Kaidn-mcp
OfficialInvestigate fraud and score events via a read-only MCP server (with opt-in mutating tools) that explains verdicts with raw evidence.
Free read-only tools:
get_stats(verdict/reason rollups),list_events(filterable scored events),explain_event(why an event scored as it did),triage_queue(review queue, highest risk first),get_config(tenant weights/thresholds).Quota-consuming enrichment checks:
check_email,check_ip,check_phone— each returns fraud score, network reputation, and abuse history.Entity investigation:
investigate_entity— enrichment plus related events for an email, IP, or device (device free) to expose fraud rings.Scoring new events:
score_eventrecords and scores an event, returning verdict, reasons, checks, and email identity dedupe info.Optional mutating tools (require
--allow-writes):add_to_list(allow/block lists) andlabel_outcome(report confirmed fraud/chargeback/legit).Safe by default: read-only unless opted in, quota-guarded, API key only via env, never exposes destructive
set_config/forget_subject.Multiple transports: stdio for local clients, Streamable HTTP for remote agents, with Docker support and health endpoint.
Designed for chaining: e.g., morning triage via
get_stats→triage_queue→explain_event; investigate a suspicious IP/device ring.
Kaidn MCP
Model Context Protocol server for the Kaidn fraud-scoring API.
Investigate fraud in plain English — "why was this signup blocked?", "what else has this device touched?", "what's in the review queue this morning?"
Evidence, not just a score. Every reason carries the raw numbers behind it, so a model can explain a verdict rather than guess at it.
Read-only by default. Nothing changes your tenant unless you opt in.
Quota-guarded. An agent in a loop cannot spend your month in ten minutes.
Any client. MCP is an open protocol — stdio locally, Streamable HTTP for remote and hosted agents.
Requirements
Node.js 18 or newer, and an API key from your Kaidn dashboard.
Getting started
First, install the Kaidn MCP server with your client. Standard config works in most of the tools:
{
"mcpServers": {
"kaidn": {
"command": "npx",
"args": ["@kaidn/mcp@latest"],
"env": { "KAIDN_API_KEY": "your_key" }
}
}
}claude mcp add kaidn --env KAIDN_API_KEY=your_key -- npx @kaidn/mcp@latestAdd the standard config to claude_desktop_config.json, then restart Claude.
Settings → Developer → Edit Config opens the file.
Settings → MCP → Add new MCP Server, or add the standard config to
.cursor/mcp.json in your project (or ~/.cursor/mcp.json for every project).
code --add-mcp '{"name":"kaidn","command":"npx","args":["@kaidn/mcp@latest"],"env":{"KAIDN_API_KEY":"your_key"}}'Add the standard config to ~/.codeium/windsurf/mcp_config.json.
Add the standard config to cline_mcp_settings.json via the MCP Servers icon →
Configure MCP Servers.
Add to settings.json under context_servers, using the same command, args and
env as the standard config.
Any MCP client takes a command, args and an env block. Use the standard config above. If the client can only reach the server over the network rather than spawning a process, see Streamable HTTP.
Related MCP server: Mnemom
Configuration
Option | Environment variable | Default | Purpose |
| required | Your secret key. Environment only — never a flag, never a tool argument. | |
|
| API base URL | |
|
| off | Register the mutating tools |
|
| Quota ceiling per process | |
|
|
| Serve Streamable HTTP |
|
|
| HTTP bind address |
|
|
| HTTP port |
| unset | Require | |
| Show usage | ||
| Show the version |
Precedence: CLI flags override environment variables.
The API key is deliberately env-only. A key passed as a flag leaks into process listings and shell history.
Transports
Transport | Use it for | Endpoint |
stdio (default) | local clients that spawn a subprocess | — |
Streamable HTTP | remote agents, containers, anything off-machine |
|
HTTP+SSE is deliberately absent: deprecated in the 2025-03-26 spec and sunset
in June 2026.
Streamable HTTP
npx @kaidn/mcp@latest --http --port 8765Stateless — a fresh server per request, nothing shared between callers — so it
sits behind a load balancer without surprises. GET /health is unauthenticated
so an orchestrator can check liveness without holding the token.
Docker
docker build -t kaidn-mcp .# stdio — behaves like the npx invocation
docker run -i --rm -e KAIDN_API_KEY=your_key kaidn-mcp
# HTTP — for remote agents
docker run --rm -p 8765:8765 \
-e KAIDN_API_KEY=your_key \
-e KAIDN_MCP_TRANSPORT=http \
-e KAIDN_MCP_HOST=0.0.0.0 \
-e KAIDN_MCP_HTTP_TOKEN=your_token \
kaidn-mcpMulti-stage build, runs as the unprivileged node user, with a healthcheck.
