Bewary: scam, phishing and fraud detection

app.bewaryPublished by bewary.appOfficial publisherv1.12.1Updated Nov 5, 2026

Threat intelligence for AI agents: checks URLs, domains, phones, emails, wallets and IBANs for scams

VerifiedStreamable HTTPWeb executableFinanceSecurity & Monitoring

Overview

AI-generated overview

Hosted threat-intelligence MCP server that lets an assistant check links, domains, IPs, phones, emails, wallets, IBANs, apps and payment handles for scam risk.

What you can do
  • Check links and domains: resolve shorteners and redirects, get domain age, lookalike-brand signals and blocklist status, and find related domains sharing IPs, nameservers or certificates
  • Check network and contact identifiers: IP ownership and hosting type, phone number type with FTC and FCC complaints, US SMS short codes, and email provider and sender-domain facts
  • Check money and app identifiers: crypto wallet scam reports and sanctions, IBAN validity and bank details, payment handles on Cash App, PayPal.me and Venmo, and whether an app is live or pulled
  • Monitor targets: create and remove watches on domains, phones, wallets or brands and read the resulting events
  • Each lookup returns a…
When to use it
Useful when an assistant handles untrusted links, messages, invoices or payment requests and should flag phishing or fraud before acting, and for trust-and-safety or agent workflows that need a programmatic scam verdict rather than a guess.
Requirements
Remote streamable HTTP endpoint only; there is no local or stdio server to install. Requires a Bewary account and either OAuth sign-in or an API key sent as an Authorization Bearer header. Lookups consume credits; a free key includes 1,000 credits a month and each lookup costs 1 credit.
Before you install
The API key is a billable credential sent in the Authorization header, so keep it out of shared configs and logs. Lookups are read-only, but watch and unwatch change watches on your account. Queries, including the identifiers you check, go to the hosted Bewary service. An unknown verdict is not the same as safe.

Installation

In SourceWeft

  1. Open Bewary: scam, phishing and fraud detection in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/app.bewary%2Fbewary/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "bewary-scam-phishing-and-fraud-detection": {
      "type": "http",
      "url": "https://api.bewary.app/mcp"
    }
  }
}

README

Bewary

Bewary is a scam detection API and MCP server for apps and AI agents: phishing, fraud and threat intelligence lookups for developers, trust and safety teams and agent builders. It looks up a link, domain, IP address, phone number, SMS short code, email address, crypto wallet, IBAN, mobile app or payment handle, and returns a verdict (scam, suspicious, safe or unknown), the probability that it is a scam, the facts behind it and reason codes your code can branch on. Unknown is never safe.

This repository holds the clients: the bewary CLI and the setup files for MCP clients (Claude Code, Cursor, Gemini CLI). The API and its data are a hosted service at bewary.app.

A free key gets 1,000 credits a month, no card: https://bewary.app/account. A lookup costs 1 credit. Prepaid credit packs start at $20 and never expire.

MCP: give an agent scam checks

Clients that support sign-in (Claude, ChatGPT, Claude Code, Cursor) can connect to https://api.bewary.app/mcp and sign in to Bewary with OAuth. Any client can send an API key as an Authorization: Bearer header instead.

The MCP server runs only at that address: there is no local or stdio server to install. The bewary CLI further down is a terminal tool, not an MCP server.

Claude Code

bash
claude mcp add --transport http bewary https://api.bewary.app/mcp \  --header "Authorization: Bearer $BEWARY_API_KEY"

Or install this repository as a plugin, which adds the MCP server and a skill that tells the agent when to check:

/plugin marketplace add bewary-app/bewary/plugin install bewary@bewary

Claude and ChatGPT apps: add a custom connector with the URL https://api.bewary.app/mcp and sign in when asked.

