Scam detection API for apps and AI agents

Q: Is there an MCP server for AI agents?

Yes. The MCP server at https://api.bewary.app/mcp has 15 tools for Claude, ChatGPT, Cursor, VS Code and other MCP clients over streamable HTTP. They run the same code as the REST API, declare an outputSchema and return structuredContent.

Each call returns a verdict and its reason_codes for a single link, domain, phone number, email, wallet or IBAN.

Get an API key Read the docs

claude mcp add --transport http bewary https://api.bewary.app/mcp --header "Authorization: Bearer $BEWARY_API_KEY"

npx bewary

$ npx bewary url https://amazon-orders-help.top/confirm
Scam  ▂▄▆█  p_scam 0.9116

High    Fake domain (brand + suspicious TLD)  DOMAIN_BRAND_ON_ABUSED_TLD
Medium  Lookalike domain                      DOMAIN_LOOKALIKE_BRAND_WORD

url     https://amazon-orders-help.top/confirm  Scam
domain  amazon-orders-help.top                  Scam

req_01M6A6HXWF86METPG24EPK22Z9

$ npx bewary iban DE89370400440532013000
Unknown  ▂▄··  p_scam 0.2000

bank  Commerzbank, BIC COBADEFFXXX
iban  DE89 3704 0044 0532 0130 00, valid, SEPA

req_01M6A6HY20EJFV1H8VQGQCHJ3W

> A text says my Amazon order is on hold and links to https://amazon-orders-help.top/confirm. Is that link safe to open?

● bewary - lookup_url (MCP)(url: "https://amazon-orders-help.top/confirm")
  ⎿  {
       "verdict": "scam",
       "p_scam": 0.9116,
       "reason_codes": [
         "DOMAIN_BRAND_ON_ABUSED_TLD",
         "DOMAIN_LOOKALIKE_BRAND_WORD"
       ],
       "entities": [
         { "type": "url", "verdict": "scam" },
         { "type": "domain", "verdict": "scam" }
       ]
     }

● No, don't open it. This is very likely a phishing text.

$ curl "https://api.bewary.app/v1/url?u=https%3A%2F%2Famazon-orders-help.top%2Fconfirm"

{
  "request_id": "req_01M6A6HXWF86METPG24EPK22Z9",
  "verdict": "scam",
  "p_scam": 0.9116,
  "reason_codes": [
    "DOMAIN_BRAND_ON_ABUSED_TLD",
    "DOMAIN_LOOKALIKE_BRAND_WORD"
  ],
  "entities": [
    { "type": "url", "verdict": "scam" },
    { "type": "domain", "verdict": "scam" }
  ]
}

Data from

FTC
OFAC
NANPA
Certificate transparency logs
RDAP
European Central Bank
Croatian National Bank

Lookup API endpoints

Each lookup returns a verdict, the signals that decided it and typed facts. The answers below were recorded from the live API.

GET/v1/url?u=http://paypal-login-secure.top/verify?account=update

Scamp_scam 0.9116

signals[0]: DOMAIN_BRAND_ON_ABUSED_TLDhigh+55brand_registry
signals[1]: DOMAIN_LOOKALIKE_BRAND_WORDmedium+35brand_registry
final_url: http://paypal-login-secure.top/verify?account=update
shortener: false
domain.lookalike.brand_id: paypal
domain.lookalike.technique: brand_word
domain.tld_abuse: high
domain.status: gone

Recorded Oct 31, 2026 · median 477 ms · 1 creditLink docs

GET/v1/domain/chase.com

Safep_scam 0.0000

signals[0]: DOMAIN_ALLOWLISTEDinfo-60brand_registry
registered_at: 1995-10-11T04:00:00Z
age_days: 11342
registrar: MarkMonitor Inc.
expires_at: 2027-10-10T04:00:00Z
tld_abuse: low
allowlisted: true
status: live

Recorded Oct 31, 2026 · median 449 ms · 1 creditDomain docs

GET/v1/phone/+12013408962

Unknownp_scam 0.2000

signals[0]: PHONE_REPORTED_CALLER_IDmedium+25phone_complaints
e164: +12013408962
country: US
original_carrier: LEVEL 3 COMMUNICATIONS, LLC - NJ
complaints.ftc.count: 12
complaints.ftc.days: 9
complaints.ftc.robocall_share: 0.3333
complaints.ftc.last_at: 2026-10-15T00:00:00Z

