies cosmetic
    • Tool “retrieve_address” changed its title: Retrieve Address Details cosmetic
    • Tool “show_policy” changed its title: Show Policy cosmetic
    • Tool “verify_address” changed its title: Verify Address cosmetic
    • Tool “verify_contact” changed its title: Verify Contact cosmetic
    • Tool “verify_email” changed its title: Verify Email cosmetic
  • 8 Sept 26 0
    • Server version: 0.15.0 → 0.15.2 functional
    • “verify_address” reworded the description of “options” cosmetic
    • “verify_contact” reworded the description of “options” cosmetic
  • 4 Sept 26 0
    • Server version: 0.14.0 → 0.15.0 functional
  • 2 Sept 26 0
    • Server version: 0.13.3 → 0.14.0 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Probed https://reach.prod.fabric.gbgplatforms.com/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=prod.fabric.gbgplatforms.com CN=YR1,O=Let's Encrypt,C=US 17 Sept 2026 16 Dec 2026 RSA 2048 SHA256-RSA 5386529ff9b628c35d882fc90d8ec2d30c1
SANs: *.prod.fabric.gbgplatforms.com, prod.fabric.gbgplatforms.com
CN=YR1,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA a20253f15f2691c05dc1ce13b9bcca4e
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of reach.prod.fabric.gbgplatforms.com. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
com. present 19718 13 Verified
gbgplatforms.com. present 32769 13 Verified
fabric.gbgplatforms.com. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains; preload

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://reach.prod.fabric.gbgplatforms.com/mcp Verified 200
http (plaintext) http://reach.prod.fabric.gbgplatforms.com/mcp HTTPS enforced 301 https://reach.prod.fabric.gbgplatforms.com/mcp
MCP tools · 11 exposed · ~4,139 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
list_policies ~28

List available decisioning policies (strict, shipping, standard, permissive) with their thresholds.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieve_address ~204

Resolve a suggestion id from address.suggestions into its full cleansed address components (organisation, sub-building, number, street, city, province, postcode, country). Use this when you need the address itself — to fill a form or show a confirmation — rather than a decision; to verify a chosen suggestion instead, pass 'suggestion_id' to verify_address. CONSUMES A LOQATE CREDIT per call, so resolve only the one suggestion the user chose. The result is reference data, NOT a verification. Requires a Loqate API key.

NameTypeReqDescription
keystring–Loqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
suggestion_idstringyesId of a suggestion previously returned in address.suggestions. CONSUMES A LOQATE CREDIT. Ids are not stable over time; a stale one returns SUGGESTION_NOT_FOUND and you must search again rather than r…

No output schema declared.

No examples provided.

show_policy ~34

Show full details for a specific decisioning policy.

NameTypeReqDescription
namestringyesPolicy name: strict shipping standard or permissive

No output schema declared.

No examples provided.

verify_address ~1,297

Verify an address against Loqate's global reference data. Returns a confidence score (0-1), verification status, and a policy-driven accept/review/reject recommendation. Set 'suggest' to also get alternative addresses suggested by Loqate whenever the address does not clear the policy; offer them to the user and verify the chosen one in a second call before treating it as good. Suggestions require a separately licensed Loqate feature enabled on the account — without it, verification still succeeds and the problem is reported in suggestions.error. Requires a Loqate API key — pass it via the 'key' field (get one at account.loqate.com).

NameTypeReqDescription
addressstring–Full address string (free-form — use this OR structured fields below)
address2string–Second address line
address3string–Third address line
address4string–Fourth address line
address5string–Fifth address line
address6string–Sixth address line
address7string–Seventh address line
address8string–Eighth address line
admin_areastring–State or province
buildingstring–Building name
contactstring–Contact name for the delivery
countrystring–ISO 2-letter country code (e.g. US GB DE)
delivery_addressstring–Full delivery address
delivery_address1string–Delivery address line 1
delivery_address2string–Delivery address line 2
delivery_address3string–Delivery address line 3
delivery_address4string–Delivery address line 4
delivery_address5string–Delivery address line 5
delivery_address6string–Delivery address line 6
delivery_address7string–Delivery address line 7
delivery_address8string–Delivery address line 8
departmentstring–Department within the organisation
dependent_localitystring–Dependent locality (e.g. neighbourhood)
dependent_thoroughfarestring–Dependent street name
detect_countryboolean–When true and no country is supplied, guess the country from the address and flag the guess in the result (country_guessed). Address-only; off by default
double_dependent_localitystring–Double dependent locality
forenamestring–Recipient's first name
full_namestring–Recipient's full name
functionstring–Contact's job title or function
idstring–Your own identifier for this record, echoed back by Loqate
keystring–Loqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header (get one at account.loqate.com)
latitudestring–Latitude, for a reverse geocode
localitystring–City or town
longitudestring–Longitude, for a reverse geocode
middle_namestring–Recipient's middle name
optionsobject–Loqate API options as nested JSON, e.g. {"ServerOptions": {"FieldStatus": "true"}}. Dot notation is equivalent: {"ServerOptions.FieldStatus": "true"}. Pass GeoCode here as a boolean — it is sent at t…
organizationstring–Company or organisation name
policystring–Policy name: strict shipping standard (default) or permissive
post_boxstring–PO box
postcodestring–Postal or ZIP code
premisestring–Premise or house number
sub_administrative_areastring–Sub administrative area (e.g. county)
sub_buildingstring–Sub-building (e.g. flat, apartment or suite)
sub_building_floorstring–Floor
suggestboolean–When true, look up alternative addresses suggested by Loqate and return them in the result as suggestions. Requires the Loqate address-suggestion feature to be enabled on the account (licensed separa…
suggest_belownull|number–Confidence floor for suggestions (0-1). An accepted address scoring below it still gets suggestions — policies accept from their own minimum, so an accepted address is not necessarily a confident one…
suggest_limitinteger–Maximum number of suggestions to return (1-10, default 5). Requires suggest
suggestion_idstring–Id of a suggestion previously returned in address.suggestions. The tool retrieves that address's cleansed components from Loqate and verifies those, which is how you confirm a suggestion the user cho…
super_administrative_areastring–Super administrative area
surnamestring–Recipient's last name
thoroughfarestring–Street name
verify_keystring–Custom address verification API key (overrides LOQATE_VERIFY_KEY env var)
verify_urlstring–Custom address verification endpoint URL (overrides LOQATE_VERIFY_URL env var)

