Bewary: Scam and Phishing Check MCP Server

npx add-mcp 'https://api.bewary.app/mcp'

Scam checks for any AI agent

One URL gives Claude, ChatGPT, Cursor or any MCP client 15 tools to check a link, number or payment before acting on it.

https://api.bewary.app/mcp

Transport

Streamable HTTP

Free

1,000 credits a month

claude mcp add --transport http bewary https://api.bewary.app/mcp \
  --header "Authorization: Bearer $BEWARY_API_KEY"

When an agent should call it

• Before opening a link a user pasted or a message contains lookup_url
• Before calling or texting back a number from a message lookup_phone lookup_shortcode
• Before paying an IBAN, a wallet or a payment handle lookup_iban lookup_wallet lookup_payment_handle
• Before replying to a sender it has not seen before lookup_email lookup_domain

Claude Code Bewary MCP server

A text says my Amazon order is on hold and links to https://amazon-orders-help.top/confirm. Is that link safe to open?

No, don't open it. This is very likely a phishing text.

Tools

Each MCP tool runs the same code as its API endpoint and returns the same typed answer with outputSchema and structuredContent.

Lookups

Tool	Answers	Inputs	Credits
lookup_url	Is this link safe to open?	url deep optional	1 credit, deep 30
lookup_domain	Domain age, lookalike-brand technique, abused TLD, blocklist status and a verdict.	domain deep optional	1 credit, deep 30
related_domains	Which other domains share infrastructure or a kit with this one: the same IP address, /24, ASN or name servers (from Bewary's own DNS history), one certificate, a registrar and registration time, a page template or a tracking id.	domain page optional per_page optional	5 credits a page
lookup_ip	Network owner, ASN, country, hosting type, reverse DNS.	ip	1 credit
lookup_phone	Country, number type, blocklist status and a verdict for a phone number.	number line_type optional	1 credit, with line type 10
lookup_shortcode	Who operates this SMS short code, and is it legitimate, shared or a scam code?	code country optional	1 credit
lookup_email	Mail server, disposable or free provider, role mailbox, and the sender domain's facts.	address	1 credit
lookup_wallet	Is this wallet on Bewary's scam list?	chain address	1 credit
lookup_iban	Is this IBAN valid (country length and structure, check digits), which bank does it belong to (name, BIC), and did a community report name it?	iban claimed_country optional	1 credit
lookup_app	Is this app live on the Apple App Store or Google Play, or did the store pull it?	store app_id storefront optional	1 credit
lookup_payment_handle	Does this Cash App $Cashtag, PayPal.me name or Venmo username exist, is it active, and is it on Bewary's scam list?	provider handle	1 credit

Watches and events

Tool	Answers	Inputs	Credits
watch	Get events when a domain, phone number, wallet or brand changes: a domain's IP addresses, name servers, down/up/parked, re-registered, expiring or expired; a listing or delisting; a new lookalike domain of a brand.	type value events optional	1 credit a day (a brand watch also 1 per lookalike event)
unwatch	Delete a watch: no more events or charges.	id	free
list_watches	Every live watch on the account.		free
list_events	Events of the account's watches, oldest first.	cursor optional types optional watch_id optional limit optional	free