scamverify-mcp

Purpose

ScamVerify MCP Server is an AI-powered scam and threat verification MCP server used to check suspicious information in Claude Desktop, ChatGPT, Cursor, and other MCP clients. It can verify phone numbers, URLs, text messages, emails, documents, and QR codes, and returns a risk score.

Main Capabilities

• Phone number verification: based on FTC Do Not Call complaints (9.7 million+, including scam type classification), FCC consumer complaints (443,000+ telecommunications violation reports), and carrier intelligence (line type, CNAM, VoIP detection, high-risk carrier flags).
• URL and threat indicator verification: URLhaus (74,000+ active malicious URL indicators), ThreatFox (60,000+ indicators of compromise IOC).
• Analysis of text, emails, documents, and QR codes.
• Community reports: user-submitted scam reports and verification.
• Data scale: the official description contains both "8M+ threat intelligence records" and "10M+ threat intelligence records."

How to Use

Option 1: Remote Server (Recommended)

Connect directly to the hosted ScamVerify MCP server, no installation required.

• Server URL:https://scamverify.ai/api/mcp
• Transport: Streamable HTTP (stateless) or stdio (local proxy)
• Authentication: API Key or OAuth 2.1 (PKCE)

Claude Desktop (OAuth, no API Key required): when no API Key is provided, Claude Desktop starts the OAuth 2.1 flow, redirecting to scamverify.ai to log in and authorize.

Cursor / Windsurf / other MCP clients: can connect using the MCP URL above.

ChatGPT: ScamVerify can be used as a ChatGPT connector, added in the ChatGPT plugin/connector settings, with the MCP URL being https://scamverify.ai/api/mcp。

Option 2: Local Proxy (stdio)

Run a local MCP server that proxies all tool calls to the ScamVerify API, suitable for MCP clients that only support stdio transport. It can be run after installation, or run directly with npx. Environment variables can be set in the Claude Desktop (stdio) configuration.

Getting an API Key

1. Register at scamverify.ai.
2. Go to Settings > API Keys.
3. Generate a key (prefix: production sv_live_, test sv_test_).

OAuth 2.1 Authentication

The remote server supports OAuth 2.1 with PKCE (S256). Discovery endpoints:

• Authorization server:https://scamverify.ai/.well-known/oauth-authorization-server
• Protected resource:https://scamverify.ai/.well-known/oauth-protected-resource

OAuth scopes: phone:lookup, url:lookup, text:analyze, email:analyze, usage:read.

On the first OAuth login or when creating an API Key, free quota is automatically activated (50 queries per month).

Use Cases

• Quickly verify unknown calls, suspicious links, scam text messages, or emails in AI clients.
• Perform threat verification on documents and QR codes.
• Scenarios requiring risk assessment by combining multi-source threat intelligence and community reports.

Limitations

• The free quota is 50 queries per month; pricing after exceeding it is not yet provided.
• Data sources and record counts are based on the official description; actual coverage may change.
• The official description contains both 8M+ and 10M+ statements for the total number of threat intelligence records, and no unified explanation is currently provided.

Related Links

• Website: scamverify.ai
• API documentation: docs.scamverify.ai
• MCP integration guide: docs.scamverify.ai/docs/guides/mcp-integration
• OAuth flow guide: docs.scamverify.ai/docs/guides/oauth-flow
• Status page: status.scamverify.ai
• Contact: scamverify.ai/contact