---
title: "Scam check API and MCP server | TapSafely"
url: https://tapsafely.com/developers
source: TapSafely
description: "Use TapSafely from your app or AI agent: a JSON scam-check API, an MCP server, an A2A agent, WebMCP tools and an Agent Skill."
---

For developers & AI assistants

# Bring scam checks into your app or assistant

The same engine that powers our checker is available as a simple JSON API and as an MCP server, so AI assistants can check suspicious messages for their users.

## MCP server

Endpoint (Streamable HTTP, stateless): `https://tapsafely.com/mcp`

Tools: `check_message`, `check_link`, `scam_trends`, `scam_guide`. Example client configuration:

```
{"mcpServers": {"tapsafely": {"type": "http", "url": "https://tapsafely.com/mcp"}}}
```

## REST API

`POST https://tapsafely.com/api/check` with a JSON body:

```
{ "kind": "text", "text": "Your parcel is on hold, pay £1.45 at …" }
{ "kind": "url",  "url": "paypa1-login.top" }
```

Response (shortened):

```
{ "score": 86, "level": { "id": "high", "label": "High risk" },
  "category": { "id": "delivery", "guide": "/scams/fake-delivery-texts" },
  "flags": [ { "label": "Small fee requested", "severity": "medium" } ],
  "advice": [ "Don't reply, tap links…" ], "links": [ … ] }
```

## Limits and keys

- Without a key: a few requests per minute per IP, rule-based and link checks only.
- With a key (header `X-Api-Key`): higher limits and AI review. [Ask us for a key](https://tapsafely.com/contact).
- Please show results calmly, never describe anything as definitely “safe”, and link to our guides.

## A2A agent

Other AI agents can talk to our assistant over the Agent2Agent protocol: JSON-RPC `SendMessage` (A2A 1.0) or `message/send` (0.3) at `https://tapsafely.com/a2a`. The agent card is at </.well-known/agent-card.json>.

```
{"jsonrpc":"2.0","id":1,"method":"message/send","params":{"message":{"role":"user","messageId":"1","parts":[{"kind":"text","text":"Is this a scam? ..."}]}}}
```

## In-page tools (WebMCP)

Browsers and agents that support WebMCP can use `check_message_for_scam`, `find_scam_guide`, `where_to_report_scam` and `open_scam_checker` directly on any page.

## Discovery files

- [OpenAPI description](https://tapsafely.com/openapi.json) and [API catalog](https://tapsafely.com/.well-known/api-catalog) (RFC 9727)
- [MCP server card](https://tapsafely.com/.well-known/mcp/server-card.json)
- [Agent Skills index](https://tapsafely.com/.well-known/agent-skills/index.json) with a ready-made scam-check skill
- </llms.txt> and </llms-full.txt> for language models
- Markdown copies of every page: send `Accept: text/markdown`, or put `/md` in front of the path (for example </md/scams/fake-delivery-texts.md>)