Bewary: scam, phishing and fraud detection

Bewary

Bewary is a scam detection API and MCP server for apps and AI agents: phishing, fraud and threat intelligence lookups for developers, trust and safety teams and agent builders. It looks up a link, domain, IP address, phone number, SMS short code, email address, crypto wallet, IBAN, mobile app or payment handle, and returns a verdict (scam, suspicious, safe or unknown), the probability that it is a scam, the facts behind it and reason codes your code can branch on. Unknown is never safe.

This repository holds the clients: the bewary CLI and the setup files for MCP clients (Claude Code, Cursor, Gemini CLI). The API and its data are a hosted service at bewary.app.

• Docs: https://bewary.app/docs
• MCP server: https://api.bewary.app/mcp (streamable HTTP, 15 tools)
• OpenAPI: https://api.bewary.app/v1/openapi.json
• Official MCP Registry: app.bewary/bewary

A free key gets 1,000 credits a month, no card: https://bewary.app/account. A lookup costs 1 credit. Prepaid credit packs start at $20 and never expire.

MCP: give an agent scam checks

Clients that support sign-in (Claude, ChatGPT, Claude Code, Cursor) can connect to https://api.bewary.app/mcp and sign in to Bewary with OAuth. Any client can send an API key as an Authorization: Bearer header instead.

The MCP server runs only at that address: there is no local or stdio server to install. The bewary CLI further down is a terminal tool, not an MCP server.

Claude Code

claude mcp add --transport http bewary https://api.bewary.app/mcp \

--header "Authorization: Bearer $BEWARY_API_KEY"

Or install this repository as a plugin, which adds the MCP server and a skill that tells the agent when to check:

/plugin marketplace add bewary-app/bewary

/plugin install bewary@bewary

Claude and ChatGPT apps: add a custom connector with the URL https://api.bewary.app/mcp and sign in when asked.

Cursor (~/.cursor/mcp.json):

{

"mcpServers": { "bewary": { "url": "https://api.bewary.app/mcp", "headers": { "Authorization": "Bearer YOUR_BEWARY_API_KEY" } } } }

VS Code (.vscode/mcp.json):

{

"servers": { "bewary": { "type": "http", "url": "https://api.bewary.app/mcp", "headers": { "Authorization": "Bearer YOUR_BEWARY_API_KEY" } } } }

Windsurf (mcp_config.json):

{

"mcpServers": { "bewary": { "serverUrl": "https://api.bewary.app/mcp", "headers": { "Authorization": "Bearer YOUR_BEWARY_API_KEY" } } } }

Gemini CLI: gemini extensions install https://github.com/bewary-app/bewary asks for your key and stores it in the keychain.

Tools

Lookups are read-only. watch and unwatch change only your account's watches.

CLI: scam checks from the terminal

No install, Node 18 or newer:

export BEWARY_API_KEY="bw_..."

npx bewary url https://amazon-orders-help.top/confirm

Scam  ▂▄▆█  p_scam 0.9116

High Fake domain (brand + suspicious TLD) DOMAIN_BRAND_ON_ABUSED_TLD Medium Lookalike domain DOMAIN_LOOKALIKE_BRAND_WORD

url https://amazon-orders-help.top/confirm Scam domain amazon-orders-help.top Scam

Commands: url, domain, phone, shortcode, email, ip, wallet, iban, app, payment-handle, related, watch, watches, unwatch, events. --json prints the API's answer as it came, and --fail-on suspicious|scam exits 2 when the verdict reaches it, which fails a CI step. Source: cli/. Full guide: https://bewary.app/docs/cli

REST API

curl -s "https://api.bewary.app/v1/url?u=https://amazon-orders-help.top/confirm" \

-H "Authorization: Bearer $BEWARY_API_KEY"

Every lookup returns the same envelope: verdict, p_scam, reason_codes, entities with typed facts, and signals with their source class. Verdicts come from evidence, not a language model: phishing and malware feeds, FTC Do Not Call and FCC complaints, CERT Polska, OFAC sanctions, certificate transparency logs and Bewary's own DNS history. Endpoints, prices and response formats: https://bewary.app/docs

What is in this repository

License

MIT for everything in this repository. Use of the Bewary API is covered by the terms and privacy policy. Questions: support@bewary.app