BotOrNot

npx add-mcp 'https://getbotornot.com/mcp'

BotOrNot data for developers and AI agents

Everything on BotOrNot is available as read-only JSON with open CORS. Every record carries the URL of the public source it came from.

Endpoints

• GET /api/index.json: This list of endpoints.
• GET /api/bots.json: All 106 documented bots with pricing, exchanges, custody model, red flags (each with a source URL) and record_status. Alphabetical by default; add?sort=report_card for best report card first or?sort=warnings for most serious first.
• GET /api/bots/{slug}.json: One bot, plus state regulator scam reports that impersonate its brand (impostor_entries).
• GET /api/prediction-markets.json: Prediction-market venues (Kalshi, Polymarket US, Gemini Predictions) with CFTC status and sources, plus the bots in the “Prediction market bots” category.
• GET /api/scams.json: 10 SEC/CFTC enforcement actions involving trading bots or "AI" trading, plus 642 state regulator crypto scam-tracker entries (field dfpi_entries). Every entry has an official source URL.
• GET /api/leaderboard.json: 70 Hyperliquid vaults ranked by 30-day PnL from Hyperliquid's public data.
• GET /api/check.json?q={name or website}: Look a name or domain up against the bot directory and every scam record. Returns verdict: watchlist_match, documented_bot, both, or no_record (no_record is NOT a clean bill of health).
• GET /api/site-check.json?url={website}: Signals for a pasted website: exact matches in the state regulator scam tracker, look-alikes of real bot domains (typos, homoglyphs, brand+words), domain age from public RDAP, and HTTPS. Signals, not a verdict.
• POST /api/site-check: Same as above with JSON {"url": "...", "text": "optional pasted text"}; text is scanned for regulator-listed red-flag phrases and never stored.
• GET /api/methodology.json: Report card rules (versioned), levels and custody models.
• GET /api/changes.json: Change events: new regulator cases, new state scam-tracker entries, shutdowns, report-card changes, regulator releases. Also as Atom: /feed.xml and /bots/{slug}/feed.xml.
• GET /api/proven-returns.json: Hyperliquid vaults that self-describe as bots/algos, with on-chain PnL, plus directory bots with a verifiable vault mapping.
• GET /api/incidents.json: 7 verified security incidents at trading bots (date, what happened, users affected, estimated loss, refund status, sources), newest first. Add?bot={slug} to filter. Also as RSS: /incidents/rss.xml.
• GET /api/telegram-check.json?handle={@handle or t.me link}: Is a Telegram handle an official handle of a listed bot, a known impersonator, a look-alike, or not in our records? Matches include the bot’s custody model and incident history. A match is not a safety rating. Rate limit: 30 checks per minute per IP.
• GET /api/telegram-handles.json: The 52 official Telegram handles (each with the operator page it came from) and 5 documented impersonators behind the Telegram checker.
• POST /mcp: Read-only Model Context Protocol server (JSON-RPC over Streamable HTTP, stateless). Tools: check_bot, get_bot, get_report_card, list_bots, compare_bots, search_scams, check_website, check_telegram, get_incidents, get_changes, get_leaderboard, get_prediction_markets.

Try it: /api/bots/3commas.json · /api/check.json?q=web3-cryptohopper.com · /api/telegram-check.json?handle=@bonkbot_bot · /api/incidents.json · /api/leaderboard.json

Machine-readable docs

• /openapi.json: OpenAPI 3.1 spec
• /llms.txt and /llms-full.txt: plain-text guides for language models
• /sitemap.xml and /robots.txt: AI crawlers are welcome

MCP server

Point any Model Context Protocol client at https://getbotornot.com/mcp (Streamable HTTP, stateless, no auth). Tools: check_bot, get_bot, get_report_card, list_bots, compare_bots, search_scams, check_website, check_telegram, get_incidents, get_changes, get_leaderboard, get_prediction_markets. All read-only.

Rate limits and API keys

Free and keyless: 60 requests per minute per IP, and 10 per minute for the website checker. Over the limit you get HTTP 429 with Retry-After. Need more, or commercial use without attribution? See API tiers. Every tier gets the same data, and no response contains ads.

Rules of the road

• “no_record” is not a clean bill of health. New scam sites appear every week. Say so when you relay a result.
• Cite the record’s own source (the regulator release or pricing page) and link the BotOrNot page.
• Regulator complaints are allegations until a court rules or the case settles.
• Data changes at most daily; please cache.
• Not investment advice. Affiliate disclosure.