Security
The server holds your API key. Whoever can reach it can spend your quota, so the defaults are conservative and the guards fail closed rather than warning.
Binds
127.0.0.1, and refuses to start on a wider interface unlessKAIDN_MCP_HTTP_TOKENis set. It stops with an explanation rather than quietly exposing your account.Read-only by default.
add_to_listandlabel_outcomeexist only with--allow-writes.set_configandforget_subjectare never exposed, in any mode. One silently changes the verdict on every future event; the other is irreversible GDPR erasure. Both belong in the dashboard, in front of a human.Quota ceiling per process, with remaining budget reported on every costing response. A reservation that would overshoot is refused outright rather than partially spent.
The key never crosses the tool boundary — not as a parameter, not in output, not in an error.
Tools
Two things govern every tool: whether it spends quota, and whether it changes anything.
Read-only — available by default
Tool | Cost | What it does |
| free | Verdict, score and reason rollups over a rolling window. Start here. |
| free | Scored events, newest first, filterable by verdict or type |
| free | Every check that fired on one event, with the raw evidence |
| free | Everything on |
| free | Effective weights and thresholds for this tenant |
| 1 row¹ | Enrichment, network reputation and related events for one entity |
| 1 row | Disposable domain, deliverability, fraud score, abuse history |
| 1 row | Proxy, VPN, Tor, datacenter ASN, geo, abuse history |
| 1 row | Validity, line type, carrier, fraud score |
| 1 row | Score a new event (also records it) |
¹ Free when the entity is a device_id; enrichment only costs on email or IP.
Mutating — require --allow-writes
Tool | What it does |
| Add an entity to the allow or block list |
| Report a confirmed fraud / chargeback / legit outcome |
Worked examples
The tools are designed to be chained. These are the flows they were built for.
Morning triage
You: What happened overnight, and what needs me?
The model calls get_stats for the shape of the last 24 hours, then
triage_queue for the events sitting on review, then explain_event on the
worst one. You get a ranked list with the reasoning attached, rather than a
dashboard you still have to read.
"Why was this customer blocked?"
You: Event
evt_8f21c— a customer says they were wrongly blocked.
explain_event returns every check that fired with its raw evidence — the
datacenter ASN it matched, how many accounts shared the device, the velocity
count. Enough to answer the customer, or to conclude the rule was wrong and
needs tuning.
Working outward from one signal
You: Is
194.x.x.xa one-off or part of a ring?
investigate_entity returns enrichment and network reputation for the IP plus
every recent event it appears in. If the same device ids keep recurring, that is
a ring rather than a coincidence.
Checking a rule change before making it
You: If I dropped the velocity weight, what would stop being blocked?
get_config reads the current weights; list_events with verdict: "block"
shows what is currently caught. The model can tell you which of those hang on
the check you are about to weaken.
Error handling
Failures come back as tool errors with a readable message, not exceptions — the model can act on them.
You see | Meaning | Fix |
| Server started without a key | Set it in the client's |
| Key rejected | Rotate or re-copy it from the dashboard |
| Rate limited | Slow down; per-key throttling is by the minute |
| The guard stopped an expensive run | Raise |
| Event is older than the scan window | Page back with |
| Ambiguous investigation | Ask about one entity at a time |
| Non-loopback HTTP with no token | Set |
Errors never contain your API key.
Troubleshooting
The client shows no tools.
Check the client's MCP log for the startup line. kaidn-mcp: ready (stdio, …)
on stderr means the server is up and the problem is on the client side. Nothing
at all usually means npx could not resolve the package or Node is older than 18.
It starts, then exits immediately.
Almost always a missing KAIDN_API_KEY. The message says so on stderr; some
clients hide stderr, so run it in a terminal to see it.
add_to_list and label_outcome are missing.
Working as designed. They need --allow-writes.
set_config and forget_subject are missing.
Also by design, and they are not available in any mode. See
SECURITY.md.
HTTP mode refuses to start. You bound something other than loopback without a bearer token. That is the guard working — the process holds your API key.
Everything is slow.
The enrichment checks make live upstream calls. get_stats, list_events,
explain_event and triage_queue are free and fast; prefer them when reading
history.
