# Bewary API

> Bewary is a scam detection API. Send a link, domain, phone number, SMS short code, email address, crypto wallet, IBAN, app or payment handle, and get back a typed verdict (scam, suspicious, safe or unknown), the probability that it is a scam, the facts behind it and reason codes your code can branch on. It is a REST API and an MCP server for AI agents. Every call needs an API key, and a free key gets 1,000 credits a month.

Base URL: https://api.bewary.app. OpenAPI (typed responses): https://api.bewary.app/v1/openapi.json. MCP server: https://api.bewary.app/mcp. TypeScript types: https://bewary.app/types/bewary.d.ts

## Use it from an agent

- [MCP server](https://bewary.app/mcp): remote MCP at https://api.bewary.app/mcp for Claude, Cursor, VS Code, Windsurf and ChatGPT; 15 tools, the same answers as the REST API
- [CLI](https://bewary.app/docs/cli.md): npx bewary, one command per MCP tool, no install
- [Agent skill: Bewary scam check](https://bewary.app/.well-known/agent-skills/bewary/SKILL.md): Bewary is a scam detection API and MCP server for apps and AI agents. It looks up links, domains, IP addresses, phone numbers, SMS short codes, email addresses, crypto wallets, IBANs, mobile apps and payment handles, and its watches send an event when a watched domain, number, wallet or brand changes. The CLI runs as `npx bewary` with no install, with one command per MCP tool. Use when a user asks whether a link, number, address or account they received is a scam, and before an agent opens a link, calls or texts a number, pays or replies.
- [Pricing](https://bewary.app/pricing): the free key, credits per call and prepaid credit packs

MCP tools:
- `lookup_url`: Look up a link
- `lookup_domain`: Look up a domain
- `related_domains`: Find related domains
- `lookup_ip`: Look up an IP address
- `lookup_phone`: Look up a phone number
- `lookup_shortcode`: Look up an SMS short code
- `lookup_email`: Look up an email address
- `lookup_wallet`: Look up a crypto wallet
- `lookup_iban`: Look up an IBAN
- `lookup_app`: Look up a mobile app
- `lookup_payment_handle`: Look up a payment handle
- `watch`: Watch an entity
- `unwatch`: Stop watching
- `list_watches`: List watches
- `list_events`: Read events

## Docs

- [Bewary home](https://bewary.app/index.md): what the API checks, every endpoint with its price and speed, where verdicts come from, pricing
- [Overview](https://bewary.app/docs/index.md): first call, which endpoint fits which job, prices and speeds
- [Scam checks for AI agents](https://bewary.app/docs/ai-agents.md): An AI agent in Claude, ChatGPT or Cursor checks a link, phone number or payment handle with Bewary's MCP server before it acts.
- [Bewary CLI](https://bewary.app/docs/cli.md): The Bewary CLI checks links, phone numbers, emails and wallets for scams in a terminal with npx bewary, no install. Its --fail-on flag fails a CI step.
- [Act on a verdict](https://bewary.app/docs/verdicts.md): What to do with each Bewary verdict in an inbox, a sign-up form, a link preview or an AI agent, with copy-paste Python and TypeScript, retries and timeouts.
- [Keys, limits and errors](https://bewary.app/docs/authentication.md): Call the Bewary scam check API with an API key: a free key gets credits every month. Credits, rate limits, response headers and error codes.
- [Response format](https://bewary.app/docs/response.md): Every check and lookup returns the same typed JSON envelope. Each entity carries typed facts. Each signal includes its source class and weight.
- [Reason codes](https://bewary.app/docs/reason-codes.md): The full list of Bewary signal codes, from DOMAIN_LOOKALIKE_BRAND_WORD to LISTED_BLOCKLIST, with severity, the entity each one attaches to, and whether it is live.
- [Watches, events and webhooks](https://bewary.app/docs/watches.md): Watch a domain, phone number, wallet or brand and get an event when it changes: new IP or name servers, down, expired, re-registered, listed, a new lookalike. 1 credit a day per watch.
- [Bulk files and backtests](https://bewary.app/docs/bulk.md): Download Bewary's listed domains, links, numbers and wallets as CSV, an RPZ zone, STIX 2.1 or a TAXII collection, updated hourly, with deltas. Backtest your own list against our history.
- [Datasets and calibration](https://bewary.app/docs/datasets.md): Every dataset Bewary answers from, with its geography and live counts, free at GET /v1/datasets. How each answer names its dataset, and the published calibration of the site score.
- [Changelog](https://bewary.app/docs/changelog.md): What changed in the Bewary scam check API, by date. The v1 contract only grows: new fields, enum values and codes, never removals.

