Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

GBG Loqate - Reach

REMOTE · REACH.PROD.FABRIC.GBGPLATFORMS.COM · SCANNED SEP 20

Verify addresses, email addresses, and phone numbers with confidence scores.

0 this week 81 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security63
Transport & Reachability100
Schema Quality & AI Usability74
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4139 tokens (~376/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the GBG Loqate - Reach MCP server?

GBG Loqate - Reach is a hosted endpoint at https://reach.prod.fabric.gbgplatforms.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · reach.prod.fabric.gbgplatforms.com

# add to Claude Code
claude mcp add --transport http gbgplc-lqt 'https://reach.prod.fabric.gbgplatforms.com/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "gbgplc-lqt": {
      "url": "https://reach.prod.fabric.gbgplatforms.com/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "gbgplc-lqt": {
      "type": "http",
      "url": "https://reach.prod.fabric.gbgplatforms.com/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.gbgplc-lqt]
url = "https://reach.prod.fabric.gbgplatforms.com/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "gbgplc-lqt": {
      "type": "remote",
      "url": "https://reach.prod.fabric.gbgplatforms.com/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add gbgplc-lqt --url 'https://reach.prod.fabric.gbgplatforms.com/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  gbgplc-lqt:
    url: "https://reach.prod.fabric.gbgplatforms.com/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "gbgplc-lqt": {
      "Transport": "http",
      "Url": "https://reach.prod.fabric.gbgplatforms.com/mcp"
    }
  }
}
# add to Vellum
assistant mcp add gbgplc-lqt -t streamable-http -u 'https://reach.prod.fabric.gbgplatforms.com/mcp'
// mcp.json
{
  "mcpServers": {
    "gbgplc-lqt": {
      "type": "http",
      "url": "https://reach.prod.fabric.gbgplatforms.com/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 15 Sept 26 0
    • Server version: 0.16.4 → 0.17.0 functional
  • 12 Sept 26 0
    • Schema quality: 2834 → 4139 functional
    • Server version: 0.15.3 → 0.16.4 functional
    • New tool “verify_address_batch” functional
    • New tool “verify_contact_batch” functional
    • New tool “verify_email_batch” functional
    • New tool “verify_phone_batch” functional
    • “verify_address” added an optional parameter “contact” cosmetic
    • “verify_address” added an optional parameter “department” cosmetic
    • “verify_address” added an optional parameter “forename” cosmetic
    • “verify_address” added an optional parameter “full_name” cosmetic
    • “verify_address” added an optional parameter “function” cosmetic
    • “verify_address” added an optional parameter “id” cosmetic
    • “verify_address” added an optional parameter “middle_name” cosmetic
    • “verify_address” added an optional parameter “surname” cosmetic
    • “verify_contact” added an optional parameter “contact” cosmetic
    • “verify_contact” added an optional parameter “department” cosmetic
    • “verify_contact” added an optional parameter “forename” cosmetic
    • “verify_contact” added an optional parameter “full_name” cosmetic
    • “verify_contact” added an optional parameter “function” cosmetic
    • “verify_contact” added an optional parameter “id” cosmetic
    • “verify_contact” added an optional parameter “middle_name” cosmetic
    • “verify_contact” added an optional parameter “surname” cosmetic
    • “verify_address” reworded the description of “dependent_locality” cosmetic
    • “verify_address” reworded the description of “latitude” cosmetic
    • “verify_address” reworded the description of “longitude” cosmetic
    • “verify_address” reworded the description of “organization” cosmetic
    • “verify_address” reworded the description of “post_box” cosmetic
    • “verify_address” reworded the description of “sub_building” cosmetic
    • “verify_address” reworded the description of “sub_building_floor” cosmetic
    • “verify_address” reworded the description of “super_administrative_area” cosmetic
    • “verify_contact” reworded the description of “dependent_locality” cosmetic
    • “verify_contact” reworded the description of “latitude” cosmetic
    • “verify_contact” reworded the description of “longitude” cosmetic
    • “verify_contact” reworded the description of “organization” cosmetic
    • “verify_contact” reworded the description of “post_box” cosmetic
    • “verify_contact” reworded the description of “sub_building” cosmetic
    • “verify_contact” reworded the description of “sub_building_floor” cosmetic
  • 9 Sept 26 0
    • Server version: 0.15.2 → 0.15.3 functional
    • Tool “verify_phone” changed its title: Verify Phone Number cosmetic
    • Tool “list_policies” changed its title: List Policies cosmetic
    • Tool “retrieve_address” changed its title: Retrieve Address Details cosmetic
    • Tool “show_policy” changed its title: Show Policy cosmetic
    • Tool “verify_address” changed its title: Verify Address cosmetic
    • Tool “verify_contact” changed its title: Verify Contact cosmetic
    • Tool “verify_email” changed its title: Verify Email cosmetic
  • 8 Sept 26 0
    • Server version: 0.15.0 → 0.15.2 functional
    • “verify_address” reworded the description of “options” cosmetic
    • “verify_contact” reworded the description of “options” cosmetic
  • 4 Sept 26 0
    • Server version: 0.14.0 → 0.15.0 functional
  • 2 Sept 26 0
    • Server version: 0.13.3 → 0.14.0 functional
  • 26 Aug 26 +1
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Aug 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Probed https://reach.prod.fabric.gbgplatforms.com/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=prod.fabric.gbgplatforms.com CN=YR1,O=Let's Encrypt,C=US 17 Sept 2026 16 Dec 2026 RSA 2048 SHA256-RSA 5386529ff9b628c35d882fc90d8ec2d30c1
SANs: *.prod.fabric.gbgplatforms.com, prod.fabric.gbgplatforms.com
CN=YR1,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA a20253f15f2691c05dc1ce13b9bcca4e
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of reach.prod.fabric.gbgplatforms.com. Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
com. present 19718 13 Verified
gbgplatforms.com. present 32769 13 Verified
fabric.gbgplatforms.com. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains; preload

