Get an API key
Ask ChatGPT Ask Claude

Bewary CLI

Bewary runs scam checks from the terminal with npx bewary. It requires Node 18 or newer, with no install. Commands look up links, domains, phone numbers, SMS short codes, email addresses, IP addresses, crypto wallets, IBANs, apps and payment handles, find related domains and manage watches. It prints verdict, p_scam, reason_codes and each entity's verdict. Scripts can use --fail-on suspicious or --fail-on scam to exit with code 2 when the verdict reaches that threshold.

Run it, no install

Shell
npx bewary url https://amazon-orders-help.top/confirm

The CLI printed this answer for the link in a fake Amazon delivery text. It includes the verdict, p_scam, the reason codes, and the link and its domain, each with its verdict.

text
Scam  ▂▄▆█  p_scam 0.9116

High    Fake domain (brand + suspicious TLD)  DOMAIN_BRAND_ON_ABUSED_TLD
Medium  Lookalike domain                      DOMAIN_LOOKALIKE_BRAND_WORD

url     https://amazon-orders-help.top/confirm  Scam
domain  amazon-orders-help.top                  Scam

req_01M6A6HXWF86METPG24EPK22Z9

To keep it installed: npm install -g bewary. It needs Node 18 or newer and nothing else.

Commands

One command per tool of the MCP server, each the same call as the API endpoint beside it.

CommandChecksAPI
bewary url <url>A link, with its redirects and the domain behind itGET /v1/url
bewary domain <domain>A domain: age, registrar, lookalike brandsGET /v1/domain/{host}
bewary phone <number>A phone number, in E.164 form like +18008291040GET /v1/phone/{number}
bewary shortcode <code>A US SMS short codeGET /v1/shortcode/US/{code}
bewary email <address>An email address and its domainGET /v1/email/{address}
bewary ip <ip>An IP address: network, country, hostingGET /v1/ip/{ip}
bewary wallet <chain> <address>A crypto wallet on btc, eth, trx, ltc, sol, xmr or dashGET /v1/wallet/{chain}/{address}
bewary iban <iban>A bank account number: valid or not, and the bank it belongs toGET /v1/iban/{iban}
bewary app <store> <app_id>An app on apple (its numeric id) or google_play (its package name): live, or pulled by the storeGET /v1/app/{store}/{app_id}
bewary payment-handle <provider> <handle>A cashapp, paypal or venmo handle: whether it exists and is activeGET /v1/payment-handle/{provider}/{handle}
bewary related <domain>Other domains that share an address, name servers, a certificate or a page template with it (API key only)GET /v1/domain/{host}/related

bewary --help lists every option. The ones a command adds:

  • phone: --line-type, the live line type (API key only).
  • url and domain: --deep, to read the linked page (API key only).
  • iban: --claimed-country, the country the payee says they are in. An IBAN from another country is flagged.
  • related: --page and --per-page, up to 50 domains a page.

Watch a domain, number, wallet or brand

With an API key, watch sends you an event when something changes: a domain moves to new addresses or goes down, a number or wallet is listed, a new lookalike of a brand appears.

CommandDoesAPI
bewary watch <type> <value>Starts a watch on a domain, phone, wallet or brand. --events picks the event typesPOST /v1/watches
bewary watchesLists your watches, active or pausedGET /v1/watches
bewary unwatch <id>Stops a watchDELETE /v1/watches/{watch_id}
bewary eventsReads your watches’ events, oldest first. --cursor continues where the last page endedGET /v1/events

Use it in scripts and CI

--fail-on suspicious (or scam) makes the exit code the decision, and --json prints the API’s answer as it came:

Shell
if ! npx bewary url "$LINK" --fail-on suspicious; then
  echo "Not opening $LINK"
fi

npx bewary domain "$DOMAIN" --json | jq -r '.verdict'

Exit codes: 0 answered, 1 failed (bad input, no network, an API error), 2 the verdict reached --fail-on.

Let an agent run it

Agents that run shell commands can call npx bewary without MCP setup. Give your agent the instructions below.

text
Before you open a link, call a number, reply to a message or pay someone the user does not know,
run `npx bewary url <link> --json` (or `phone`, `email`, `wallet`, `payment-handle`) and act on "verdict":
scam: stop and say why, from "reason_codes". suspicious: ask the user first. unknown: never treat it as safe.

Your key

Every command needs an API key: set BEWARY_API_KEY or pass --key. A free key gets 1,000 credits a month, no card.

Shell
export BEWARY_API_KEY="bw_..."   # your key, from bewary.app/account
npx bewary url "$LINK" --deep

Updated · This page as Markdown · Changelog