ffraud
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| FFRAUD_API_KEY | No | Optional API key sent as the X-API-Key header. It raises burst limits and site_check's hourly allowance; nothing else. No tools require it. | |
| FFRAUD_BASE_URL | No | Overrides the API base URL for local development. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
FFraud's open fraud database. site_check checks a whole website's security in seconds and returns every finding with the exact fix; ip_check scores any IP for VPN, proxy, Tor, datacenter and abuse history; email_check catches disposable and blacklisted addresses; domain_check reads a domain's phishing and throwaway-mailbox record; ip_reports returns the community evidence behind a score. All free and keyless; a free key from ffraud.com/dashboard/keys raises site_check's hourly allowance.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| site_checkA | Check a whole website's security in seconds: the TLS certificate (trusted by browsers, expiry, the names it covers), the security headers (HSTS, Content-Security-Policy, framing, nosniff, referrer and permissions policies), cookie flags, whether http:// moves to https://, the domain's mail records (SPF, DMARC, MX), whether the domain or the addresses serving it are on phishing or abuse lists, and the bot protection the home page loads. Returns a 0-100 score, a grade from A to F, every finding with the exact fix to apply (header lines, DNS records, server settings), and what passed. Reads only what any visitor sees. Free, no key: 20 fresh checks an hour per address, 300 per account with a free key; a site checked in the last ten minutes costs nothing. |
| ip_checkA | Fraud intelligence for any IPv4 or IPv6 address: a 0-100 fraud score, risk band, and whether it is a VPN, proxy, Tor node, relay, datacenter host or mobile connection. Also returns the owning network (ASN, ISP, organisation), geolocation, reverse DNS, abuse history and how much of its /24 subnet is flagged. Free, no key. Use it before trusting a signup, a checkout or an API caller. |
| email_checkA | Check an email address before you let it create an account: whether it is disposable or throwaway, a role address, on a community blacklist, or tied to a domain that hands out temporary mailboxes. Free, no key. |
| domain_checkA | Reputation for a domain: whether it hands out disposable mailboxes and whether it appears in the phishing dataset, with a risk level. One unauthenticated lookup, no key. |
| ip_reportsA | The community abuse reports filed against an IP: what it was reported for, when, and by how many distinct reporters. Use it when you want the evidence behind a score rather than the score alone. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
email_check, domain_check, ip_check and site_check each target a clearly different entity or scope (address vs domain reputation vs full website security), so selection is mostly obvious. The only friction is ip_check vs ip_reports, which both return abuse history for an IP, and to a lesser degree site_check vs domain_check, which both consult phishing lists — though descriptions do draw the line (score vs evidence, single lookup vs full site audit).
Four of five tools follow a clean <entity>_check pattern (email_check, domain_check, ip_check, site_check), which makes the set easy to scan. ip_reports is the one deviation, a noun-only, plural form that breaks the verb/noun rhythm and slightly obscures that it is another IP-scoped lookup.
Five tools covering four entity types plus an evidence drill-down is tightly scoped with no filler. Each tool maps to a distinct check an agent would actually perform before a signup, checkout or API call.
The surface covers the main fraud triage entities — email, domain, IP and whole-site posture — with both a score and an evidence path, which is solid lifecycle coverage for a lookup service. The notable gap is the absence of a phone/number check (a standard fraud signal alongside email and IP) and of any combined or batch operation for screening several indicators in one call.