Email Finder: Find Anyone's Email Address from a Name or LinkedIn URL

What this skill does

Finds one person's best available email address, routing through whichever tools fit the inputs you actually have. The inverse of the exhibitor-list skill: instead of walking a roster to find some qualifying people, it walks every available path to find one specific person — and only comes back to ask you something when the identity itself is genuinely ambiguous, like a common name with no company attached.

For a list of companies rather than a named person, use Find Decision Makers and Contact Information from Company Names instead.

Chain

whatever you know (name / company / domain / LinkedIn URL)
  to a routing decision       (paths A-E, picked from the inputs on hand)
  to search_people / search_linkedin_profile / linkedin_to_best_email
  to search_business_email_by_name   (a second angle on a confirmed name + domain)
  to reverse_linkedin_lookup  (confirm the person genuinely isn't indexed)
  to reverse_email_lookup     (pattern-guess common conventions, batched in one call)
  every email reported with its A-F risk score, never silently dropped

"Not found" means the chain was exhausted

A miss on the first tool is a mid-process result, not an outcome. The skill continues automatically through the remaining steps of the chosen path — including pattern-guessing — before it will report NOT FOUND, so a person is never written off because the cheapest lookup came up empty. Running only step one and calling the misses "not found" isn't a faster version of this skill; it's a much weaker one that happens to share step one.

The one exception is volume. On a list big enough that chasing every miss to the end meaningfully changes the number of calls, it asks up front which you want — full chain on everyone, or a faster partial pass — rather than quietly picking the cheap option and leaving you to discover the undercount later.

Inputs

Any one of these is enough to start — the rest are recovered along the way:

• Full name — or just a first or last name
• Company name — resolved to a domain automatically if you don't have one
• Company domain — e.g. acme.com
• LinkedIn profile URL — the most direct route; takes priority over everything else
• Role or title with no name — "the CFO at Acme" works as a starting point
• Anything else identifying — title, location, industry, used to disambiguate a common name

The five paths

When it activates

• "find [name]'s email address"
• "what's the email for this LinkedIn profile"
• "get me an email for the CFO at [company]"
• A name, LinkedIn URL, or role at a company handed over with a request for contact details

Output

One row: name, title, company, domain, linkedin_url, email, email_type, risk_score, verification_status, path_used, notes. email_type is business, personal, or pattern-guessed; verification_status is VERIFIED / PATTERN-GUESSED / UNVERIFIED / NOT FOUND. path_used tells you which chain was tried, so a miss is auditable rather than mysterious. Nothing found means it says so plainly with what was attempted — it never fabricates a plausible-looking address.

Search filters

search_people filters on query, company, company_domain, country, state, city, seniority, department or functional_area, industry, linkedin_industry, naics_code, employee_range, and revenue_range.

• Filters are free precision - execution cost comes from the free-text query, so a filters-only search runs ~40x cheaper and lands more precisely. A bare query is never the right shape; at minimum it gets country attached (~99% fill rate).
• Size and revenue apply to the person's current employer - "VPs at 51-200 employee software companies" is one call, not a company search followed by a people search.
• Three industry vocabularies - broad industry buckets, LinkedIn's ~150 niche labels, or a NAICS code at any depth. Shortening the code widens the net.
• Sparse filters are the usual cause of a thin result set - seniority/industry/department are ~60% filled and naics_code/linkedin_industry ~50%, and every filter is exact-match, silently dropping records where the field is empty.
• Sizing is free - count_only: true returns a match count without fetching data or charging tokens, and every response carries results.total to read before paginating.

Tips

• Search results already carry the email — business_email and business_email_risk_score come back on the matched search_people or search_linkedin_profile record, which frequently ends the chase in a single call with no enrichment step at all
• An empty search_business_email_by_name means "no business email down that path", not "no email" — it's the signal to try search_linkedin_profile → linkedin_to_best_email next, never a stopping point
• Misses on the enrichment endpoints cost nothing — tokens are only charged when data is found, so trying the cheapest direct tool first is never wasteful, even speculatively
• reverse_linkedin_lookup doubles as the "genuinely not in the database" check, and confirms the person's current company and domain, which may differ from the one you started with
• Pattern-guessing is the last resort and needs a confirmed name and domain: six common conventions batched into one reverse_email_lookup call. A hit whose current_company doesn't match the domain is flagged as possibly stale rather than passed off as a clean find
• A common name with no company isn't a search-tuning problem — one disambiguating detail (company, industry, city, or title) is worth more than any amount of re-querying
• Built for one person at a time, but it holds up row by row across a batch — each person gets the whole chain, not a single shared first pass