# ScamCheck MCP Server

Scan suspicious messages, URLs, and text for scams inside any AI assistant that supports MCP (Claude Desktop, Claude Code, Cursor, and more). **No signup or API key needed** — works out of the box on the free anonymous tier.

## Quick start (no API key)

Add to your Claude Desktop / Cursor config:

```json
{
  "mcpServers": {
    "scamcheck": {
      "command": "npx",
      "args": ["scamcheck-mcp-server"]
    }
  }
}
```

That's it. Ask your assistant *"is this message a scam?"* and paste the message.

## Higher limits (optional API key)

The anonymous tier is rate-limited per IP. For higher limits, grab a free key at [scamcheck.tech/dashboard/developer](https://scamcheck.tech/dashboard/developer) and add it:

```json
{
  "mcpServers": {
    "scamcheck": {
      "command": "npx",
      "args": ["scamcheck-mcp-server"],
      "env": {
        "SCAMCHECK_API_KEY": "sk-live-your-key-here"
      }
    }
  }
}
```

## Tool: `scan_message`

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `input` | string | ✓ | The message, URL, or text to scan |
| `source` | `text` \| `url` \| `screenshot` | — | Content type (default: `text`) |

## Example response

```
🔴 Likely Scam — Risk Score: 89/100
Category: phishing · Confidence: 92%

Summary: This message impersonates a bank to steal credentials.

Why this was flagged:
• Creates false urgency with account suspension threat
• Uses a URL that does not match the official bank domain
• Requests sensitive personal information via link

What to do:
✓ Do not click any links in this message
✓ Contact your bank directly using the number on your card
✓ Report to your bank's fraud department

Full report: https://scamcheck.tech/result/abc123
```

## Rate limits

- Anonymous (no key): IP rate-limited
- Free API key: 100 scans/month
- Pro/Business: Unlimited

## Install in Claude Desktop (one click)

Download [scamcheck.mcpb](https://scamcheck.tech/scamcheck.mcpb) and double-click it, or drag it into **Claude Desktop → Settings → Extensions**. The API key field is optional; leave it blank to use the free tier.

## Privacy Policy

Full policy: [scamcheck.tech/privacy](https://scamcheck.tech/privacy)

- **What is collected:** only the text or URL you ask the `scan_message` tool to check, plus the optional API key you configure. The extension reads nothing else from your computer or your conversations.
- **How it is used:** the content is sent over HTTPS to the ScamCheck API (`scamcheck.tech`) and analysed to produce the verdict. Anonymous requests are rate-limited by IP address.
- **Storage and retention:** scans may be stored to generate a shareable result link and to improve detection. Retention is described in the full policy linked above.
- **Third parties:** ScamCheck uses an AI model provider to analyse scans. Your data is not sold or used for advertising.
- **Contact:** privacy questions or deletion requests go to support via [scamcheck.tech](https://scamcheck.tech) or the [GitHub issues](https://github.com/smijo-geek/scamcheck-mcp-server/issues).