Free scam checks for links, wallets, emails, and breach exposure. No signup.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Checks whether an email address appears in known data breaches. Provide `email`. Returns the number of breaches found with the named sources behind each; a count of zero means no breaches were found in the corpus, not that the address is safe. Read-only: it only looks up breach records. Requires the RELAYSHIELD_API_KEY environment variable; without it, the tool returns setup instructions instead of calling the API.
Email address to check. Case-insensitive.
Checks whether an email address appears in known data breaches. Provide `email`. Returns the number of breaches found with the named sources behind each; a count of zero means no breaches were found in the corpus, not that the address is safe. Read-only: it only looks up breach records. Requires the RELAYSHIELD_API_KEY environment variable; without it, the tool returns setup instructions instead of calling the API.
| Argument | Type | Description |
|---|---|---|
| email* | string | Email address to check. Case-insensitive. |
{
"type": "object",
"required": [
"email"
],
"properties": {
"email": {
"type": "string",
"format": "email",
"description": "Email address to check. Case-insensitive."
}
}
}Scores a suspicious email for phishing signals from its parsed fields. Provide any of: from_address, from_name, reply_to, return_path, subject, body_text, and links (up to 25). Returns a risk level and score with the specific flags behind them; links in the email are also checked against RelayShield's threat-intelligence corpus. A verdict of unknown means nothing conclusive was found; this tool never reports an email as safe.
| Argument | Type | Description |
|---|---|---|
| links | array | Links found in the body, up to 25. |
| subject | string | Message subject. |
| reply_to | string | Reply-To address, if present and different from from_address. |
| body_text | string | Plain-text body, used for urgency/deadline/threat phrasing. |
| from_name | string | The claimed sender's display name. |
| return_path | string | Envelope sender, if available. Informational only. |
| from_address | string | The claimed sender's address, e.g. [email protected]. |
{
"type": "object",
"properties": {
"links": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 25,
"description": "Links found in the body, up to 25."
},
"subject": {
"type": "string",
"description": "Message subject."
},
"reply_to": {
"type": "string",
"description": "Reply-To address, if present and different from from_address."
},
"body_text": {
"type": "string",
"description": "Plain-text body, used for urgency/deadline/threat phrasing."
},
"from_name": {
"type": "string",
"description": "The claimed sender's display name."
},
"return_path": {
"type": "string",
"description": "Envelope sender, if available. Informational only."
},
"from_address": {
"type": "string",
"description": "The claimed sender's address, e.g. [email protected]."
}
}
}Checks one URL, or up to 25 URLs in a single call, against RelayShield's threat-intelligence corpus for known phishing, malware, and scam abuse. Provide either `url` (a single http:// or https:// link) or `urls` (an array of up to 25 links). Returns a per-link verdict of FLAGGED or unknown with the reasons behind each verdict, plus counts of checked, flagged, and incomplete links. A verdict of unknown means nothing is known against the link; this tool never reports a link as safe.
| Argument | Type | Description |
|---|---|---|
| url | string | A single link starting with http:// or https://. Omit when sending urls. |
| urls | array | Up to 25 links to check in one call. Omit when sending url. |
{
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "A single link starting with http:// or https://. Omit when sending urls."
},
"urls": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 25,
"description": "Up to 25 links to check in one call. Omit when sending url."
}
}
}Returns a read-only risk assessment of a cryptocurrency wallet address. It never moves funds or initiates transactions. Provide `address`; the chain (EVM, Solana, TON, or Bitcoin) is detected from the address format automatically. Returns a risk level of CRITICAL, HIGH, MEDIUM, LOW, or unknown, with the specific sanctions, scam, drainer, and phishing flags behind it. A verdict of unknown means nothing is known against the address; it does not mean the address is safe.
| Argument | Type | Description |
|---|---|---|
| address* | string | Wallet address to screen. Chain is auto-detected. |
{
"type": "object",
"required": [
"address"
],
"properties": {
"address": {
"type": "string",
"description": "Wallet address to screen. Chain is auto-detected."
}
}
}