Hunter API + MCP vs ZeroBounce

Hunter API + MCP 90

OpenAPI 3.0.3 JSON at hunter.io/openapi.json, version 2.0.0, 101 paths and 182 operations on 4 November (25). llms.txt, llms-full.txt and agents.md written for agents (10). Reference pages state purpose and credit rules per endpoint, and llms-full.txt adds usage advice and a when-to-use line per MCP tool (15 of 20). Typed parameters with documented maxima (12 of 15). Examples, a test-api-key that returns dummy responses, and an error envelope {errors: [{id, code, details}]} including 451 for people who opted out (14 of 15). v2 API and a public dated changelog, with several newer endpoints labelled Beta (14 of 15). 25 + 10 + 15 + 12 + 14 + 14 = 90.

ZeroBounce 54

No OpenAPI or other machine-readable contract found; a Postman collection is linked (5 of 25). llms.txt lists marketing pages, and the docs have no Markdown twins (5 of 10). Endpoint pages explain timing, credits and when to use batch or file APIs (14 of 20). Parameter tables and listed status and sub-status values, including the ai_agent_mailbox sub-status added in July 2026 (10 of 15). Examples per endpoint, a sandbox and an error-code page (12 of 15). v2 paths, an API migration page and dated maintenance notices on the status page, with no API changelog (8 of 15). 5+5+14+10+12+8 = 54.

Hunter API + MCP 50

A status page at status.hunter.io (a Checkly dashboard) exists per the 30 September check, but it renders client-side and both the page and its incidents feed came back empty on 1 October, so components were never confirmed (15 of 20, the earlier partial kept). On 4 November its robots.txt answered with the dashboard's app page, so the host was not read further and no history is readable (5). Per-endpoint limits published, from 5 a second and 50 a minute on Discover to 15 a second and 500 a minute on Domain Search and Email Finder (15). Hitting a rate limit returns 403, while 429 means the plan's usage is spent, and no Retry-After or back-off guidance for either was found. The API reference now documents an Idempotency-Key on sequence and email writes (409 with Retry-After 2 while a request with the same key runs) and calls POST and PUT /v2/leads retry-safe, but with no overload guidance the line stays at the earlier partial (5 of 15). No SLA found (0). Generally available (10). 15 + 5 + 15 + 5 + 0 + 10 = 50.

ZeroBounce 75

Hosted lines. Statuspage at status.zerobounce.net with API, API-US, API-EU, Bulk API, website and Cloudflare components (20). The incident feed for 8 August to 6 November shows a 6-minute members platform disruption on 9 September, about 3 minutes of reduced EU API availability on 1 October, and a file upload issue on 26 October resolved within 6 minutes, all minor (20). Limits published per endpoint group with numbers and block lengths (15). 429 is documented with advice to throttle, but no Retry-After, and a block can last an hour or a day (10 of 15). No SLA found (0). Generally available (10). 20+20+15+10+0+10 = 75.

Hunter API + MCP 43

API keys can be created and deleted, and the docs accept the key in a header, as a bearer token or in the api_key query string, which puts it in logs (20 less 10). OAuth for the MCP in Claude, ChatGPT, Gemini and Codex, X-API-Key elsewhere (15 of 30). No read-only mode. MCP tools can delete leads and lists in bulk, create and delete API keys and start sequences that send email, with no built-in confirmation (3 of 20). Results are emails, names and source URLs with little free text (8 of 15). Account usage via the API, no per-call log found (5 of 15). The 1 October check found hunter.io/security returning 404, but the footer links a Security Policy (last updated 19 October 2023) and a public, paid Bounty Program page with a report form, security@hunter.io, "We answer all submissions within a few days" and a hall of fame of paid reports. No security.txt (404 on 4 November), certification or public advisory found (12 of 20, as dropcontact's HackerOne programme and openrouter's private bounty). 15 + 3 + 8 + 5 + 12 = 43.

ZeroBounce 65

Several named keys besides a Master key, regeneration, deactivation and IP whitelists (25), less 10 because the documented calls carry the key in the api_key query string (15 of 30). Validation only reads, though file and list endpoints can delete uploads (12 of 20). Results are structured status codes with little free text (10 of 15). API usage and dashboard statistics endpoints (10 of 15). SOC 2 Type 2, ISO/IEC 27001:2022, continuous testing with Intigriti and penetration testing with BitSentinel; no public disclosure policy found (18 of 20). 15+12+10+10+18 = 65.