Recorded Oct 31, 2026 · median 115 ms · 1 creditPhone number docs

GET/v1/shortcode/US/86006

Safep_scam 0.0013

signals[0]: SHORTCODE_LEGITIMATEinfo0shortcodes
code: 86006
country: US
status: legitimate
operator.name: Bank of America
operator.brand_id: bankofamerica
legit_uses: null
reports_30d: null

Recorded Oct 31, 2026 · median 113 ms · 1 creditSMS short code docs

GET/v1/email/signup@mailinator.com

Suspiciousp_scam 0.5000

signals[0]: EMAIL_DISPOSABLEhigh+50email_providers
signals[1]: DOMAIN_AGE_GT_1Yinfo-45registration
disposable: true
free_provider: false
role_account: false
mx: true
domain.registered_at: 2003-07-02T13:50:53Z
domain.registrar: GoDaddy.com, LLC

Recorded Oct 31, 2026 · median 211 ms · 1 creditEmail address docs

GET/v1/ip/1.1.1.1

Unknownp_scam 0.2000

signals: []
version: 4
asn: 13335
as_org: CLOUDFLARENET - Cloudflare, Inc., US
country: AU
hosting_type: cdn
reverse_dns: one.one.one.one
listed: null

Recorded Oct 31, 2026 · median 260 ms · 1 creditIP address docs

GET/v1/wallet/eth/0x098B716B8Aaf21512996dC57EB0615e2383E2f96

Suspiciousp_scam 0.7914

signals[0]: WALLET_SANCTIONEDhigh+75sanctions
chain: eth
caip2: null
sanctioned: true
listed: false
list_count: 1
reports: null

Recorded Oct 31, 2026 · median 127 ms · 1 creditCrypto wallet docs

GET/v1/iban/DE89370400440532013000

Unknownp_scam 0.2000

signals: []
print_form: DE89 3704 0044 0532 0130 00
country: DE
valid: true
sepa: true
bank.name: Commerzbank
bank.bic: COBADEFFXXX
bank.source: Quelle: Deutsche Bundesbank

Recorded Oct 31, 2026 · 1 creditIBAN docs

GET/v1/app/google_play/com.whatsapp

Unknownp_scam 0.2000

signals: []
store: google_play
app_id: com.whatsapp
name: WhatsApp
developer: WhatsApp LLC
status: live
rating_count: 246797088
first_seen: 2026-10-30T19:36:24Z

Recorded Oct 31, 2026 · 1 creditMobile app docs

GET/v1/payment-handle/venmo/venmo

Unknownp_scam 0.2000

signals: []
provider: venmo
handle: venmo
status: active
status_checked_at: 2026-10-31T21:06:41Z
reports: null

Recorded Oct 31, 2026 · 1 creditPayment handle docs

Assess an accountPOST/v1/assess1 credit per field
Batch lookupsPOST/v1/batch1 credit per value, up to 1,000 a call
Related domainsGET/v1/domain/{host}/related5 credits a page

Data coverage

Counts from GET /v1/datasets on November 4, 2026. Free, no key needed.

1,934,038records Bewary answers from

DNS historyAddresses, name servers, mail servers and change history.864,153domains
Phishing and malware feedsRead hourly. Each domain is re‑checked weekly, and dead ones stay as history.371,543live domains
Disposable email domainsDisposable address, free provider or role mailbox.51,431live domains
Crypto wallet reportsAddresses named in scam reports.28,604wallets
Stablecoin issuer freezesAddresses Tether and Circle froze on chain.11,318wallets
National bank code listsBanks with their BICs and addresses in 25 countries, free of charge from each publisher.10,365banks
Platform takedownsPages a hosting or form platform took down itself, each listed as the exact link.1,449links
US sanctions listThe US Treasury's OFAC list of sanctioned crypto addresses.805wallet addresses
Banks on sanctions listsBanks on the OFAC and EU sanctions lists, by BIC or as an office the list names, read daily.252banks
IBAN formatsISO 13616: registry country, length, BBAN structure and check digits.89countries
Brand registryDomain lookups flag lookalikes of these brands.43brands

Also behind every answerRDAP registration · Certificate transparency logs · Web archive · IP networks · App Store and Google Play · Cash App, PayPal and Venmo profiles

