Skip to main content
Glama
ffraud
by FFraud-com

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
FFRAUD_API_KEYNoOptional API key sent as the X-API-Key header. It raises burst limits and site_check's hourly allowance; nothing else. No tools require it.
FFRAUD_BASE_URLNoOverrides the API base URL for local development.

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

FFraud's open fraud database. site_check checks a whole website's security in seconds and returns every finding with the exact fix; ip_check scores any IP for VPN, proxy, Tor, datacenter and abuse history; email_check catches disposable and blacklisted addresses; domain_check reads a domain's phishing and throwaway-mailbox record; ip_reports returns the community evidence behind a score. All free and keyless; a free key from ffraud.com/dashboard/keys raises site_check's hourly allowance.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{}

Tools

Functions exposed to the LLM to take actions

NameDescription
site_checkA

Check a whole website's security in seconds: the TLS certificate (trusted by browsers, expiry, the names it covers), the security headers (HSTS, Content-Security-Policy, framing, nosniff, referrer and permissions policies), cookie flags, whether http:// moves to https://, the domain's mail records (SPF, DMARC, MX), whether the domain or the addresses serving it are on phishing or abuse lists, and the bot protection the home page loads. Returns a 0-100 score, a grade from A to F, every finding with the exact fix to apply (header lines, DNS records, server settings), and what passed. Reads only what any visitor sees. Free, no key: 20 fresh checks an hour per address, 300 per account with a free key; a site checked in the last ten minutes costs nothing.

ip_checkA

Fraud intelligence for any IPv4 or IPv6 address: a 0-100 fraud score, risk band, and whether it is a VPN, proxy, Tor node, relay, datacenter host or mobile connection. Also returns the owning network (ASN, ISP, organisation), geolocation, reverse DNS, abuse history and how much of its /24 subnet is flagged. Free, no key. Use it before trusting a signup, a checkout or an API caller.

email_checkA

Check an email address before you let it create an account: whether it is disposable or throwaway, a role address, on a community blacklist, or tied to a domain that hands out temporary mailboxes. Free, no key.

domain_checkA

Reputation for a domain: whether it hands out disposable mailboxes and whether it appears in the phishing dataset, with a risk level. One unauthenticated lookup, no key.

ip_reportsA

The community abuse reports filed against an IP: what it was reported for, when, and by how many distinct reporters. Use it when you want the evidence behind a score rather than the score alone.

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

TDQS

A4.1/5.0

Scored across 5 tools

Disambiguation4/5

email_check, domain_check, ip_check and site_check each target a clearly different entity or scope (address vs domain reputation vs full website security), so selection is mostly obvious. The only friction is ip_check vs ip_reports, which both return abuse history for an IP, and to a lesser degree site_check vs domain_check, which both consult phishing lists — though descriptions do draw the line (score vs evidence, single lookup vs full site audit).

Naming Consistency4/5

Four of five tools follow a clean <entity>_check pattern (email_check, domain_check, ip_check, site_check), which makes the set easy to scan. ip_reports is the one deviation, a noun-only, plural form that breaks the verb/noun rhythm and slightly obscures that it is another IP-scoped lookup.

Tool Count5/5

Five tools covering four entity types plus an evidence drill-down is tightly scoped with no filler. Each tool maps to a distinct check an agent would actually perform before a signup, checkout or API call.

Completeness4/5

The surface covers the main fraud triage entities — email, domain, IP and whole-site posture — with both a score and an evidence path, which is solid lifecycle coverage for a lookup service. The notable gap is the absence of a phone/number check (a standard fraud signal alongside email and IP) and of any combined or batch operation for screening several indicators in one call.

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues