How to Find Work Emails in Gemini CLI (2026)

TL;DR

• Gemini CLI reaches LeadOcean through one gemini mcp add command and a browser sign-in. You search for people, then ask for one person's current work email and its status.
• It takes about 15 minutes. The example run spends up to 5 of your 1,000 free records: 3 on search rows, 1 on an MCP lookup and 1 on a REST re-check.
• Counts and enum lookups cost 0. A person we hold nothing for is a 404 and costs nothing.

Prerequisites

• A LeadOcean account from app.leadocean.io. The free plan has no card and 1,000 records, one-off.
• Gemini CLI installed. The Gemini CLI docs, September 2026, carry a notice that unpaid tier and Google One users moved to Antigravity CLI on 18 June 2026. Check which CLI your plan covers.
• A browser on the same machine. The same docs say OAuth sign-in opens a local browser and receives a redirect on localhost. It does not work over plain SSH.
• Optional, for the REST step: curl, jq and a key in your shell as $LEADOCEAN_API_KEY. The MCP steps need no key. The lookup needs the enrich scope, which free keys have.

export LEADOCEAN_API_KEY="paste-your-key-here"

Step 1: Add the LeadOcean MCP server

Add LeadOcean as a remote HTTP server. The Gemini CLI docs, September 2026, give the form gemini mcp add --transport http <name> <url>. The default scope is the current project. Add --scope user to load it everywhere.

gemini mcp add --transport http --scope user leadocean https://api.leadocean.io/mcp

Do not pass a --header flag. LeadOcean signs you in with OAuth 2.1, so no key goes into the config. Our OAuth server supports dynamic client registration, so you add no client ID.

Start gemini, then run two slash commands. The first opens your browser on LeadOcean. The second lists the server and its tools.

/mcp auth leadocean
/mcp

You should see all 13 LeadOcean tools. Server details are on the LeadOcean MCP page.

Step 2: Check the email filters for free

Look up exact strings before you filter. A guess such as "business" returns nothing. Ask Gemini CLI for the email type values.

Use leadocean_list_enum_values with name email_type. List the values and say which
one means an address at the person's current employer. Do not call any tool that
spends records.

The answer is work. The value work_other is a business address at a different company, usually a former employer.

Gemini CLI asks you to confirm each MCP tool call unless the server is marked trusted. Do not pass --trust for this server. Read the arguments before you accept.

Step 3: Count the audience

Size the people you can email before you look anyone up. The example is IT directors in Germany with a verified work address.

Use leadocean_count_leads with jobLevel ["Director"], jobFunction ["Information
Technology"], country ["DE"], emailType ["work"], emailStatus ["verified"],
facets false. Report the total and say which email filter it used.

The count tool is free however often you call it. Passing emailStatus replaces its default of verified, catch_all_valid and catch_all. So this total is verified work addresses only, not everyone we hold.

Step 4: Search for three people

Search returns thin rows with email flags and no addresses. Keep limit small, because each person returned costs 1 record.

Use leadocean_search_leads with the same filters and limit 3. Show name, job title,
company, email_status and the person_id for each row. Do not call get_lead yet.

The REST version is the same filters in a flat JSON body. Filters are arrays, limit runs 1 to 100, and you page with cursor.

curl -s https://api.leadocean.io/v1/people/search \
  -H "x-api-key: $LEADOCEAN_API_KEY" -H "content-type: application/json" \
  -d '{
    "jobLevel": ["Director"],
    "jobFunction": ["Information Technology"],
    "country": ["DE"],
    "emailType": ["work"],
    "emailStatus": ["verified"],
    "limit": 3
  }' | tee search.json | jq -r '.data[].meta.source_ids.person_id'

Each row carries its id at meta.source_ids.person_id. There is no name plus domain lookup in the API, so this id is how you get from a search row to an address.

Step 5: Ask for the work email

Pick one row and look it up with reveal_email set to true. That returns every address we hold for the person, each with a type and a status.

Use leadocean_get_lead with person_id <id from row 1> and reveal_email true. Give me
the work address at their current employer, its status and its type in a table.
Tell me how many records this cost.

That is 1 record, and 4 so far with the search. A lookup that finds nobody costs nothing.

The same lookup returns career history in resume_data when we hold it: past roles with dates, plus education. It costs no extra record.

Pick the address whose type is work. A work_other address belongs to a former employer and is the likeliest to bounce. If the person has no work address, the table says so. Do not ask Gemini CLI to guess one from a name pattern.

Keep the spend visible. Tell the agent to stop after one lookup and report the records used. A prompt such as "find emails for everyone you found" keeps calling the tool, one record per person.

Step 6: Re-check the lookup over REST

The REST route is one request to a documented endpoint. It returns at most one address, at the person's current employer, and only if it is verified, catch_all_valid or catch_all.

ID=$(jq -r '.data[0].meta.source_ids.person_id' search.json)
curl -s "https://api.leadocean.io/v2/people/email/work?person_id=$ID" \
  -H "x-api-key: $LEADOCEAN_API_KEY"

This call costs 1 record, even when data comes back null. A 404, where we hold nothing for the person, costs 0. Field detail is on Find a work email.

Step 7: Read the status before you send

Ask Gemini CLI to flag anything weaker than verified.

For each address, say whether it is safe to send to. verified and catch_all_valid
are safe. catch_all can still bounce. Flag everything else. Do not guess an address.

LeadOcean gives no refund for bounces. The status is your only protection. A search row can show verified for a person who enriches as untested, so trust the status on the lookup, not on the search row.

What you get

The Step 2 and Step 3 results below are real free tool runs from 1 October 2026. The email type lookup returned seven values.

{
  "name": "email_type",
  "total": 7,
  "values": ["work", "work_other", "work_any", "personal", "other", "unknown", "none"]
}

The count for Director, Information Technology, country DE, emailType work, emailStatus verified returned this.

{
  "total": 661,
  "totalIsExact": true,
  "credits": 0,
  "sample": 1,
  "hasMore": true,
  "source": "leadocean"
}

That is 661 people in Germany who match and hold a verified work address in search. Treat a search count of verified as an upper bound and confirm per address on lookup. Your number will differ as the data refreshes monthly.

We did not run a paid lookup for this page, so there is no measured result for one. The Step 6 call returns this shape. It is the response shape from the API reference, with placeholder values.

{
  "success": true,
  "data": {
    "email": "jane.doe@acme.com",
    "status": "verified",
    "verified_batch_date": "2026-09-14"
  }
}

When no address qualifies, data is null. That means none that qualify, not that the person has no work email. The whole run costs up to 5 records: 3 for the search, 1 for Step 5 and 1 for Step 6.

To check the number, call GET /v1/account before and after. It is free.

curl -s https://api.leadocean.io/v1/account \
  -H "x-api-key: $LEADOCEAN_API_KEY" | jq '.data.records | {used, remaining}'

Troubleshooting

FAQ