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://reach.prod.fabric.gbgplatforms.com/mcp Verified 200
http (plaintext) http://reach.prod.fabric.gbgplatforms.com/mcp HTTPS enforced 301 https://reach.prod.fabric.gbgplatforms.com/mcp
MCP tools · 11 exposed · ~4,139 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
list_policies ~28

List available decisioning policies (strict, shipping, standard, permissive) with their thresholds.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieve_address ~204

Resolve a suggestion id from address.suggestions into its full cleansed address components (organisation, sub-building, number, street, city, province, postcode, country). Use this when you need the address itself — to fill a form or show a confirmation — rather than a decision; to verify a chosen suggestion instead, pass 'suggestion_id' to verify_address. CONSUMES A LOQATE CREDIT per call, so resolve only the one suggestion the user chose. The result is reference data, NOT a verification. Requires a Loqate API key.

NameTypeReqDescription
keystringLoqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
suggestion_idstringyesId of a suggestion previously returned in address.suggestions. CONSUMES A LOQATE CREDIT. Ids are not stable over time; a stale one returns SUGGESTION_NOT_FOUND and you must search again rather than r…

No output schema declared.

No examples provided.

show_policy ~34

Show full details for a specific decisioning policy.

NameTypeReqDescription
namestringyesPolicy name: strict shipping standard or permissive

No output schema declared.

No examples provided.

verify_address ~1,297

Verify an address against Loqate's global reference data. Returns a confidence score (0-1), verification status, and a policy-driven accept/review/reject recommendation. Set 'suggest' to also get alternative addresses suggested by Loqate whenever the address does not clear the policy; offer them to the user and verify the chosen one in a second call before treating it as good. Suggestions require a separately licensed Loqate feature enabled on the account — without it, verification still succeeds and the problem is reported in suggestions.error. Requires a Loqate API key — pass it via the 'key' field (get one at account.loqate.com).