## Endpoints

- [Phishing link checker API](https://bewary.app/docs/url.md): A link lookup returns a scam verdict, where the link lands after redirects and short links, and that domain's age and lookalike facts. 1 credit a lookup.
- [Domain age and lookalike domain API](https://bewary.app/docs/domain.md): A domain lookup returns RDAP registration date, expiry and registrar, the domain's age, and whether the name imitates a brand and how. 1 credit a lookup.
- [Phone number scam lookup API](https://bewary.app/docs/phone.md): A phone lookup returns a scam verdict from FTC and FCC complaints and Bewary's scam list, plus country and number type. 1 credit, 10 with live line type.
- [SMS short code lookup API](https://bewary.app/docs/shortcode.md): US SMS short code lookups identify legitimate operators, shared codes or codes known for scam texts. A lookup costs 1 credit.
- [Disposable email check API](https://bewary.app/docs/email.md): An email lookup says whether an address is disposable, from a free provider such as Gmail, or a shared role mailbox, and whether its domain gets mail.
- [IP address lookup API](https://bewary.app/docs/ip.md): An IP address lookup returns its hosting type (datacenter, CDN or residential), the ASN and network owner, the registry country and reverse DNS. 1 credit.
- [Crypto wallet scam check API](https://bewary.app/docs/wallet.md): Bewary checks Bitcoin, Ethereum and other EVM, Tron, Litecoin, Solana, Monero and Dash addresses against its scam list and US OFAC sanctions. 1 credit.
- [IBAN validation API](https://bewary.app/docs/iban.md): Bewary validates an IBAN's length, structure and check digits, checks scam reports, and names the bank and BIC where it holds the country's bank list.
- [App store lookup API](https://bewary.app/docs/app.md): App store lookups return App Store or Google Play status, name, developer, rating count and Bewary's live sightings. A lookup costs 1 credit.
- [Payment handle lookup API](https://bewary.app/docs/payment-handle.md): Cash App username lookup returns handle status, scam list membership and a `verdict` for 1 credit per lookup.
- [Related domains API](https://bewary.app/docs/related.md): Lists the domains that share an IP address, name servers, a certificate or a page template with a domain, each with its relations and verdict. 5 credits a page.
- [Seller and profile risk API](https://bewary.app/docs/assess.md): One call checks a new seller, host or profile’s contact points for your platform’s seller verification and returns deny, review or pass. 1 credit per valid field.
- [Bulk scam lookup API](https://bewary.app/docs/batch.md): Send up to 1,000 lookups of any type in one request. Results keep your order, invalid items are listed and not charged.

## Data and method

- [The data, by country](https://bewary.app/data): every dataset Bewary answers from, its geography and live counts (the same as https://api.bewary.app/v1/datasets, free)
- [How Bewary checks scams](https://bewary.app/about): the method behind a verdict
- [Scam library](https://bewary.app/scams): how common scams work, each with how to spot it and what to do

## Free tools

Pages that answer one question for a person with the same API call, and show that call.