Check the server independently of the client:
node dist/index.js --help # no key required
KAIDN_API_KEY=your_key npm start # should print a ready lineSupport
Bugs and feature requests: GitHub issues
Security: security@kaidn.io — see SECURITY.md
Privacy and data handling: PRIVACY.md
The API itself: kaidn.io
Run from source
git clone https://github.com/Kaidn-io/kaidn-mcp.git
cd kaidn-mcp
npm install
npm run build
npm testclaude mcp add kaidn --env KAIDN_API_KEY=your_key -- node /absolute/path/to/kaidn-mcp/dist/index.jsTo check it starts without a client:
KAIDN_API_KEY=your_key npm startIt prints kaidn-mcp: ready (stdio, read-only, quota ceiling 100) to stderr and
then waits on stdin — that is the MCP transport, so the silence is correct.
Why the evidence matters
Kaidn's engine is rules-first and explainable: every reason carries the raw
numbers behind it. A bare score gives a model nothing to reason about, while
checks[] with evidence attached gives it something to explain. That is the
difference between explain_event being useful and being decorative.
Rules decide. The model narrates.
Project
CONTRIBUTING.md — what belongs here, and the guarantees a change must not break
SECURITY.md — reporting, threat model, known limitations
PRIVACY.md — what passes through, what is stored, what is not
Licence
MIT
Available Tools
10 toolscheck_emailCheck an email addressA
Enrichment and in-network reputation for one email address: disposable/ throwaway domain, deliverability, fraud score, plus how often the address has been seen abusing other operators. Also returns canonical, the identity key: every alias that reaches one mailbox (+tags, gmail dot tricks, googlemail.com) collapses to the same string, so compare THAT across accounts to tell whether two signups are one person. is_aliased and alias_tricks say which trick was used, and reject_reason says why an address is unusable. Consumes one row of monthly quota.
| Name | Required | Description | Default |
|---|---|---|---|
| Yes | The email address to check |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It transparently reports quota consumption, explains canonical alias collapsing behavior, and notes specific return fields like reject_reason. It doesn't explicitly state read-only nature or error handling, but these are reasonably implied by the enrichment context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately detailed but each sentence adds value: purpose, canonical key, specific fields, and quota. The structure is logical, though the first sentence is dense with colon-separated lists. It is appropriately sized for a tool with no output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Since there is no output schema, the description is the sole source for return values. It lists the main fields (canonical, is_aliased, alias_tricks, reject_reason) and covers quota consumption. It could be more complete by detailing response structure or error cases, but it covers the key behavioral and output aspects for a check tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only describes the parameter as 'The email address to check' with type string. The description adds that the tool accepts one email address (not a batch) and explains the canonical key semantics, providing meaningful context for interpreting the parameter. It stops short of providing format constraints or examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as an email enrichment and reputation lookup, enumerating specific outputs such as disposable domain, deliverability, fraud score, and abuse history. It distinguishes itself from sibling tools like check_ip and check_phone by explicitly focusing on email addresses.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a clear use case: using the canonical key to compare across accounts to detect duplicate signups. It also mentions quota consumption as a cost consideration. However, it doesn't explicitly state when not to use this tool or reference alternatives beyond the implicit sibling context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_ipCheck an IP addressA
Enrichment and in-network reputation for one IP: proxy/VPN/Tor, datacenter ASN, geo, fraud score, and cross-operator abuse history. Consumes one row of monthly quota.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | The IPv4 or IPv6 address to check |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses quota consumption, a behavioral trait, but does not mention other aspects like read-only nature, latency, or error behavior. This is partial disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no fluff. The purpose and key constraint (quota) are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool without an output schema, the description lists the return categories and quota cost, providing adequate context for the agent. It could mention limitations or assumptions but is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of the ip parameter with a clear description, so the baseline is 3. The description adds no new parameter-level detail beyond confirming 'one IP', which does not exceed the schema's content.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: enriching and providing in-network reputation for a single IP address, listing specific data categories. This distinguishes it from check_email/check_phone siblings targeting different entities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for IP lookups but does not explicitly say when to use it over alternatives or mention exclusions. Sibling names provide context, but the description itself lacks direct usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_phoneCheck a phone numberA
Validity, line type, carrier and fraud score for one phone number. Consumes one row of monthly quota.
