Infrastructure
What runs underneath, and the code that does it.
What this site says about how the engine works is in the open-source app. Here is each claim, with a link to the code, pinned to the release we checked it against.
- Licence
- AGPL-3.0
- Code
- GitHub
- Hosting
- In the EU
- Verification IP health checks
- Every 6 hours
- Security reports
- Private, acknowledged within 3 working days
Verification servers
A pool of IP addresses, paced and checked.
Email checks leave from our own verification servers, never from yours. They're spread over a pool of IP addresses, paced so mail servers keep answering, and each IP is checked for health every 6 hours.
- IP 1Checking
- IP 2Checking
- IP 3Checking
- IP 4Benched: on a blocklist
Each IP, per mail provider
- Googlepaced hardest
- Microsoftpaced hardest
- Other mail serverspaced
Each IP also has a limit a minute and a limit a day.
Each company, across all IPs
A first burst, big enough to test the company for catch-all and look up two people, then about 4 checks a minute.
Rejected guesses at one company are capped each day: many rejections look like harvesting, so after the cap that company waits until tomorrow.
Every 6 hours, each IP is checked
- DNS blocklists
- Reverse DNS
- SPF
A blocklisted IP is benched and not used until it's clean again.
Illustrative: the number of IPs changes.
Read the code:proxyRouter.ts,senderHealth.ts,senderHealthMonitor.ts
Claims, with code
Each claim, and where to read it.
The links point at release v0.9.118 of the open-source app, so they show the code as it was when we checked.
| Claim | How | Code |
|---|---|---|
| No email is sent to check an address | Our verification server looks up the mail server, says hello (EHLO), gives a sender (MAIL FROM) and asks about the address (RCPT TO). It hangs up (QUIT) before DATA, so no message is sent. | emailFinder.ts |
| Catch-all domains are said so, not guessed | A made-up address is checked; if it's accepted, a second of a different shape is checked in a separate session. Both accepted means catch-all. The verdict is kept for 30 to 180 days. | emailFinder.tssharedCatchAll.ts |
| Checks are paced per mail provider and per company | Each IP asks each mail provider only so often, Google and Microsoft hardest. Each company gets a first burst, then about 4 checks a minute, with a daily cap on rejected guesses. | proxyRouter.ts |
| Verification IPs are health-checked every 6 hours | Each IP is checked against spam blocklists, with its reverse DNS and SPF. One on a blocklist is benched until a check finds it clean. | senderHealth.tssenderHealthMonitor.ts |
| Finding an email takes at most 6 checks | Likely formats are ranked, the company's learned pattern first, and checked one by one until the mail server confirms one. Only the pattern is stored, never the name. | emailFinder.tspatterns.ts |
| Shared learning is company data only | Hosted copies share a company's email format (companies of 10 or more people, backed by 3 addresses from 2 workspaces) and catch-all verdicts. Neither holds a person's name or address. | sharedFormats.tssharedCatchAll.ts |
| Opt-outs apply across hosted copies | Opt-outs are stored as keyed hashes (HMAC), not as addresses, and shared, so someone who opts out on one hosted copy is left out on all of them. | suppression.ts |
| Prospect search keeps 7 fields per person | Name, title, seniority, company, domain, country and profile URL. Search results are kept only if you save them. | types.ts |
| Sending protects your domain | Each sending domain is signed with its own DKIM key. Hard bounces and complaints are never emailed again. Unconfirmed guesses go out 50 first, then wait 1 hour, and the rest only if under 2% bounced. | MagpieCRM's sending docs |
| MCP keys are per app, and sending needs you | MCP runs over Streamable HTTP at a workspace's /api/mcp, with a Bearer key per app. It can't send or schedule a campaign. The tools that lead to email (starting a sequence, adding people to one, emailing a proposal) are marked destructive, so AI apps that respect that ask you first. | api/mcp.tscopilot/mcp.ts |
Keys
A key per app, made and revoked in Settings.
The way to reach the engine from code today is MCP, on a MagpieCRM workspace. Each AI app gets its own key, shown once, and each can be revoked without touching the others.
- Bearer keys over Streamable HTTP
- Tools that send email are marked destructive
Security
Found a security issue?
Please report it privately on GitHub, not in a public issue. We acknowledge reports within 3 working days. Our security policy says how to report, and what happens next.
Not yet
What we don't have yet.
So you know where things stand:
- No status page yet.
- No uptime guarantee.
- No SOC 2 or ISO 27001 certification.
FAQ
Questions, answered.
Where is Magpie Cloud hosted?
In the EU. Email checks go out from our own verification servers, never from your domain or IP addresses.
Is there a status page or an uptime guarantee?
Not yet. Neither exists today, and we won't claim one until it does.
Are you SOC 2 or ISO 27001 certified?
No. What we can show instead is the code: the app is open source, and each claim on this page links to where it's done.
Why do the links point at a release, not the latest code?
So each link shows the code as it was when we checked the claim. Newer releases are on GitHub, and changes to the engine are in the changelog.
Keep exploring
Related
Build on the engine behind MagpieCRM.
The APIs are in early access. Tell us what you'd use them for, and we'll write when your key is ready.