# BurnerCheck

> Disposable (throwaway) email checker: checks an email address or a domain against the open-source disposable-email-domains list (CC0) and flags role addresses, free webmail providers, look-alike domains and likely typos. List-based and offline (no MX/DNS lookup, no mail server contact). Public JSON API plus a remote MCP server for AI agents. Addresses are processed in memory and not stored or logged.

## For AI agents

- [MCP server](https://burnercheck.mike-tusa.workers.dev/mcp): remote MCP over Streamable HTTP (POST only, stateless, JSON responses). Protocol versions: 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05. Tools: `check_email` (email), `check_domain` (domain), `get_meta`. Read-only. Client config (most MCP clients accept this; some use a different format, for example VS Code uses a `servers` key): `{"mcpServers":{"burnercheck":{"type":"http","url":"https://burnercheck.mike-tusa.workers.dev/mcp"}}}`
- [OpenAPI 3.1 spec](https://burnercheck.mike-tusa.workers.dev/openapi.json): machine-readable description of the JSON API
- [Docs](https://burnercheck.mike-tusa.workers.dev/docs): human-readable API docs

## JSON API

- `POST https://burnercheck.mike-tusa.workers.dev/v1/check` with JSON `{"email": "jane@mailinator.com"}` (recommended: keeps the address out of URLs): valid_syntax, disposable, role, free_provider, confusable, suggestion, list_version. `GET /v1/check?email=` also works but puts the address in a URL.
- `GET https://burnercheck.mike-tusa.workers.dev/v1/domain/{domain}`: domain only (anything with "@" returns 400 domain_only). Prefer this when you don't need the local part.
- `POST https://burnercheck.mike-tusa.workers.dev/v1/check/batch` with `{"emails": [...]}`: up to 100 addresses, paid keys only (paid plans are not on sale yet).
- `GET https://burnercheck.mike-tusa.workers.dev/v1/meta`: version, list version and size, source, limits.
- Errors: { "error": { "code", "message" } } with 400 (missing_email, missing_domain, input_too_long, domain_only, invalid_body, invalid_json, empty_batch, too_many_emails, invalid_email_item), 401 (invalid_api_key, api_key_required), 403 (paid_plan_required), 404 (not_found), 405 (method_not_allowed), 413 (body_too_large), 415 (unsupported_media_type), 429 (rate_limited, too_many_failed_auth, daily_capacity_reached, quota_exceeded), 503 (keys_unavailable, storage_unavailable, quota_unavailable).
- "Not disposable" means "not on our list": new throwaway domains may not be listed yet, and a valid format does not mean the mailbox exists.

## Limits and keys

- Anonymous: about 10 checks/min per IP. API key (`Authorization: Bearer bc_live_...`, issued by request during early access): about 120/min; free plan 1000 checks per month. A shared daily capacity applies. The MCP endpoint uses the same keys and counters: each `check_email` / `check_domain` call is one check; `get_meta` and non-call messages don't count, but are capped at about 120/min per IP (HTTP 429 + Retry-After).

## Optional

- [Privacy](https://burnercheck.mike-tusa.workers.dev/docs#privacy): addresses are not stored or logged; the web checker sends them in POST bodies only.
- Source list: disposable-email-domains (CC0), refreshed weekly.
- Contact: digitalpromohub.support@gmail.com