NameTypeReqDescription
addressstringFull address string (free-form — use this OR structured fields below)
address2stringSecond address line
address3stringThird address line
address4stringFourth address line
address5stringFifth address line
address6stringSixth address line
address7stringSeventh address line
address8stringEighth address line
admin_areastringState or province
buildingstringBuilding name
contactstringContact name for the delivery
countrystringISO 2-letter country code (e.g. US GB DE)
delivery_addressstringFull delivery address
delivery_address1stringDelivery address line 1
delivery_address2stringDelivery address line 2
delivery_address3stringDelivery address line 3
delivery_address4stringDelivery address line 4
delivery_address5stringDelivery address line 5
delivery_address6stringDelivery address line 6
delivery_address7stringDelivery address line 7
delivery_address8stringDelivery address line 8
departmentstringDepartment within the organisation
dependent_localitystringDependent locality (e.g. neighbourhood)
dependent_thoroughfarestringDependent street name
detect_countrybooleanWhen true and no country is supplied, guess the country from the address and flag the guess in the result (country_guessed). Address-only; off by default
double_dependent_localitystringDouble dependent locality
forenamestringRecipient's first name
full_namestringRecipient's full name
functionstringContact's job title or function
idstringYour own identifier for this record, echoed back by Loqate
keystringLoqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header (get one at account.loqate.com)
latitudestringLatitude, for a reverse geocode
localitystringCity or town
longitudestringLongitude, for a reverse geocode
middle_namestringRecipient's middle name
optionsobjectLoqate API options as nested JSON, e.g. {"ServerOptions": {"FieldStatus": "true"}}. Dot notation is equivalent: {"ServerOptions.FieldStatus": "true"}. Pass GeoCode here as a boolean — it is sent at t…
organizationstringCompany or organisation name
policystringPolicy name: strict shipping standard (default) or permissive
post_boxstringPO box
postcodestringPostal or ZIP code
premisestringPremise or house number
sub_administrative_areastringSub administrative area (e.g. county)
sub_buildingstringSub-building (e.g. flat, apartment or suite)
sub_building_floorstringFloor
suggestbooleanWhen true, look up alternative addresses suggested by Loqate and return them in the result as suggestions. Requires the Loqate address-suggestion feature to be enabled on the account (licensed separa…
suggest_belownull|numberConfidence floor for suggestions (0-1). An accepted address scoring below it still gets suggestions — policies accept from their own minimum, so an accepted address is not necessarily a confident one…
suggest_limitintegerMaximum number of suggestions to return (1-10, default 5). Requires suggest
suggestion_idstringId of a suggestion previously returned in address.suggestions. The tool retrieves that address's cleansed components from Loqate and verifies those, which is how you confirm a suggestion the user cho…
super_administrative_areastringSuper administrative area
surnamestringRecipient's last name
thoroughfarestringStreet name
verify_keystringCustom address verification API key (overrides LOQATE_VERIFY_KEY env var)
verify_urlstringCustom address verification endpoint URL (overrides LOQATE_VERIFY_URL env var)

No output schema declared.

No examples provided.

verify_address_batch ~356

Verify up to 100 addresses in one call. Up to 100 records per call; the results array is in submission order and each entry carries its input index, so results can be zipped back onto rows without relying on order. One bad record fails only itself — it carries an error while the rest are verified. Suggestions are not available in batch. Records are grouped by country before being sent, as Loqate recommends, so the cost is one upstream call per distinct country in the batch rather than one per call. Set detect_country to guess the country of records that do not supply one — detection runs per record, before grouping, so a mixed batch still sends each group with the right default. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
addressesnull|arrayyesAddresses to verify, up to 100. Results are returned in the same order, each carrying its input index
detect_countrybooleanWhen true, guess the country of any record that does not supply one, from its address text, and flag the guess in that record's result. Records are then grouped by their detected country, so a mixed-…
keystringLoqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
optionsobjectLoqate API options as nested JSON, applied to every record in the batch
policystringPolicy name: strict shipping standard (default) or permissive
verify_keystringCustom address verification API key
verify_urlstringCustom address verification endpoint URL

No output schema declared.