- [Domain age checker](https://bewary.app/check/domain-age.md): See when a website was registered, how old it is, when it expires and who registered it, and whether its name imitates a brand. Free, no signup.
- [Is this link safe?](https://bewary.app/check/link): Paste a link and Bewary checks its domain, any brand it imitates and where a short link goes, against live scam feeds. Free, instant, no signup.
- [Is this QR code safe?](https://bewary.app/check/qr): Scan a QR code or a screenshot of one and Bewary checks where it really goes against live scam feeds. Catch fake parking, package, and payment QR scams. Free.
- [Is this number a scam?](https://bewary.app/check/phone): Enter a phone number and Bewary checks it against FTC and FCC scam and robocall complaints and its scam lists. Free and instant.
- [Has my email been leaked?](https://bewary.app/check/email): Check if your email is in a known data breach, free. See which breaches and when, and what to change first.

## Directory

Each page answers one value, and the same answer as the API gives is at the page URL plus .json.

- [Number directory](https://bewary.app/area-codes): FTC and FCC complaints per US area code and phone number; every number page has a JSON twin (https://bewary.app/number/<10 digits>.json), and the API serves the same data free at https://api.bewary.app/v1/directory/
- [Who texts from 90831? U.S. Bank](https://bewary.app/shortcode/90831.json): U.S. Bank alerts
- [Who texts from 58189? Zelle (Early Warning Services, LLC)](https://bewary.app/shortcode/58189.json): Zelle alerts
- [Who texts from 28581? Block, Inc. (Cash App)](https://bewary.app/shortcode/28581.json): Cash App codes
- [Who texts from 64013? Qmatic](https://bewary.app/shortcode/64013.json): Qmatic queue texts
- [Who texts from 86006? Bank of America](https://bewary.app/shortcode/86006.json): BofA alerts
- [Who texts from 41593? ITR (irsissues.org)](https://bewary.app/shortcode/41593.json): ITR tax texts
- [Who texts from 21581? Credence Resource Management, LLC](https://bewary.app/shortcode/21581.json): Credence debt texts
- [Who texts from 31354? Fabletics (TechStyle Fashion Group)](https://bewary.app/shortcode/31354.json): Fabletics texts
- [Who texts from 49388? Synchrony Financial](https://bewary.app/shortcode/49388.json): Synchrony alerts
- [Who texts from 53849? Bank of America](https://bewary.app/shortcode/53849.json): BofA Zelle alerts
- [Who texts from 56592? Zip (formerly QuadPay)](https://bewary.app/shortcode/56592.json): Zip alerts
- [Who texts from 63937? PinchMe Alerts](https://bewary.app/shortcode/63937.json): Shared code alerts
- [Who texts from 22395? Twilio](https://bewary.app/shortcode/22395.json): Twilio OTP code
- [Who texts from 32665? Meta Platforms (Facebook)](https://bewary.app/shortcode/32665.json): Facebook texts
- [Who texts from 44398? Google (Firebase Authentication)](https://bewary.app/shortcode/44398.json): Firebase SMS codes
- [Who texts from 24273? JPMorgan Chase Bank, N.A. (Chase)](https://bewary.app/shortcode/24273.json): Chase alerts
- [Who texts from 36246? OpenTable, Inc.](https://bewary.app/shortcode/36246.json): OpenTable alerts
- [Who texts from 043075? No single operator](https://bewary.app/shortcode/043075.json): 043075 delivery scam
- [Who texts from 25054? Strickland Brothers (10 Minute Oil Change)](https://bewary.app/shortcode/25054.json): Strickland texts
- [Who texts from 52547? DraftKings](https://bewary.app/shortcode/52547.json): DraftKings texts
- [Who texts from 48658? Dave & Buster's](https://bewary.app/shortcode/48658.json): Dave & Buster's texts
- [Who texts from 64436? Credit One Bank, N.A.](https://bewary.app/shortcode/64436.json): Credit One alerts
- [Who texts from 65089? No single operator](https://bewary.app/shortcode/65089.json): 65089 lookup

## Optional

- [Full docs in one file](https://bewary.app/llms-full.txt)