Country	Scam domains	Reported phone numbers	Number blocks	Banks for IBAN checks	SMS short codes
United StatesNANPA, FTC, FCC	–	381,173	202,774	–	26
Taiwan165 anti-fraud line	65,328	–	–	–	–
PolandCERT Polska	61,405	–	–	–	–
GermanyFederal Network Agency, Deutsche Bundesbank	–	10,013	–	3,432	–
ItalyBanca d'Italia	–	–	–	1,201	–
SwitzerlandSIX Interbank Clearing	–	–	–	1,071	–
AustriaOesterreichische Nationalbank	–	–	–	874	–
SloveniaBanka Slovenije	–	–	–	821	–
BelgiumNational Bank of Belgium	–	–	–	782	–
FranceEuropean Central Bank	–	–	–	504	–
SpainBanco de España	–	–	–	425	–
IrelandDeutsche Bundesbank	–	–	–	248	–
LithuaniaBank of Lithuania	–	–	–	230	–
LuxembourgEuropean Central Bank	–	–	–	120	–
United KingdomDeutsche Bundesbank	–	–	–	115	–
PortugalBanco de Portugal	–	–	–	104	–
NetherlandsDeutsche Bundesbank	–	–	–	91	–
MaltaCentral Bank of Malta	–	–	–	63	–
CzechiaCzech National Bank	–	–	–	47	–
CyprusCentral Bank of Cyprus	–	–	–	42	–
GreeceEuropean Central Bank	–	–	–	39	–
SlovakiaNárodná banka Slovenska	–	–	–	38	–
RomaniaDeutsche Bundesbank	–	–	–	26	–
BulgariaEuropean Central Bank	–	–	–	23	–
CroatiaCroatian National Bank	–	–	–	22	–
LatviaDeutsche Bundesbank	–	–	–	22	–
LiechtensteinSIX Interbank Clearing	–	–	–	20	–
GibraltarDeutsche Bundesbank	–	–	–	5	–

Bank names and BICs come from each central bank's public list, free of charge from its publisher. The Federal Network Agency's list also names numbers from 139 other countries.

Use cases

AI agents

Give an agent the MCP server and it checks a link, number or wallet before it opens, calls or pays. The tools return typed JSON, not prose.

MCPlookup_url and 14 more tools

Claude CodeBewary MCP server

A text says my Amazon order is on hold and links to https://amazon-orders-help.top/confirm. Is that link safe to open?

lookup_url(url: "https://amazon-orders-help.top/confirm")

Scamp_scam 0.9116

DOMAIN_BRAND_ON_ABUSED_TLD
DOMAIN_LOOKALIKE_BRAND_WORD

No, don't open it. This is very likely a phishing text.

Payouts and payments

Before a payout, Bewary checks an IBAN's check digits and, in 25 countries, names its bank and BIC. It matches wallets against US sanctions and says whether a Venmo, PayPal or Cash App handle is active.

Payoutspending review

PayeeBewaryAction

DE89 3704 0044 0532 0130 00IBAN Valid, Commerzbank, COBADEFFXXX Pay

DE89 3704 0044 0532 0130 01IBAN The IBAN fails its check digitsIBAN_CHECKSUM_INVALID Return to payee

0x098b…2f96Ethereum wallet A wallet on a US sanctions listWALLET_SANCTIONED Block

@venmoVenmo Profile active Pay

Seller and account onboarding

One POST /v1/assess call reads a new seller's website, email, phone, other links and payout wallet, returning a single deny, review or pass decision.

POST/v1/assess

New sellerseller_8841Decision:Deny

FieldBewary

paypal-login-secure.topwebsite Scam Fake domain (brand + suspicious TLD)DOMAIN_BRAND_ON_ABUSED_TLD

payouts@mailinator.comemail Suspicious Disposable emailEMAIL_DISPOSABLE

+18008291040phone Unknown Toll free, US, not on a scam list

Messaging and SMS platforms

Your SMS router uses short code and URL lookups to pass legitimate short codes and block lookalike links before delivery.

Inbound SMSrouting

Sender or linkBewaryAction

86006Short code Safe Bank of America, real sender Allow

www.usps.com/manage/Link Safe Established domain (allowlist) Allow

amazon-orders-help.top/confirmLink Scam Fake domain (brand + suspicious TLD)DOMAIN_BRAND_ON_ABUSED_TLD Block

paypal-login-secure.top/verify?account=updateLink Scam Lookalike domainDOMAIN_LOOKALIKE_BRAND_WORD Block

Trust and safety

Your queue sends up to 1,000 reported values in one POST /v1/batch call. Each answer carries the reason code that decided it.