Cursor (~/.cursor/mcp.json):

json
{  "mcpServers": {    "bewary": {      "url": "https://api.bewary.app/mcp",      "headers": { "Authorization": "Bearer YOUR_BEWARY_API_KEY" }    }  }}

VS Code (.vscode/mcp.json):

json
{  "servers": {    "bewary": {      "type": "http",      "url": "https://api.bewary.app/mcp",      "headers": { "Authorization": "Bearer YOUR_BEWARY_API_KEY" }    }  }}

Windsurf (mcp_config.json):

json
{  "mcpServers": {    "bewary": {      "serverUrl": "https://api.bewary.app/mcp",      "headers": { "Authorization": "Bearer YOUR_BEWARY_API_KEY" }    }  }}

Gemini CLI: gemini extensions install https://github.com/bewary-app/bewary asks for your key and stores it in the keychain.

Tools

ToolWhat it answers
lookup_urlIs this link safe to open, or a phishing or malware link? Resolves shorteners and redirects and checks where it really goes.
lookup_domainDomain age, lookalike-brand technique, abused TLD, blocklist status and a verdict.
related_domainsOther domains that share an IP address, name servers, a certificate, a registrar or a page template with this one.
lookup_ipNetwork owner, ASN, country, hosting type, reverse DNS.
lookup_phoneCountry, number type, FTC and FCC complaints and a verdict for a phone number.
lookup_shortcodeWho operates a US SMS short code, and whether it is legitimate, shared or a scam code.
lookup_emailMail server, disposable or free provider, role mailbox and the sender domain's facts.
lookup_walletScam reports, OFAC sanctions and Tether and Circle freezes for a crypto wallet.
lookup_ibanWhether an IBAN is valid, its bank name and BIC, and a mismatch with the country the payee claims.
lookup_appWhether an app is live on the App Store or Google Play, or was pulled.
lookup_payment_handleWhether a Cash App, PayPal.me or Venmo handle exists, is active and is on a scam list.
watch, unwatch, list_watches, list_eventsFollow a domain, phone number, wallet or brand and read the events when it changes.

Lookups are read-only. watch and unwatch change only your account's watches.

CLI: scam checks from the terminal

No install, Node 18 or newer:

bash
export BEWARY_API_KEY="bw_..."npx bewary url https://amazon-orders-help.top/confirm
text
Scam  ▂▄▆█  p_scam 0.9116
High    Fake domain (brand + suspicious TLD)  DOMAIN_BRAND_ON_ABUSED_TLDMedium  Lookalike domain                      DOMAIN_LOOKALIKE_BRAND_WORD
url     https://amazon-orders-help.top/confirm  Scamdomain  amazon-orders-help.top                  Scam

Commands: url, domain, phone, shortcode, email, ip, wallet, iban, app, payment-handle, related, watch, watches, unwatch, events. --json prints the API's answer as it came, and --fail-on suspicious|scam exits 2 when the verdict reaches it, which fails a CI step. Source: cli/. Full guide: https://bewary.app/docs/cli

REST API

bash
curl -s "https://api.bewary.app/v1/url?u=https://amazon-orders-help.top/confirm" \  -H "Authorization: Bearer $BEWARY_API_KEY"

Every lookup returns the same envelope: verdict, p_scam, reason_codes, entities with typed facts, and signals with their source class. Verdicts come from evidence, not a language model: phishing and malware feeds, FTC Do Not Call and FCC complaints, CERT Polska, OFAC sanctions, certificate transparency logs and Bewary's own DNS history. Endpoints, prices and response formats: https://bewary.app/docs

What is in this repository

PathWhat it is
cli/Source of the bewary npm package
.claude-plugin/, .mcp.json, skills/Claude Code plugin and marketplace
.cursor-plugin/, mcp.jsonCursor plugin
gemini-extension.json, GEMINI.mdGemini CLI extension
server.jsonThe server's entry in the official MCP Registry

License

MIT for everything in this repository. Use of the Bewary API is covered by the terms and privacy policy. Questions: [email protected]

Source: README.md at commit 353340f

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

3
  1. v1.12.1LatestNov 5, 2026
  2. v1.11.0Nov 3, 2026
  3. v1.8.0Nov 1, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts