Get an API key
MCP server

Scam checks for any AI agent

One URL gives Claude, ChatGPT, Cursor or any MCP client 15 tools to check a link, number or payment before acting on it.

https://api.bewary.app/mcp

Streamable HTTP. Send your key as an Authorization header. A free key gets 1,000 credits a month.

claude mcp add --transport http bewary https://api.bewary.app/mcp \
  --header "Authorization: Bearer $BEWARY_API_KEY"
  • Claude CodeRun in your terminal.
  • CursorIn ~/.cursor/mcp.json, or .cursor/mcp.json in a project.
  • VS CodeIn .vscode/mcp.json in your workspace.
  • WindsurfIn ~/.codeium/windsurf/mcp_config.json.
  • Claude and ChatGPT appsAdd a custom connector with your key in the URL: https://api.bewary.app/mcp/YOUR_BEWARY_API_KEY. These apps take a URL, not a header.

When an agent should call it

  • Before opening a linka user pasted or a message containslookup_url
  • Before calling or texting backa number from a messagelookup_phonelookup_shortcode
  • Before payingan IBAN, a wallet or a payment handlelookup_ibanlookup_walletlookup_payment_handle
  • Before replyingto a sender it has not seen beforelookup_emaillookup_domain
Claude CodeBewary MCP server

A text says my Amazon order is on hold and links to https://amazon-orders-help.top/confirm. Is that link safe to open?

lookup_url(url: "https://amazon-orders-help.top/confirm")
Scamp_scam 0.9116
  • DOMAIN_BRAND_ON_ABUSED_TLD
  • DOMAIN_LOOKALIKE_BRAND_WORD

No, don't open it. This is very likely a phishing text.

Tools

Each MCP tool runs the same code as its API endpoint and returns the same typed answer with outputSchema and structuredContent.

Lookups

ToolAnswersInputsCredits
lookup_url Is this link safe to open? urldeepoptional 1 credit, deep 30
lookup_domain Domain age, lookalike-brand technique, abused TLD, blocklist status and a verdict. domaindeepoptional 1 credit, deep 30
related_domains Which other domains share infrastructure or a kit with this one: the same IP address, /24, ASN or name servers (from Bewary's own DNS history), one certificate, a registrar and registration time, a page template or a tracking id. domainpageoptionalper_pageoptional 5 credits a page
lookup_ip Network owner, ASN, country, hosting type, reverse DNS. ip 1 credit
lookup_phone Country, number type, blocklist status and a verdict for a phone number. numberline_typeoptional 1 credit, with line type 10
lookup_shortcode Who operates this SMS short code, and is it legitimate, shared or a scam code? codecountryoptional 1 credit
lookup_email Mail server, disposable or free provider, role mailbox, and the sender domain's facts. address 1 credit
lookup_wallet Is this wallet on Bewary's scam list? chainaddress 1 credit
lookup_iban Is this IBAN valid (country length and structure, check digits), which bank does it belong to (name, BIC), and did a community report name it? ibanclaimed_countryoptional 1 credit
lookup_app Is this app live on the Apple App Store or Google Play, or did the store pull it? storeapp_idstorefrontoptional 1 credit
lookup_payment_handle Does this Cash App $Cashtag, PayPal.me name or Venmo username exist, is it active, and is it on Bewary's scam list? providerhandle 1 credit

Watches and events

ToolAnswersInputsCredits
watch Get events when a domain, phone number, wallet or brand changes: a domain's IP addresses, name servers, down/up/parked, re-registered, expiring or expired; a listing or delisting; a new lookalike domain of a brand. typevalueeventsoptional 1 credit a day (a brand watch also 1 per lookalike event)
unwatch Delete a watch: no more events or charges. id free
list_watches Every live watch on the account. free
list_events Events of the account's watches, oldest first. cursoroptionaltypesoptionalwatch_idoptionallimitoptional free

Start with 1,000 free credits a month

Free keys get 1,000 credits monthly without a card. Lookups cost 1 credit.

Get an API keyRead the docs
claude mcp add --transport http bewary https://api.bewary.app/mcp --header "Authorization: Bearer $BEWARY_API_KEY"