POST/v1/batch

User reportsone batch call

ReportedBewaryQueue

paypal-login-secure.top/verify?account=updateLink Scam Fake domain (brand + suspicious TLD)DOMAIN_BRAND_ON_ABUSED_TLD Take down

0x098b…2f96Wallet Suspicious A wallet on a US sanctions listWALLET_SANCTIONED Review

signup@mailinator.comEmail Suspicious Disposable emailEMAIL_DISPOSABLE Review

+12013408962Phone Unknown 12 FTC complaintsPHONE_REPORTED_CALLER_ID Review

com.whatsappAndroid app Unknown Live on Google Play, WhatsApp LLC Review

chase.comDomain Safe Established domain (allowlist)DOMAIN_ALLOWLISTED Close

For developers

Response schema

The shared response schema lets a single parser read answers from every endpoint.

verdict: scam, suspicious, safe or unknown. Unknown is never safe.
p_scam: The probability that it is a scam, from 0 to 1.
reason_codes: Stable codes that decided it, strongest first. Codes are added, never renamed.
entities: The value and what it resolves to, such as a link's domain, each with its verdict and typed facts.

Response 200 OK application/json

{  "verdict": "scam",  "p_scam": 0.9116,  "reason_codes": [    "DOMAIN_BRAND_ON_ABUSED_TLD",    "DOMAIN_LOOKALIKE_BRAND_WORD"  ],  "entities": [    {      "type": "url",      "value": "http://paypal-login-secure.top/verify?account=update",      "verdict": "scam"    },    {      "type": "domain",      "value": "paypal-login-secure.top",      "verdict": "scam"    }  ]}

MCP server for AI agents

The MCP server's 15 tools run the same code as the REST API. An agent can call a tool before opening a link, calling a number or sending money.

claude mcp add --transport http bewary https://api.bewary.app/mcp --header "Authorization: Bearer $BEWARY_API_KEY"

Works withClaudeChatGPTCursorVS CodeWindsurf

lookup_urllookup_domainrelated_domainslookup_iplookup_phonelookup_shortcodelookup_emaillookup_walletlookup_ibanlookup_applookup_payment_handlewatchunwatchlist_watcheslist_events

Pricing

The API, CLI and MCP server share one credit balance.

Free

Free key: 1,000 credits a month; no card, reset on the 1st (UTC)
Works on: every endpoint and MCP tool; deep lookups, line type, batch and watches included

Get a free key

Prepaid credits

Credits never expire

Pack	Credits	Per 1,000 credits
$20	10,000	$2.00
$100	60,000	$1.67
$500	375,000	$1.33
$2,000	2,000,000	$1.00

Buy credits

Credits per call

Lookup1
Related domains, a page5
Phone with live line type10
Deep lookup30

Rate card

Free tools

Free domain age, link, phone number and QR code checkers use the same API.

Domain age checker chase.comregistered 1995 Safe Is this link safe? paypal-login-secure.top/…PayPal lookalike on .top Scam Is this number a scam? +18008291040toll free, not listed Unknown Is this QR code safe? reads the link, then checks it

Questions

Is there a free scam detection API?

Yes. A free key gets 1,000 credits a month without a card, enough for 1,000 lookups on any endpoint. Prepaid credit packs start at $20 and never expire.

What does the scam detection API check?

Bewary looks up links, domains, phone numbers, SMS short codes, email addresses, IP addresses, crypto wallets, IBANs, mobile apps and payment handles. Assess checks a new account's website, email, phone and wallet in one call, and related domains finds the other domains on the same setup.

Is there an MCP server for AI agents?

Yes. The MCP server at https://api.bewary.app/mcp has 15 tools for Claude, ChatGPT, Cursor, VS Code and other MCP clients over streamable HTTP. They run the same code as the REST API, declare an outputSchema and return structuredContent.

What is the API latency?

Lookup medians ranged from 113 to 477 ms, measured from Europe on October 23, 2026 with first-time inputs. Lookups use no language model.

What request data does Bewary store?

A lookup keeps no record of who asked. It can add the value itself to Bewary's data: a looked-up domain is queued for its web-archive history, and a looked-up app is recorded as seen on its store. API keys are stored as SHA-256 hashes.

Start with 1,000 free credits a month

Free keys get 1,000 credits monthly without a card. Lookups cost 1 credit.

Get an API key Read the docs

claude mcp add --transport http bewary https://api.bewary.app/mcp --header "Authorization: Bearer $BEWARY_API_KEY"