MCPModel Context ProtocolPrivate beta

Your assistant asks. Our corpus answers.

An analyst investigating a suspicious merchant asks their assistant about a domain. It answers with our verdict, when we reached it, the named sources behind it, and a link to the published report. Read-only, and it never starts an analysis you did not ask for.

Request access Read the tool contract

Two tools

get_domain_report

One domain's stored assessment: the verdict, the date it was reached, the findings with their sources, and the permanent report link.

domain, language

search_domains

Domains your account can see whose name matches a query, each with its verdict, assessment time and report link.

query, limit, cursor, language

Evidence you can check

A verdict nobody can verify is an assertion. Every finding carries the source that made it, that source's own date, and a reference you can follow — whether the source is a public feed or our own corpus of analysed domains. Your assistant can cite us; your reviewer can audit the citation.

{
  "domain": "trusthvast.com",
  "verdict": "FRAUDULENT",
  "risk_score": 90,
  "confidence": null,
  "decision_source": "automated",
  "assessed_at": "2026-06-26T01:55:03+00:00",
  "explanation": "Presents itself as a crypto trading platform
    promising 45% ROI in short periods. The domain is very young
    (105 days) and hosted on an IP address associated with a
    100% risky fraud-infrastructure cluster. Social media icons
    do not link to real profiles...",
  "evidence": [
    {
      "label": "Hosted on an address where 108 of 115 domains
                we have analysed are flagged (94%)",
      "source": "desenmascara.me corpus",
      "observed_at": "2026-06-26T01:55:03+00:00",
      "reference": "163.61.188.2",
      "kind": "infrastructure_cluster"
    }
  ],
  "report_url": "https://desenmascara.me/analisis/86592e63-..."
}

Our own analysis. The cluster finding is our corpus: 108 of the 115 domains we have seen on that address are flagged. No feed carries that.

{
  "domain": "binancefxpro.com",
  "verdict": "FRAUDULENT",
  "risk_score": 95,
  "evidence": [
    {
      "label": "Listed on DestroyList, the curated phishing
                feed maintained by PhishDestroy",
      "source": "PhishDestroy DestroyList",
      "source_url": "https://raw.githubusercontent.com/...",
      "observed_at": "2026-09-09T06:15:59+00:00",
      "reference": "binancefxpro.com",
      "kind": "threat_feed"
    }
  ]
}

A third-party listing, carried with the same attribution — whose list, which entry, read when.

What it will not tell you

Most of the design here is about refusing to say more than we know. An assistant cannot see a page to judge it for itself, so everything it repeats is on us.

A domain with no report says so: It returns not_found — not a clean bill of health. It means nobody has looked at it.
An abstention stays an abstention: INSUFFICIENT_DATA carries no risk score. The stored zero means “nothing was computed”, and publishing it would read as “we measured this and found no risk”.
Confidence is always null: We store no confidence value. Inventing a “high” would be inventing evidence.
A failed lookup is an error, never a result: A timeout or an outage arrives as a tool error. It can never surface as an absence of risk.
URLs are refused, not truncated: Ask about a path and the tool says the path was not checked, rather than quietly answering about the domain.
A subdomain is never collapsed: tenant.example.app is not example.app. Answering about the platform instead of the tenant is the worst substitution this service could make.

Why the awkward answers matter

This service publishes verdicts about real businesses, so it also publishes its corrections. When a threat feed withdraws a listing, our verdict withdraws with it, and the report says why. When a human reviewer overrules the pipeline, the tool reports the human's verdict and the human's reasoning, not the one they overruled. Every published report keeps its earlier versions at their own permanent links, so you can see whether we changed our mind and when. An assistant that repeats us inherits all of that.

Getting access

Access rides on an existing paid plan. There is no separate MCP purchase, price or credit: these tools read assessments that already exist and never spend an AI call.

An API keyMinted per partner and revocable on its own. Do not share one between teams.
Your egress address allowlistedThe API is restricted to approved source addresses and these tools inherit that unchanged.
Tell us which client you will connectWe keep a public compatibility record of what has actually connected, and we would rather add your client to it than guess.

Both are issued by hand today, which is why this is a private beta rather than a button. It is also why we would like to hear what you are building: the first integrations shape the second release.

Included with
Citizen	Reports, plus search across your account's own history
Startup / Enterprise	Reports, plus search across the full corpus

Connecting it

A stdio adapter you run beside your assistant, with its own pinned dependencies. Configuration is environment variables; the key never appears in a tool argument, where a model could read it back.

Verified against Claude Code and the official Python SDK client.

Request accessSetup guide, tool schemas and the compatibility record are sent with your key.

Not in this release

Requesting a new analysis of a domain we have never seen is the next release, and that one does spend credits — which is exactly why it is separated from this one. Dated history and immutable report versions follow it.