# Bewary CLI

Bewary runs scam checks from the terminal with `npx bewary`. It requires Node 18 or newer, with no install. Commands look up links, domains, phone numbers, SMS short codes, email addresses, IP addresses, crypto wallets, IBANs, apps and payment handles, find related domains and manage watches. It prints `verdict`, `p_scam`, `reason_codes` and each entity's verdict. Scripts can use `--fail-on suspicious` or `--fail-on scam` to exit with code 2 when the verdict reaches that threshold.

Updated 2026-10-30.

## Run it, no install

```bash
npx bewary url https://amazon-orders-help.top/confirm
```

The CLI printed this answer for the link in a fake Amazon delivery text. It includes the verdict, `p_scam`, the reason codes, and the link and its domain, each with its verdict.

```text
Scam  ▂▄▆█  p_scam 0.9116

High    Fake domain (brand + suspicious TLD)  DOMAIN_BRAND_ON_ABUSED_TLD
Medium  Lookalike domain                      DOMAIN_LOOKALIKE_BRAND_WORD

url     https://amazon-orders-help.top/confirm  Scam
domain  amazon-orders-help.top                  Scam

req_01M6A6HXWF86METPG24EPK22Z9
```

To keep it installed: `npm install -g bewary`. It needs Node 18 or newer and nothing else.

## Commands

One command per tool of the [MCP server](/mcp), each the same call as the API endpoint beside it.

| Command | Checks | API |
|---|---|---|
| `bewary url <url>` | A link, with its redirects and the domain behind it | `GET /v1/url` |
| `bewary domain <domain>` | A domain: age, registrar, lookalike brands | `GET /v1/domain/{host}` |
| `bewary phone <number>` | A phone number, in E.164 form like `+18008291040` | `GET /v1/phone/{number}` |
| `bewary shortcode <code>` | A US SMS short code | `GET /v1/shortcode/US/{code}` |
| `bewary email <address>` | An email address and its domain | `GET /v1/email/{address}` |
| `bewary ip <ip>` | An IP address: network, country, hosting | `GET /v1/ip/{ip}` |
| `bewary wallet <chain> <address>` | A crypto wallet on `btc`, `eth`, `trx`, `ltc`, `sol`, `xmr` or `dash` | `GET /v1/wallet/{chain}/{address}` |
| `bewary iban <iban>` | A bank account number: valid or not, and the bank it belongs to | `GET /v1/iban/{iban}` |
| `bewary app <store> <app_id>` | An app on `apple` (its numeric id) or `google_play` (its package name): live, or pulled by the store | `GET /v1/app/{store}/{app_id}` |
| `bewary payment-handle <provider> <handle>` | A `cashapp`, `paypal` or `venmo` handle: whether it exists and is active | `GET /v1/payment-handle/{provider}/{handle}` |
| `bewary related <domain>` | Other domains that share an address, name servers, a certificate or a page template with it (API key only) | `GET /v1/domain/{host}/related` |

`bewary --help` lists every option. The ones a command adds:

- `phone`: `--line-type`, the live line type (API key only).
- `url` and `domain`: `--deep`, to read the linked page (API key only).
- `iban`: `--claimed-country`, the country the payee says they are in. An IBAN from another country is flagged.
- `related`: `--page` and `--per-page`, up to 50 domains a page.

## Watch a domain, number, wallet or brand

With an API key, `watch` sends you an event when something changes: a domain moves to new addresses or goes down, a number or wallet is listed, a new lookalike of a brand appears.

| Command | Does | API |
|---|---|---|
| `bewary watch <type> <value>` | Starts a watch on a `domain`, `phone`, `wallet` or `brand`. `--events` picks the event types | `POST /v1/watches` |
| `bewary watches` | Lists your watches, active or paused | `GET /v1/watches` |
| `bewary unwatch <id>` | Stops a watch | `DELETE /v1/watches/{watch_id}` |
| `bewary events` | Reads your watches' events, oldest first. `--cursor` continues where the last page ended | `GET /v1/events` |

## Use it in scripts and CI

`--fail-on suspicious` (or `scam`) makes the exit code the decision, and `--json` prints the API's answer as it came:

```bash
if ! npx bewary url "$LINK" --fail-on suspicious; then
  echo "Not opening $LINK"
fi

npx bewary domain "$DOMAIN" --json | jq -r '.verdict'
```

Exit codes: `0` answered, `1` failed (bad input, no network, an API error), `2` the verdict reached `--fail-on`.

## Let an agent run it

Agents that run shell commands can call `npx bewary` without MCP setup. Give your agent the instructions below.

```text
Before you open a link, call a number, reply to a message or pay someone the user does not know,
run `npx bewary url <link> --json` (or `phone`, `email`, `wallet`, `payment-handle`) and act on "verdict":
scam: stop and say why, from "reason_codes". suspicious: ask the user first. unknown: never treat it as safe.
```

## Your key

Every command needs an API key: set `BEWARY_API_KEY` or pass `--key`. A free key gets 1,000 credits a month, no card.

```bash
export BEWARY_API_KEY="bw_..."   # your key, from bewary.app/account
npx bewary url "$LINK" --deep
```