# FFraud [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://ffraud.com/docs/mcp  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/ffraud

## Description
Free IP, email and domain fraud checks for AI agents: fraud score, VPN, proxy and Tor detection, throwaway email detection. Hosted at https://ffraud.com/api/mcp, no key.

## Tools
Capabilities this server exposes over MCP:

- **site_check** — Check a whole website's security in seconds: the TLS certificate (trusted by browsers, expiry, the names it covers), the security headers (HSTS, Content-Security-Policy, framing, nosniff, referrer and permissions policies), cookie flags, whether http:// moves to https://, the domain's mail records (SPF, DMARC, MX), whether the domain or the addresses serving it are on phishing or abuse lists, and the bot protection the home page loads. Returns a 0-100 score, a grade from A to F, every finding with the exact fix to apply (header lines, DNS records, server settings), and what passed. Reads only what any visitor sees. Free, no key: 20 fresh checks an hour per address, 300 per account with a free key; a site checked in the last ten minutes costs nothing.
- **ip_check** — Fraud intelligence for any IPv4 or IPv6 address: a 0-100 fraud score, risk band, and whether it is a VPN, proxy, Tor node, relay, datacenter host or mobile connection. Also returns the owning network (ASN, ISP, organisation), geolocation, reverse DNS, abuse history and how much of its /24 subnet is flagged. Free, no key. Use it before trusting a signup, a checkout or an API caller.
- **email_check** — Check an email address before you let it create an account: whether it is disposable or throwaway, a role address, on a community blacklist, or tied to a domain that hands out temporary mailboxes. Free, no key.
- **domain_check** — Reputation for a domain: whether it hands out disposable mailboxes and whether it appears in the phishing dataset, with a risk level. One unauthenticated lookup, no key.
- **ip_reports** — The community abuse reports filed against an IP: what it was reported for, when, and by how many distinct reporters. Use it when you want the evidence behind a score rather than the score alone.
- **request_api_key** — Ask FFraud for an API key for the person you work for. FFraud emails them one Approve button, and nothing is created until they press it. Returns signup_id and claim_token: tell the person to open the email from FFraud and press Approve, then call claim_api_key with both. Use it only when the person wants a key and gave you their own email address.
- **claim_api_key** — After request_api_key: picks up the API key once the person pressed Approve. Answers status "pending" while they have not (wait about 5 seconds and call again, or remind them to check their inbox), "approved" with api_key exactly once (keep it: send it in the X-API-Key header, store it as FFRAUD_API_KEY), or "denied", "expired" or "delivered" when it is over.

## Claude Desktop Quick Installation
Remote MCP endpoint (confidence: high). Install path detected from listing signals. Add as a URL/SSE server in your client:

```json
"mcpServers": {
  "ffraud": {
    "url": "https://ffraud.com/api/mcp"
  }
}
```

## Documentation

## What FFraud MCP server does

FFraud provides fraud and reputation checks for IP addresses, email addresses, domains, and reported abuse. The hosted MCP service is aimed at agent workflows that need to assess trust before accepting a signup, checkout, API request, or email address.

IP analysis returns a fraud score from 0 to 100, a risk band, and indicators for VPNs, proxies, Tor nodes, relays, datacenter hosts, and mobile connections. Results can also include the address's ASN, ISP, organisation, geolocation, reverse DNS, abuse history, and the proportion of its /24 subnet that has been flagged.

Email checks identify disposable or throwaway addresses, role-based addresses, community blacklist presence, and domains associated with temporary mailboxes. Domain checks report disposable-mail hosting, phishing-dataset presence, and a risk level.

## How it works

Agents connect to the hosted MCP endpoint at `https://ffraud.com/api/mcp` and invoke the relevant tool with an IP address, email address, domain, or IP for abuse-report lookup. The service is free and does not require an API key.

The `ip_reports` tool complements the numerical IP assessment by returning community reports, including what an address was reported for, when reports were filed, and the number of distinct reporters. This is useful when an agent needs supporting evidence rather than only a risk score.

## Setup and configuration

Configure an MCP client to use the streamable hosted endpoint:

```text
https://ffraud.com/api/mcp
```

No authentication key or environment variable is required. The service can be used directly for the supported lookups after the endpoint is registered with an MCP client.

## Tools and capabilities

- `ip_check`: Evaluate IPv4 or IPv6 fraud risk and network characteristics, including VPN, proxy, Tor, relay, datacenter, and mobile indicators.
- `email_check`: Check whether an address is disposable, role-based, blacklisted, or associated with a temporary-mail domain.
- `domain_check`: Assess disposable-mail hosting and phishing-dataset presence, with a risk level.
- `ip_reports`: Retrieve community abuse reports for an IP, including report reason, timing, and distinct reporter count.

## Limitations and notes

Domain reputation uses one unauthenticated lookup and requires no key. IP, email, and domain checks are presented as fraud-intelligence signals for decision workflows; the available results should be interpreted according to the agent's own signup, payment, or API-access policy.

_Full upstream README: https://allmcps.com/mcp/ffraud/readme_