No output schema declared.

No examples provided.

verify_address_batch ~356

Verify up to 100 addresses in one call. Up to 100 records per call; the results array is in submission order and each entry carries its input index, so results can be zipped back onto rows without relying on order. One bad record fails only itself — it carries an error while the rest are verified. Suggestions are not available in batch. Records are grouped by country before being sent, as Loqate recommends, so the cost is one upstream call per distinct country in the batch rather than one per call. Set detect_country to guess the country of records that do not supply one — detection runs per record, before grouping, so a mixed batch still sends each group with the right default. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
addressesnull|arrayyesAddresses to verify, up to 100. Results are returned in the same order, each carrying its input index
detect_countryboolean–When true, guess the country of any record that does not supply one, from its address text, and flag the guess in that record's result. Records are then grouped by their detected country, so a mixed-…
keystring–Loqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
optionsobject–Loqate API options as nested JSON, applied to every record in the batch
policystring–Policy name: strict shipping standard (default) or permissive
verify_keystring–Custom address verification API key
verify_urlstring–Custom address verification endpoint URL

No output schema declared.

No examples provided.

verify_contact ~1,229

Verify address, email, and/or phone together. Returns individual results plus an overall recommendation (most conservative of all provided fields). Set 'suggest' to also get alternative addresses suggested by Loqate whenever the address does not clear the policy; offer them to the user and verify the chosen one in a second call before treating it as good. Suggestions require a separately licensed Loqate feature enabled on the account — without it, verification still succeeds and the problem is reported in suggestions.error. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
addressstring–Full address string
address2string–Second address line
address3string–Third address line
address4string–Fourth address line
address5string–Fifth address line
address6string–Sixth address line
address7string–Seventh address line
address8string–Eighth address line
admin_areastring–State or province
buildingstring–Building name
contactstring–Contact name for the delivery
countrystring–ISO 2-letter country code
delivery_addressstring–Full delivery address
delivery_address1string–Delivery address line 1
delivery_address2string–Delivery address line 2
delivery_address3string–Delivery address line 3
delivery_address4string–Delivery address line 4
delivery_address5string–Delivery address line 5
delivery_address6string–Delivery address line 6
delivery_address7string–Delivery address line 7
delivery_address8string–Delivery address line 8
departmentstring–Department within the organisation
dependent_localitystring–Dependent locality (e.g. neighbourhood)
dependent_thoroughfarestring–Dependent street name
detect_countryboolean–When true and no country is supplied, guess the country from the address and flag the guess in the result (country_guessed). Address-only — does not affect phone or email; off by default
double_dependent_localitystring–Double dependent locality
emailstring–Email address to verify
forenamestring–Recipient's first name
full_namestring–Recipient's full name
functionstring–Contact's job title or function
idstring–Your own identifier for this record, echoed back by Loqate
keystring–Loqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
latitudestring–Latitude, for a reverse geocode
localitystring–City or town
longitudestring–Longitude, for a reverse geocode
middle_namestring–Recipient's middle name
optionsobject–Loqate API options as nested JSON, e.g. {"ServerOptions": {"FieldStatus": "true"}}. Dot notation is equivalent: {"ServerOptions.FieldStatus": "true"}. Pass GeoCode here as a boolean — it is sent at t…
organizationstring–Company or organisation name
phonestring–Phone number to verify
policystring–Policy name: strict shipping standard (default) or permissive
post_boxstring–PO box
postcodestring–Postal or ZIP code
premisestring–Premise or house number
sub_administrative_areastring–Sub administrative area (e.g. county)
sub_buildingstring–Sub-building (e.g. flat, apartment or suite)
sub_building_floorstring–Floor
suggestboolean–When true, look up alternative addresses suggested by Loqate and return them under address.suggestions. Requires the Loqate address-suggestion feature to be enabled on the account (licensed separatel…
suggest_belownull|number–Confidence floor for suggestions (0-1). An accepted address scoring below it still gets suggestions. Omit to use the policy value (standard 0.85); 0 disables the floor. Address-only
suggest_limitinteger–Maximum number of suggestions to return (1-10, default 5). Requires suggest
suggestion_idstring–Id of a suggestion previously returned in address.suggestions. The tool retrieves that address's cleansed components from Loqate and verifies those, which is how you confirm a suggestion the user cho…
super_administrative_areastring–Super administrative area
surnamestring–Recipient's last name
thoroughfarestring–Street name
verify_keystring–Custom address verification API key (overrides LOQATE_VERIFY_KEY env var)
verify_urlstring–Custom address verification endpoint URL (overrides LOQATE_VERIFY_URL env var)

