fraud-prevention-mcp-server

Open-source MCP server for AI-powered fraud prevention. Detects fraudulent IPs, emails, URLs and phone numbers using free APIs — a fully free alternative to proprietary solutions.

Features

• IP Reputation — Detect proxies, VPNs, Tor exit nodes, bots and abusive IPs

• Email Risk — Disposable emails, spam traps, fraud scoring, deliverability

• URL Safety — Phishing, malware, spam URL detection

• Phone Validation — VoIP detection, line type, fraud scoring

• Breach Exposure — HaveIBeenPwned integration for data breach lookups

• Composite Risk Score — Multi-signal ALLOW/MONITOR/REVIEW/BLOCK decision

Related MCP server: Scam Detector MCP

Tools

Data Sources

• IPQualityScore — Free tier: 5,000 requests/month. Get free key at ipqualityscore.com/create-account

• HaveIBeenPwned — Breach database. Get key at haveibeenpwned.com/API/Key

Installation

pip install fraud-prevention-mcp-server

Configuration

Set your free API keys as environment variables:

export IPQS_API_KEY=your_ipqualityscore_key
export HIBP_API_KEY=your_haveibeenpwned_key

Claude Desktop Integration

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "fraud-prevention": {
      "command": "fraud-prevention-mcp-server",
      "env": {
        "IPQS_API_KEY": "your_key_here",
        "HIBP_API_KEY": "your_key_here"
      }
    }
  }
}

Example Usage

check_ip_reputation("192.168.1.1")
→ { fraud_score: 15, risk_level: "low", is_proxy: false, is_vpn: false, ... }

check_email_risk("test@tempmail.com")
→ { fraud_score: 85, risk_level: "critical", disposable: true, recommendation: "BLOCK" }

check_breach_exposure("user@example.com")
→ { breach_count: 3, risk_level: "high", has_password_exposure: true, ... }

calculate_composite_risk(ip="1.2.3.4", email="user@example.com")
→ { composite_risk_score: 45, decision: "REVIEW", action: "Manual review recommended" }

Risk Levels

Why This Server?

• Free — Uses only free-tier APIs, no enterprise contracts needed

• Open Source — MIT license, fully auditable

• Multi-Signal — Combines IP, email, URL and phone signals

• Actionable — Returns ALLOW/MONITOR/REVIEW/BLOCK decisions

License

MIT