# scamverifyai/scamverify-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/scamverifyai/scamverify-mcp  
**GitHub Stars:** 1  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/scamverifyai-scamverify-mcp

## Description
AI-powered scam and threat verification MCP server. Check phone numbers, URLs, text messages, emails, documents, and QR codes against 8M+ threat intelligence records (FTC/FCC complaints, carrier analysis, URLhaus, ThreatFox). Returns risk scores, verdicts, and detailed signals. 10 tools, OAuth 2.1 + API key auth, Streamable HTTP transport.

## Tools
Capabilities this server exposes over MCP:

- **check_phone** — Look up a US phone number for scam reports, carrier info, robocall flags, and community reports. Returns risk score (0-100), verdict, and detailed signals from FTC, FCC, carrier, and community data.
- **check_url** — Check a website URL for safety. Analyzes domain age, SSL certificate, redirect chains, brand impersonation, Google Web Risk, URLhaus, ThreatFox, and community reports.
- **check_text** — Analyze a text/SMS message for scam indicators. Extracts and cross-references embedded phone numbers and URLs. AI identifies scam type, red flags, and risk level.
- **check_email** — Analyze an email for phishing indicators. Checks sender domain, email headers (SPF/DKIM/DMARC), brand impersonation, embedded URLs and phone numbers.
- **check_document** — Analyze a document image for scam indicators. Uses vision AI to extract entities (addresses, officials, citations, phone numbers) and verifies them against government databases.
- **check_qr** — Scan a QR code image and verify its contents. Decodes the QR code server-side and, if it contains a URL, runs full URL verification.
- **batch_phone** — Look up multiple phone numbers in a single request (max 100).
- **batch_url** — Check multiple URLs in a single request (max 100).
- **get_usage** — Check your current API usage quota and rate limits for the billing period.
- **get_status** — Check the operational status of ScamVerify API services. No authentication required.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "scamverify-mcp": {
    "command": "npx",
    "args": ["-y","@scamverifyai/scamverify-mcp"],
    "env": {
      "SCAMVERIFY_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `SCAMVERIFY_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What scamverifyai/scamverify-mcp MCP server does

The scamverifyai/scamverify-mcp MCP server provides agent-accessible checks for common scam and phishing indicators. It covers US phone numbers, website URLs, SMS or other text, email messages, document images, and QR code images. Results can include a 0–100 risk score, a verdict, and supporting signals.

Phone checks combine FTC and FCC complaint data with carrier information, robocall flags, and community reports. URL checks examine domain age, SSL certificates, redirect chains, brand impersonation, Google Web Risk, URLhaus, ThreatFox, and community reports. Text and email analysis can extract embedded phone numbers and URLs; email analysis also considers sender domains, headers, SPF, DKIM, and DMARC.

Document analysis uses vision AI to extract entities such as addresses, officials, citations, and phone numbers, then checks those entities against government databases. QR analysis decodes the image server-side and performs URL verification when the decoded content is a URL. Batch tools support up to 100 phone numbers or URLs per request.

## How it works

The hosted endpoint is `https://scamverify.ai/api/mcp` and uses stateless Streamable HTTP. Remote clients can authenticate with a bearer API key or OAuth 2.1 using PKCE. OAuth scopes include phone lookup, URL lookup, text analysis, email analysis, and usage access.

For clients that only support stdio, the npm package runs a local proxy that forwards tool calls to the ScamVerify API. The proxy therefore still needs an API key and does not represent an offline copy of the threat databases. The same project can also be built and started from a cloned repository.

In addition to verification tools, the scamverifyai/scamverify-mcp MCP server exposes `get_usage` for the current billing-period quota and rate limits, plus `get_status`, which does not require authentication. Four prompts are also listed for phone investigations, URL verification, text analysis, and email assessment.

## Setup and configuration

The hosted service requires no local installation. Configure an MCP client with the server URL and either an authorization header or OAuth. The README specifically documents remote configurations for Claude Desktop, Cursor, Windsurf, and other MCP clients, and identifies the service as a ChatGPT connector.

For local stdio use, install the package with npm or invoke it through `npx`. Set `SCAMVERIFY_API_KEY` to a production or test key. `SCAMVERIFY_API_URL` is optional and can override the default API base URL. API keys are created through the ScamVerify website after signup. OAuth users can authorize access through the hosted flow.

The documented free tier provides 50 lookups per month. Paid plans increase lookup limits and request rates, from the Starter plan through Enterprise options.

## Tools and capabilities

- Check individual phone numbers, URLs, text messages, emails, documents, and QR codes.
- Submit up to 100 phone numbers or URLs in one batch request.
- Return risk scores, verdicts, extracted entities, and detailed verification signals.
- Inspect API quota and billing-period rate limits.
- Query service availability without authentication.
- Use four investigation-oriented MCP prompts.

## Limitations and notes

Phone lookup is described for US numbers. Batch phone and URL requests have a maximum size of 100 items. Document and QR checks require image input, while QR verification only performs URL analysis when the decoded value contains a URL.

The remote service and local proxy depend on the ScamVerify API, so API authentication and network access are relevant for normal operation. OAuth is supported by the hosted server, but the local proxy setup shown in the README uses `SCAMVERIFY_API_KEY`.

The repository is MIT-licensed. Threat intelligence coverage and record counts can change as the underlying FTC, FCC, URLhaus, ThreatFox, carrier, and community sources are updated.

_Full upstream README: https://allmcps.com/mcp/scamverifyai-scamverify-mcp/readme_