Which lead research and enrichment tools should a GTM agent use? 13 tools compared

Short answer: give a GTM agent one tool to find accounts (web search, scraping or a signal source) and one to enrich contacts, not five of each. Prefer the vendor's official connector, run a second enrichment source only as a cheapest-first waterfall, send each provider the fewest fields that get a match, never scrape through the owner's personal LinkedIn session, and have the owner approve keys, paid credits and any send. Of the 13 lead research and enrichment tools compared below, 11 passed our security scan at a pinned commit and 2 closed hosted services are held at review because there is no code to scan.

Finding and enriching leads comes first in a GTM engineer agent's outbound pipeline: turn an ideal customer profile into a list of accounts, then into named contacts with roles and verified emails. It is also where the agent spends money on lookups, hands outside vendors personal data, and runs into platform terms.

Item facts below (maker, cost, scan result, commit) come from the library build of 2026-11-03. Connection details come from each item's listed install method. We have not run these tools against a live list, so this is a guide to choosing and limiting them, not a benchmark.

Two jobs: finding accounts and enriching contacts

• Finding means discovering companies and people that fit: web search, crawling directories and job boards, scraping public pages, or watching for buying signals such as funding or hiring.
• Enriching means filling in the record: firmographics, role, seniority, email and phone, usually from a commercial data provider.

Most agents need one tool for each.

The tools we have vetted

11 of the 13 are published by the vendor itself. The two community items are Clay skill pack (Forma Norden), which teaches an agent to build Clay tables and waterfalls, and SignalForce, a config-driven engine that collects public buying signals for an ICP.

More broadly, 21 items in our reviewed catalog are tagged for data and scraping work (19 pass, 2 at review). Across the wider library, 427 items carry that tag and 368 of them (86.2%) have not been scanned yet.

What the scan says, and what it cannot

2 of the passed tools did not pass automatically. Reading the flagged lines cleared them:

• Apify MCP Server (official): automated review (medium 4). No high or critical findings; the secret-like strings were vendor-side telemetry and public client keys, and the vulnerable packages sat in a development lockfile.
• Browserbase Skills (official): automated reject (medium 2, critical 1). The critical finding was the API reference telling the agent to send the user's own Browserbase key to Browserbase's own API, plus an instruction never to write the key into artifacts. Not exfiltration.

Two limits matter for lead tools in particular:

1. Remote MCP servers run on the vendor's machines. For Apollo, Exa, Apify and Firecrawl we scanned the public repo at the commit shown, not the hosted service you connect to. Treat every result as untrusted input.
2. Closed services have nothing to scan. Clay MCP (official, hosted) and Sixtyfour API are held at review because they are closed hosted services that need a paid plan. The decision there is about data handling and scopes, which only the owner can weigh.

Across all 111 repos in our catalog, 41.4% had at least one medium-or-higher automated finding (research), so a pinned, read version beats "latest".

Six rules for lead tools

1. One finder, one enricher

Start with one research tool and one enrichment source that match the data you need. Add another only when your own log shows a gap, such as records the first source missed.

2. Waterfall, cheapest first

If you use more than one enrichment source, try them in cost order, stop at the first verified hit, and log which source answered and what it cost. Our house skill Enrichment waterfall SKILL.md is a short SKILL.md that does exactly this. Disclosure: it is made by Avatar 8 LLC, which runs this site; it went through the same scan and passed.

3. Send the minimum

Enrichment means sending names, domains and emails to a third party. Send only the fields that get a match, keep the provider's terms on file, and do not pass along notes or deal data the lookup does not need.

4. No personal-session scraping

Do not let the agent automate the owner's own LinkedIn or other logged-in social account. LinkedIn MCP Server (community) is clean of high and critical findings, but we hold it at review because automating a personal LinkedIn session may violate LinkedIn's User Agreement and risks the account. In our daily vetting since 2026-10-17, 19 of 150 rejections were for terms-of-service or platform-policy risk, and 7 rejection notes mention LinkedIn. Prefer official APIs and public pages.

5. Owner approval for keys, credits and sends

Of the 13 tools above, 6 need an API key, 4 have a free tier, 2 are paid and 1 is free (the Clay skill pack, which still needs a Clay account). Keys and paid plans should be the owner's call, and the account should belong to whoever the agent works for, not to the owner personally if it is a separate venture.

6. Enrich, verify, then stop

Enrichment should end in a file, not an email. Our house prompt Outbound first run (staging only) pulls ICP contacts, verifies them, finds one verifiable fact per contact, drafts three touches into a CSV and stops before sending, reporting baseline counts. Sending is a separate, approved step (CRM rules).

What builders are asking

Less than you might expect. Of the 198 public posts about skills and MCP servers we collected on 2026-10-25 (X, Reddit and Hacker News), none mention enrichment, Apollo or Clay, 1 mentions prospects and 2 mention outbound. One GTM example: an open-sourced outbound system built as "20 Claude Code skills, one orchestrator", where each stage reads the last stage's file (@UdayKang7, 2026-10-14).

We wrote this because finding and enriching prospects are the first two of the six jobs in our GTM engineer guide, not because public demand for it is measured.

What we have not measured

We have no data on match rate, email accuracy, bounce rate, cost per record or token use for any of these tools, and not enough check-ins from outside agents to compare them. The table covers maker, connection, cost and scan results only. If you run a waterfall, your own log of hit rate and cost per record is the number that matters.

Let a coach pick and prune

Agent Coach matches vetted tools to your agent's job, checks in daily on what it used, and says what to keep or remove. It is free. REST and MCP details are in the developer docs. Paste one line into your agent:

Read https://upskill.coach/start and follow it.

Related: how to vet a skill or MCP server.

FAQ

What is the best lead enrichment tool for an AI agent?

There is no single best one, and we have no hit-rate data to rank them. Pick by the data you need and the account you already pay for: in our catalog, Apollo.io MCP plugin (official) is the official hosted MCP for Apollo's people and company data, Explorium GTM Skills, Crustdata Skills, Sixtyfour Skill (official) and Parallel Agent Skills (official) are official skills for their vendors' APIs, and Clay offers a hosted MCP for waterfall enrichment across its providers. Measure hit rate and cost per record on your own list before committing.

Should a GTM agent use one enrichment provider or several?

Start with one. Add a second only when your own log shows records the first one missed, then run them as a waterfall: cheapest source first, stop at the first verified hit, and record which source answered and what it cost.

Is it safe to send prospect data to an enrichment API?

It means a third party sees the names, emails and companies you send. Send the fewest fields that get a match, and read the vendor's data-handling terms first. We keep Clay MCP (official, hosted) and Sixtyfour API at review for this reason: they are closed hosted services with no code for us to scan.

Can an AI agent scrape LinkedIn for leads?

Not through the owner's personal session: that may violate LinkedIn's User Agreement and risks the account, so we keep LinkedIn MCP Server (community) at review for policy, not code. In our daily vetting, 19 candidates were rejected for terms-of-service or platform-policy risk.

Do lead tools need the owner's approval?

Usually yes. Of the 13 lead tools compared here, 6 need an API key, 2 are paid and 4 have a free tier; only 1 is free outright. Keys, paid credits and anything that sends a message should wait for the owner (setup).

Does a passed security scan mean the data is accurate?

No. A scan checks the code and instructions an item ships, not the quality of the data behind the API. Accuracy, coverage and bounce rates have to be measured on your own records.

Questions or corrections: ops@avatar33.com.