No output schema declared.

No examples provided.

verify_contact_batch ~286

Verify up to 100 contacts in one call, each with any combination of address, email and phone, returning an overall recommendation per contact. Results are in submission order and each carries its input index. One bad record fails only itself, and a field that cannot be verified does not remove the contact — the overall recommendation is drawn from whichever fields were checked. The three types run concurrently, so a full batch is paced by email at roughly 7 seconds per 100. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
contactsnull|arrayyesContacts to verify, up to 100. Results are returned in the same order, each carrying its input index
detect_countryboolean–When true, guess the country of any contact whose address does not supply one and flag the guess in that contact's address result. Off by default
keystring–Loqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
optionsobject–Loqate API options as nested JSON, applied to every address in the batch
policystring–Policy name: strict shipping standard (default) or permissive
verify_keystring–Custom address verification API key
verify_urlstring–Custom address verification endpoint URL

No output schema declared.

No examples provided.

verify_email ~108

Verify an email address via Loqate. Returns confidence, risk level, and accept/review/reject recommendation. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
emailstringyesEmail address to verify
keystring–Loqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
policystring–Policy name: strict shipping standard (default) or permissive

No output schema declared.

No examples provided.

verify_email_batch ~214

Verify up to 100 email addresses in one call. Up to 100 records per call; the results array is in submission order and each entry carries its input index, so results can be zipped back onto rows without relying on order. One bad record fails only itself — it carries an error while the rest are verified. Suggestions are not available in batch. The batch endpoint returns less detail than single verification: risk, complainer and reason are absent, though the accept/review/reject recommendation and the disposable-mailbox flag are identical. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
emailsnull|arrayyesEmail addresses to verify, up to 100. Results are returned in the same order, each carrying its input index
keystring–Loqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
policystring–Policy name: strict shipping standard (default) or permissive

No output schema declared.

No examples provided.

verify_phone ~143

Verify a phone number via Loqate. Returns confidence, number type, carrier, and accept/review/reject recommendation. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
countrystring–ISO 2-letter country code (helps with parsing if no country prefix)
keystring–Loqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
phonestringyesPhone number (E.164 format preferred e.g. +442071234567)
policystring–Policy name: strict shipping standard (default) or permissive

No output schema declared.

No examples provided.

verify_phone_batch ~240

Verify up to 100 phone numbers in one call. Up to 100 records per call; the results array is in submission order and each entry carries its input index, so results can be zipped back onto rows without relying on order. One bad record fails only itself — it carries an error while the rest are verified. Suggestions are not available in batch. Phone validation has no bulk endpoint, so numbers are checked concurrently against a shared limit. Measured at around 2.6s for 100 numbers, which is the fastest of the three batch types — email is the slowest, at roughly 7s for 100, because it probes mail servers. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
keystring–Loqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
phonesnull|arrayyesPhone numbers to verify, up to 100. Results are returned in the same order, each carrying its input index
policystring–Policy name: strict shipping standard (default) or permissive

No output schema declared.

No examples provided.

Install

How do I install the GBG Loqate - Reach MCP server?

GBG Loqate - Reach is a hosted endpoint at https://reach.prod.fabric.gbgplatforms.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · reach.prod.fabric.gbgplatforms.com

# add to Claude Code
claude mcp add --transport http gbgplc-lqt 'https://reach.prod.fabric.gbgplatforms.com/mcp'
Common questions

What is the GBG Loqate - Reach MCP server?

GBG Loqate - Reach is an MCP server listed in the public MCP registry as io.github.gbgplc/lqt. Verify addresses, email addresses, and phone numbers with confidence scores. This page covers its hosted endpoint (https://reach.prod.fabric.gbgplatforms.com/mcp).

Is the GBG Loqate - Reach MCP server safe to use?

GBG Loqate - Reach scores 87 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the GBG Loqate - Reach MCP server expose?

GBG Loqate - Reach exposes 11 tools: list_policies, retrieve_address, show_policy, verify_address, verify_address_batch, and 6 more. Their descriptions and schemas cost roughly 4,139 tokens of context every time the server is loaded.

Does the GBG Loqate - Reach MCP server require authentication?

No. We connected to GBG Loqate - Reach without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the GBG Loqate - Reach MCP server still maintained?

GBG Loqate - Reach is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.