No examples provided.

verify_contact ~1,229

Verify address, email, and/or phone together. Returns individual results plus an overall recommendation (most conservative of all provided fields). Set 'suggest' to also get alternative addresses suggested by Loqate whenever the address does not clear the policy; offer them to the user and verify the chosen one in a second call before treating it as good. Suggestions require a separately licensed Loqate feature enabled on the account — without it, verification still succeeds and the problem is reported in suggestions.error. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
addressstringFull address string
address2stringSecond address line
address3stringThird address line
address4stringFourth address line
address5stringFifth address line
address6stringSixth address line
address7stringSeventh address line
address8stringEighth address line
admin_areastringState or province
buildingstringBuilding name
contactstringContact name for the delivery
countrystringISO 2-letter country code
delivery_addressstringFull delivery address
delivery_address1stringDelivery address line 1
delivery_address2stringDelivery address line 2
delivery_address3stringDelivery address line 3
delivery_address4stringDelivery address line 4
delivery_address5stringDelivery address line 5
delivery_address6stringDelivery address line 6
delivery_address7stringDelivery address line 7
delivery_address8stringDelivery address line 8
departmentstringDepartment within the organisation
dependent_localitystringDependent locality (e.g. neighbourhood)
dependent_thoroughfarestringDependent street name
detect_countrybooleanWhen true and no country is supplied, guess the country from the address and flag the guess in the result (country_guessed). Address-only — does not affect phone or email; off by default
double_dependent_localitystringDouble dependent locality
emailstringEmail address to verify
forenamestringRecipient's first name
full_namestringRecipient's full name
functionstringContact's job title or function
idstringYour own identifier for this record, echoed back by Loqate
keystringLoqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
latitudestringLatitude, for a reverse geocode
localitystringCity or town
longitudestringLongitude, for a reverse geocode
middle_namestringRecipient's middle name
optionsobjectLoqate API options as nested JSON, e.g. {"ServerOptions": {"FieldStatus": "true"}}. Dot notation is equivalent: {"ServerOptions.FieldStatus": "true"}. Pass GeoCode here as a boolean — it is sent at t…
organizationstringCompany or organisation name
phonestringPhone number to verify
policystringPolicy name: strict shipping standard (default) or permissive
post_boxstringPO box
postcodestringPostal or ZIP code
premisestringPremise or house number
sub_administrative_areastringSub administrative area (e.g. county)
sub_buildingstringSub-building (e.g. flat, apartment or suite)
sub_building_floorstringFloor
suggestbooleanWhen true, look up alternative addresses suggested by Loqate and return them under address.suggestions. Requires the Loqate address-suggestion feature to be enabled on the account (licensed separatel…
suggest_belownull|numberConfidence floor for suggestions (0-1). An accepted address scoring below it still gets suggestions. Omit to use the policy value (standard 0.85); 0 disables the floor. Address-only
suggest_limitintegerMaximum number of suggestions to return (1-10, default 5). Requires suggest
suggestion_idstringId of a suggestion previously returned in address.suggestions. The tool retrieves that address's cleansed components from Loqate and verifies those, which is how you confirm a suggestion the user cho…
super_administrative_areastringSuper administrative area
surnamestringRecipient's last name
thoroughfarestringStreet name
verify_keystringCustom address verification API key (overrides LOQATE_VERIFY_KEY env var)
verify_urlstringCustom address verification endpoint URL (overrides LOQATE_VERIFY_URL env var)

No output schema declared.

