Scamverify MCP

What scamverifyai/scamverify-mcp MCP server does

The scamverifyai/scamverify-mcp MCP server provides agent-accessible checks for common scam and phishing indicators. It covers US phone numbers, website URLs, SMS or other text, email messages, document images, and QR code images. Results can include a 0–100 risk score, a verdict, and supporting signals.

Phone checks combine FTC and FCC complaint data with carrier information, robocall flags, and community reports. URL checks examine domain age, SSL certificates, redirect chains, brand impersonation, Google Web Risk, URLhaus, ThreatFox, and community reports. Text and email analysis can extract embedded phone numbers and URLs; email analysis also considers sender domains, headers, SPF, DKIM, and DMARC.

Document analysis uses vision AI to extract entities such as addresses, officials, citations, and phone numbers, then checks those entities against government databases. QR analysis decodes the image server-side and performs URL verification when the decoded content is a URL. Batch tools support up to 100 phone numbers or URLs per request.

How it works

The hosted endpoint is https://scamverify.ai/api/mcp and uses stateless Streamable HTTP. Remote clients can authenticate with a bearer API key or OAuth 2.1 using PKCE. OAuth scopes include phone lookup, URL lookup, text analysis, email analysis, and usage access.

For clients that only support stdio, the npm package runs a local proxy that forwards tool calls to the ScamVerify API. The proxy therefore still needs an API key and does not represent an offline copy of the threat databases. The same project can also be built and started from a cloned repository.

In addition to verification tools, the scamverifyai/scamverify-mcp MCP server exposes get_usage for the current billing-period quota and rate limits, plus get_status, which does not require authentication. Four prompts are also listed for phone investigations, URL verification, text analysis, and email assessment.

Setup and configuration

The hosted service requires no local installation. Configure an MCP client with the server URL and either an authorization header or OAuth. The README specifically documents remote configurations for Claude Desktop, Cursor, Windsurf, and other MCP clients, and identifies the service as a ChatGPT connector.

For local stdio use, install the package with npm or invoke it through npx. Set SCAMVERIFY_API_KEY to a production or test key. SCAMVERIFY_API_URL is optional and can override the default API base URL. API keys are created through the ScamVerify website after signup. OAuth users can authorize access through the hosted flow.

The documented free tier provides 50 lookups per month. Paid plans increase lookup limits and request rates, from the Starter plan through Enterprise options.

Tools and capabilities

• Check individual phone numbers, URLs, text messages, emails, documents, and QR codes.
• Submit up to 100 phone numbers or URLs in one batch request.
• Return risk scores, verdicts, extracted entities, and detailed verification signals.
• Inspect API quota and billing-period rate limits.
• Query service availability without authentication.
• Use four investigation-oriented MCP prompts.

Limitations and notes

Phone lookup is described for US numbers. Batch phone and URL requests have a maximum size of 100 items. Document and QR checks require image input, while QR verification only performs URL analysis when the decoded value contains a URL.

The remote service and local proxy depend on the ScamVerify API, so API authentication and network access are relevant for normal operation. OAuth is supported by the hosted server, but the local proxy setup shown in the README uses SCAMVERIFY_API_KEY.

The repository is MIT-licensed. Threat intelligence coverage and record counts can change as the underlying FTC, FCC, URLhaus, ThreatFox, carrier, and community sources are updated.