| Name | Required | Description | Default |
|---|---|---|---|
| phone | Yes | The phone number, E.164 or national | |
| country | No | ISO country code to parse a national number against, e.g. 'US' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly mentions consuming one row of monthly quota, which is a key operational detail (rate limit/cost). It also lists the output data points. However, it does not mention any side effects, permissions, or error conditions, which for a simple lookup may be acceptable but leaves some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary purpose, and includes a crucial quota warning without any unnecessary words. It is highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (two params, full schema coverage, no output schema), the description adequately covers its behavior and outputs. It lists the returned fields and the quota consumption, but it could be more complete with explicit usage context relative to sibling tools, though that is mostly a usage-guideline issue.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for both parameters, so the description does not need to add parameter meaning. It adds no extra semantics beyond the schema's existing descriptions for 'phone' and 'country', so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: it returns validity, line type, carrier, and fraud score for a single phone number. This specific verb-less enumeration distinguishes it from sibling tools like check_email and check_ip, which target different entity types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for phone number checks but does not explicitly discuss when to use it versus alternatives like check_email or check_ip. No exclusions or prerequisites are mentioned, so usage guidance is minimal but not misleading.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain_eventExplain why an event scored the way it didA
The 'why was this blocked?' tool. Returns the event with every check that fired, its weight, and the raw evidence behind it, so the reasoning can be narrated with receipts rather than guessed at. Free.
| Name | Required | Description | Default |
|---|---|---|---|
| event_id | Yes | The event id, as returned by list_events |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses what the tool returns (event, checks, weights, raw evidence) and that it is 'Free', but it does not explicitly state whether it has side effects, requires certain permissions, or has other operational constraints. This leaves some ambiguity, though the read-only nature is strongly implied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences plus 'Free.', front-loaded with the purpose ('why was this blocked?') and then a compact, informative explanation of the output (every check, weight, evidence). Every word earns its place; no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description does a good job conveying what the caller will get (event with checks, weights, evidence). It could be slightly more complete by mentioning whether the event itself is returned in full or just the analysis details, but the phrase 'Returns the event with...' sufficiently covers this.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes the only parameter (event_id) as 'The event id, as returned by list_events', achieving 100% schema description coverage. The tool description does not add any additional parameter-specific information beyond what the schema provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: explaining why an event scored as it did, specifically by returning the event with all checks that fired, their weights, and raw evidence. This specific verb-resource pairing ('explain event') distinguishes it from siblings like score_event (which likely computes the score) and investigate_entity (which sounds broader).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'The ‘why was this blocked?’ tool' gives a clear situational context for when to use this tool. It implies you should use it when you need the reasoning behind a score/block decision rather than just the score itself. However, it does not explicitly mention when not to use it or name alternative tools, so it's not a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_configGet scoring configurationA
This tenant's weight and threshold overrides plus the effective merged engine config. Free. Useful for explaining why a score landed where it did.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden. It states the tool is 'Free' and returns tenant-specific config, but it does not explicitly confirm that the operation is read-only, whether any authentication is needed, or what 'Free' means. The 'get' verb implies safety, but more explicit behavioral disclosure would improve transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no redundancy. The first sentence immediately explains the tool's output; the second adds a use case. All words earn their place, and the structure is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple zero-parameter getter, the description covers the essential context: what is returned, that it is free, and when it is useful. No output schema exists, but the description gives enough detail about the config composition. It does not overpromise or omit critical information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is empty, so there are no parameter semantics to add. Baseline for zero params is 4. The description adds value by clarifying what the configuration contains, which is more than schema alone would provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the tenant's scoring configuration, specifying the exact contents: weight and threshold overrides plus the effective merged engine config. This goes beyond the title and distinguishes it from siblings like get_stats or explain_event.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear use case: 'Useful for explaining why a score landed where it did.' This implies when to use it relative to scoring-related tasks. However, it does not explicitly mention alternative tools or exclusions, so it stops short of full comparative guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_statsVerdict and reason rollupsA
Aggregate view over a rolling window: totals by verdict, average score and the most common reasons. Free — does not consume quota. Start here to see what changed before drilling into individual events.