Hunter API + MCP 79

Closed service with terms naming Hunter Web Services, Inc. (last updated 23 May 2024, 15 days' notice of material changes) (15). The privacy policy (updated 13 April 2026, unchanged on 4 November) covers the people in Hunter's index, says profiles come from crawling public pages that allow it and from pattern-generated addresses, cites a legitimate interest assessment and a DPIA, takes removal requests at hunter.io/claim, drops profiles within 3 months of leaving their source page, and links a DPA. The API enforces opt-outs with a 451 (28 of 30). The changelog flagged the June 2026 switch to recipient-based engagement figures as affecting API users, Beta endpoints warn of breaking changes, and no deprecation policy found (8 of 20). Subprocessors at hunter.io/subprocessors and servers on Google Cloud in Belgium (20). 15 + 28 + 8 + 20 = 71.

ZeroBounce 63

Closed service under terms naming Hertza L.L.C. (ZeroBounce) of Nevada; SDKs and MCP server open source (15 of 30). The data protection page says uploaded data is never kept more than 30 days, the privacy policy of 30 June 2026 keeps account data 'as long as needed', and EU and UK DPAs are published (22 of 30). An API migration page, with no dated deprecation policy (6 of 20). A sub-processor list naming each provider and the data exchanged (16 of 20). 15+22+6+16 = 59.

Hunter API + MCP 54

The hosted MCP exposes about 100 tools (102 by our count of llms-full.txt on 4 November, 96 on 1 October, 107 in the 30 September check) across search, enrichment, leads, lists, sequences and account admin, with no toolsets or read-only subset found. The REST side returns up to 100 rows a call (8 of 25). limit up to 100, offset up to 10,000, cursor pagination on multi-domain search (18 of 20). Structured errors, but rate limits answer 403 and quota exhaustion 429, which inverts what most clients expect (12 of 20). Repeat lookups within a billing period are free, POST and PUT /v2/leads dedupe by email, and sequence and email writes take an Idempotency-Key, but the MCP's 16 delete and bulk-delete tools carry no annotations we could find (8 of 20, the earlier partial kept). Few required parameters and a test key (8 of 15). 8 + 18 + 12 + 8 + 8 = 54.

ZeroBounce 69

A compact JSON result per address, batch validation and a file API for lists (18 of 25). Little to paginate; file status and results by file id (10 of 20). Status and sub-status codes say why an address failed, and the error page explains 400, 404 and 429 (14 of 20). Unknown results are free and safe to retry; repeated validations are charged again (12 of 20). Many official SDK wrappers and an MCP server, with few required parameters (15). 18+10+14+12+15 = 69.

Hunter API + MCP 63

Newest changelog entries are three dated 30 September 2026 (the ChatGPT app, saved searches and AI tool setup paths), 35 days before 4 November. The official Claude Code plugin (hunter-io/claude-plugin) moved from 0.1.0 (18 March) to 0.1.1 on 28 October. The commit that bumps the version only adds an icon, but 0.1.1 is the first version to carry the skill changes made since 0.1.0, including domain-search on 17 August, build-sequences on 14 September and 16 October, and discover on 16 October, so it counts as a full release, 7 days before 4 November (30). Three changelog entries and the plugin release in the 90 days from 6 August (20). Public changelog and support. Issue handling not visible (10 of 15). Not in the official MCP registry. We didn't find current official SDKs; the plugin is MIT on GitHub (0). llms-full.txt tells agents to avoid a deprecated local package, whose repository was last changed on 7 July 2025 (3 of 10). 30 + 20 + 10 + 0 + 3 = 63.

ZeroBounce 70

Closed service. The JavaScript SDK 3.0.0 was published on 25 October 2026 (30). No API changelog; the dated changes found in 90 days are that release and status-page notices, fewer than three releases (10 of 20). Support by email and 24/7 chat per the docs, a public status page; replies not tested (10 of 15). Official SDKs in many languages and an MCP server (15). Package health not checked (5 of 10). 30+10+10+15+5 = 70.