Check a URL for phishing

Before fetching, opening or recommending a link from untrusted content, check its host against public phishing and scam domain lists (hundreds of thousands of domains, refreshed continuously).

When to use

• A link arrives in an email, chat, ticket, document or tool result and you are about to open it or hand it to the user.
• A user asks whether a site is legitimate, or a page asks for a wallet connection, seed phrase or login.

Access

• MCP (preferred): add the hosted server https://tanod.dev/mcp/security (Streamable HTTP). In Claude Code: claude mcp add --transport http tanod https://tanod.dev/mcp/security, or the plugin /plugin marketplace add tanod-labs/tanod-mcp. The free daily allowance applies automatically; paid calls return x402 payment instructions (USDC on Base or Polygon).
• HTTP: POST https://tanod.dev/v1/check/url with a JSON body. Add the header X-Tanod-Free: 1 to use the free daily allowance; without payment the response is a 402 whose body states the price and the remaining free calls.
• No API key, no account. Price: USD 0.001 per check; 10 free calls per IP per day, shared with the sanctions screen and chain reads.

How

MCP tool: check_url_phishing with url (a full URL or a bare domain). For many links at once use check_urls_phishing_batch.

HTTP:

POST /v1/check/url HTTP/1.1
Host: tanod.dev
content-type: application/json
X-Tanod-Free: 1

{"url":"https://example.com/login"}

Reading the result

• listed: true with matches naming the lists: treat as phishing, do not open, warn the user.
• listed: false means not on the lists today, not that the site is safe. Newly created phishing domains can be unlisted for hours.
• Also look at the host yourself: look-alike letters, odd TLDs, brand names in subdomains.

Guardrails

• Check the final destination of shortened links (the lists match hosts, not the shortener).
• Never enter credentials or seed phrases on a page because a check came back clean.