| Name | Required | Description | Default |
|---|---|---|---|
| window_hours | No | Default 24 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It discloses that the tool is free (does not consume quota) and operates over a rolling window, adding behavioral context. It does not explicitly state read-only behavior, but 'aggregate view' strongly implies it. This is useful beyond schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short sentences: the first states the core functionality, the second adds the free/quota trait, and the third gives usage guidance. Every sentence adds value; no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter, no output schema), the description is complete: it explains what is returned conceptually, the rolling window behavior, the free trait, and the suggested usage workflow. No critical information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter (window_hours), so the schema already fully documents it. The description does not add any extra parameter semantics, but that is unnecessary. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: an aggregate view over a rolling window with totals by verdict, average score, and most common reasons. It also differentiates from siblings by saying 'Start here... before drilling into individual events,' positioning it as the initial overview tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage guidance: 'Start here to see what changed before drilling into individual events.' This tells the user when to use it (first, for an overview) and implies that event-level tools are for subsequent drilling. It also mentions the free/quota aspect, which is a practical consideration.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
investigate_entityInvestigate an entity and the ring around itA
One call for what a fraud analyst actually wants. Returns enrichment for the entity, its reputation across the CROSS-OPERATOR abuse network (whether this email, IP or device has already burned other businesses, not just yours), and every recent event it appears in — which is how you get from one suspicious signup to the whole ring of accounts sharing its device, IP or inbox. Supply exactly one of email, ip or device_id. Enrichment consumes one row of monthly quota (device_id lookups are free).
| Name | Required | Description | Default |
|---|---|---|---|
| ip | No | ||
| No | |||
| limit | No | How many recent events to scan. Default 100 | |
| device_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and it discloses key behaviors: cross-operator reputation scope, event retrieval, the one-identifier requirement, and quota costs. However, it does not mention what happens if multiple identifiers are supplied, nor does it clarify the relationship between 'every recent event' and the 'limit' parameter, which is a slight transparency gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences and front-loaded with the core benefit. The first sentence is long but information-dense, and every clause serves a purpose. It is not overly verbose, though it could be split for readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, identifier types, expected outputs (reputation, events), and quota costs. Given no output schema and no annotations, it is reasonably complete for a complex investigation tool, but it omits return format details, error handling, and the exact role of the limit parameter relative to 'every recent event'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 25% (only limit has a description). The description compensates by explaining that email, ip, and device_id are mutually exclusive entity identifiers and that device_id lookups are free. It adds meaning beyond the schema, though it lacks format details or explicit behavior when multiple identifiers are passed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: it enriches an entity, provides reputation across a cross-operator abuse network, and returns recent events to uncover fraud rings. It uses a strong verb-resource pairing ('Returns enrichment for the entity, its reputation... and every recent event') and differentiates from sibling tools like check_email or list_events by emphasizing the investigation use case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage constraints ('Supply exactly one of email, ip or device_id') and mentions quota implications. It implies when to use this tool ('what a fraud analyst actually wants') but does not explicitly name alternatives or state when not to use it, so it stops short of full exclusion guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_eventsList scored eventsA
Scored events for this tenant, newest first. Free — does not consume quota. Filter by verdict or event type to narrow an investigation.
| Name | Required | Description | Default |
|---|---|---|---|
| event | No | Event type, e.g. 'signup', 'cashout', 'trial_start' | |
| limit | No | Default 25 | |
| offset | No | ||
| verdict | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses the ordering (newest first) and the quota-free nature, but does not mention the return format, pagination behavior, or any other side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose and key differentiators. No wasted words; every phrase adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no output schema and no annotations, the description covers the core aspects: what is listed, ordering, cost, and filtering use case. Lacks response shape details, but that is often implicit for list tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%; event and limit have descriptions, offset and verdict do not. The description adds that verdict and event are filters for investigations, but does not explain offset or pagination semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists scored events for the tenant, with newest first. It provides specific verb and resource, but does not explicitly differentiate from siblings like triage_queue or get_stats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear context: the tool is free (does not consume quota) and suggests using filters to narrow an investigation. However, it does not explicitly state when not to use it or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
score_eventScore an eventA
Run an event through the scoring engine and get {score, verdict, reasons, checks}. When the event carries an email, the response also has an identity block whose email_canonical is the dedupe key for that address — so one call both scores the event and tells you whether the mailbox is one you have already seen. Consumes one row of monthly quota AND records an event — prefer the read-only tools when investigating history rather than testing new input.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | No | ||
