// MCP

Add spotafraud to ChatGPT & Claude

Let your assistant check Australian (.au) domains for fraud and age. Free in ChatGPT and Claude; an API key for everything else.

Copy this prompt

Paste this into Claude Code, Codex or any coding assistant and it will wire up the server for you.

setup prompt

Add the spotafraud MCP server so you can check Australian (.au) domains for fraud and age.
Server (streamable HTTP): https://mcp.spotafraud.ai/mcp
It's free in ChatGPT and Claude. In other clients, send my spotafraud API key as an
"Authorization: Bearer sfk_..." header (get one at https://spotafraud.ai/dashboard).
Then use the check_au_domain tool whenever I ask whether a .au website, shop, link, invoice
sender or text message is legitimate, or how old a .au domain is.

Prefer to do it by hand? Pick your client below.

ChatGPT

Free — no API key needed. ChatGPT reaches for the tool on its own when you ask about a .au domain.

ChatGPT → Settings → Connectors → Add

Name: spotafraud
URL:  https://mcp.spotafraud.ai/mcp

Then just ask, e.g. “is soysisters.com.au a legit Australian site?” or “how old is coles.com.au?”

Claude

Free in Claude (web, desktop and Claude Code) — no API key needed.

Claude → Settings → Connectors → Add custom connector

URL: https://mcp.spotafraud.ai/mcp

or Claude Code (CLI)

claude mcp add --transport http spotafraud https://mcp.spotafraud.ai/mcp

Other clients & code

Any other MCP client (Cursor, your own code, Codex) must send a spotafraud API key as a Bearer token. Get one in the dashboard.

Claude Code / CLI

# Free in Claude Code:
claude mcp add --transport http spotafraud https://mcp.spotafraud.ai/mcp
# From other tools, authenticate with your API key:
claude mcp add --transport http spotafraud https://mcp.spotafraud.ai/mcp \
  --header "Authorization: Bearer sfk_your_key"

mcp.json (Cursor and similar)

{
  "mcpServers": {
    "spotafraud": {
      "url": "https://mcp.spotafraud.ai/mcp",
      "headers": { "Authorization": "Bearer sfk_your_key" }
    }
  }
}

The tool

One tool, check_au_domain(domain), over the same data as the REST API. It returns the first-seen date from 12 years of certificate history, the matched registered business (ABN), any lookalike it resembles, and a risk verdict with reasons — read-only, from precomputed data.

example

check_au_domain("mygov-secure.com.au")
→ fraud (93/100). First seen 2026-10-14 (5 days old); resembles my.gov.au (Services Australia).

Only Australian (.au) domains are in scope. Prefer the REST API for server-to-server use.