No examples provided.

verify_contact_batch ~286

Verify up to 100 contacts in one call, each with any combination of address, email and phone, returning an overall recommendation per contact. Results are in submission order and each carries its input index. One bad record fails only itself, and a field that cannot be verified does not remove the contact — the overall recommendation is drawn from whichever fields were checked. The three types run concurrently, so a full batch is paced by email at roughly 7 seconds per 100. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
contactsnull|arrayyesContacts to verify, up to 100. Results are returned in the same order, each carrying its input index
detect_countrybooleanWhen true, guess the country of any contact whose address does not supply one and flag the guess in that contact's address result. Off by default
keystringLoqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
optionsobjectLoqate API options as nested JSON, applied to every address in the batch
policystringPolicy name: strict shipping standard (default) or permissive
verify_keystringCustom address verification API key
verify_urlstringCustom address verification endpoint URL

No output schema declared.

No examples provided.

verify_email ~108

Verify an email address via Loqate. Returns confidence, risk level, and accept/review/reject recommendation. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
emailstringyesEmail address to verify
keystringLoqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
policystringPolicy name: strict shipping standard (default) or permissive

No output schema declared.

No examples provided.

verify_email_batch ~214

Verify up to 100 email addresses in one call. Up to 100 records per call; the results array is in submission order and each entry carries its input index, so results can be zipped back onto rows without relying on order. One bad record fails only itself — it carries an error while the rest are verified. Suggestions are not available in batch. The batch endpoint returns less detail than single verification: risk, complainer and reason are absent, though the accept/review/reject recommendation and the disposable-mailbox flag are identical. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
emailsnull|arrayyesEmail addresses to verify, up to 100. Results are returned in the same order, each carrying its input index
keystringLoqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
policystringPolicy name: strict shipping standard (default) or permissive

No output schema declared.

No examples provided.

verify_phone ~143

Verify a phone number via Loqate. Returns confidence, number type, carrier, and accept/review/reject recommendation. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
countrystringISO 2-letter country code (helps with parsing if no country prefix)
keystringLoqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
phonestringyesPhone number (E.164 format preferred e.g. +442071234567)
policystringPolicy name: strict shipping standard (default) or permissive

No output schema declared.

No examples provided.

verify_phone_batch ~240

Verify up to 100 phone numbers in one call. Up to 100 records per call; the results array is in submission order and each entry carries its input index, so results can be zipped back onto rows without relying on order. One bad record fails only itself — it carries an error while the rest are verified. Suggestions are not available in batch. Phone validation has no bulk endpoint, so numbers are checked concurrently against a shared limit. Measured at around 2.6s for 100 numbers, which is the fastest of the three batch types — email is the slowest, at roughly 7s for 100, because it probes mail servers. Requires a Loqate API key — pass it via the 'key' field.

NameTypeReqDescription
keystringLoqate API key — required unless the server has one configured or the request carries an Authorization: Bearer header
phonesnull|arrayyesPhone numbers to verify, up to 100. Results are returned in the same order, each carrying its input index
policystringPolicy name: strict shipping standard (default) or permissive

No output schema declared.

No examples provided.

Common questions

What is the GBG Loqate - Reach MCP server?

GBG Loqate - Reach is an MCP server listed in the public MCP registry as io.github.gbgplc/lqt. Verify addresses, email addresses, and phone numbers with confidence scores. This page covers its hosted endpoint (https://reach.prod.fabric.gbgplatforms.com/mcp).

Is the GBG Loqate - Reach MCP server safe to use?

GBG Loqate - Reach scores 81 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the GBG Loqate - Reach MCP server expose?

GBG Loqate - Reach exposes 11 tools: list_policies, retrieve_address, show_policy, verify_address, verify_address_batch, and 6 more. Their descriptions and schemas cost roughly 4,139 tokens of context every time the server is loaded.

Does the GBG Loqate - Reach MCP server require authentication?

No. We connected to GBG Loqate - Reach without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the GBG Loqate - Reach MCP server still maintained?

GBG Loqate - Reach is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.