| No | |||
| event | Yes | Event type, e.g. 'signup', 'cashout', 'trial_start' | |
| phone | No | ||
| user_id | No | ||
| timezone | No | IANA browser timezone | |
| device_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full weight and does an excellent job: it discloses monthly quota consumption, that it records an event, and the conditional identity block with email_canonical as a dedupe key. These are serious side effects an agent must know before invoking.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, perfectly front-loaded with the core purpose, then the email behavior, then the quota/recording warning. No wasted words or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and no annotations, the description covers the essential return fields, side effects, and usage caveat. It lacks a full per-parameter breakdown, but the schema already lists all parameters and the description focuses on the most consequential behaviors.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 29%, so the description must compensate. It adds meaningful semantics for "email" (identity block, dedupe key) and implicitly for "event" (the scoring trigger), but completely ignores ip, phone, user_id, and device_id—leaving those parameters opaque for the agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: "Run an event through the scoring engine and get {score, verdict, reasons, checks}". It also distinguishes this from sibling check_* tools by focusing on scoring whole events and the added email identity dedupe feature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly advises "prefer the read-only tools when investigating history rather than testing new input", giving a clear alternative and context. It also notes the quota consumption and event recording, signaling this is for live scoring rather than historical investigation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
triage_queueReview queue, highest risk firstA
Every event sitting on the 'review' verdict, sorted by score descending — the daily triage job. Free.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Default 50 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It specifies the filter and sort, indicating a read-only query. However, it doesn't disclose the effect of the limit parameter (the description says 'every event' but limit can restrict results), and 'Free' is ambiguous. No contradictions with annotations (none present).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, highly efficient, front-loaded with the core behavior. The final 'Free' note is extraneous but not harmful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (one optional param, no output schema), the description covers the main purpose. However, it fails to reconcile 'every event' with the limit parameter, and does not describe the return format or potential pagination. The lack of annotations and output schema places more burden on the description, but it still provides a sufficient overview for a basic list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of the single parameter with a description (though minimal: 'Default 50'). The property name is self-explanatory, so baseline 3 applies. The tool description adds no parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: returns events with 'review' verdict, sorted by score descending. It distinguishes from sibling tools like list_events by specifying the filter and sort order. The title reinforces this.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context (daily triage job) and implies this is the tool for reviewing high-risk events. However, it doesn't explicitly mention alternatives or when not to use it, preventing a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
v0.2.2- First observed
check_email - First observed
check_ip - First observed
check_phone - First observed
explain_event - First observed
get_config - First observed
get_stats - First observed
investigate_entity - First observed
list_events - First observed
score_event - First observed
triage_queue
TDQS
Scored across 10 tools
Each tool has a clearly distinct purpose: check_email/check_ip/check_phone target different entity types, the read-only analytics tools (list_events, get_stats, get_config, explain_event, triage_queue) each serve a unique function, investigate_entity combines enrichment and history, and score_event is the only action that records an event. No two tools are easily confused.
All tool names follow a consistent verb_noun snake_case pattern (check_email, list_events, get_config, score_event, etc.). The verbs (check, list, get, explain, investigate, triage, score) clearly indicate the action, and the nouns (email, events, stats, config, entity, queue) indicate the resource.
10 tools is well within the ideal range for a fraud investigation MCP. Each tool covers a distinct need — enrichment, event browsing, stats, config, explanation, investigation, triage, and scoring — without unnecessary redundancy or bloat.
The tool set covers the full investigation lifecycle: enrichment for email/IP/phone/device, listing and triaging events, understanding scores via stats and config, explaining individual verdicts, investigating entity history, and testing new events. There are no obvious missing operations for the stated purpose.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Score an IP, email, phone, domain or device for fraud in one call, with the signals behind it.
Signup fraud checks: score emails and IPs, look up IPs and manage your blocklist.
KYC, KYB, AML, wallet screening, transaction monitoring, and fraud workflows for AI agents.
AI Visibility and Content Intelligence tools for Claude and MCP-compatible agents.
Related MCP Servers
- AlicenseAqualityCmaintenanceScans suspicious messages, URLs, and text for scams inside any MCP-compatible AI assistant. No signup or API key needed for anonymous use.157MIT
- FlicenseNot gradedqualityCmaintenanceProvides trust infrastructure for AI agents by enabling reputation lookup, website trust scanning, and identity verification via MCP tools.1-
- FlicenseNot gradedqualityDmaintenanceProvides real-time threat intelligence for AI agents, enabling checks on IPs, domains, URLs, hashes, CVEs, prompt-injection payloads, and malicious AI-skill/MCP-tool definitions against a free database of 890K+ IOCs.-

BlackDome MCP Serverofficial
AlicenseNot gradedqualityCmaintenanceGive your AI agents direct access to live honeypot threat intelligence. Look up attacker IPs, browse indicators of compromise (IOCs), inspect captured credentials and malware payloads, profile threat actors, and render a real-time global attack map — all from Claude, Cursor, or any MCP-compatible client.MIT