Fidro Now Has an MCP Server: Score Signups and Manage Your Blocklist From ChatGPT, Claude and Cursor

Fidro now ships a Model Context Protocol server. Point ChatGPT, Claude, Cursor, VS Code, Codex or Claude Code at https://fidro.io/mcp, approve it once, and your assistant can score signups, look up IPs, check your quota and manage your blocklist against your real account. It is on every plan, including Free, from today.

The MCP page has the endpoint, a one-minute setup for each client and the full tool list. The MCP guide goes deeper. This post is about why we built it and what it is useful for.

Why an MCP server

Fraud decisions rarely get made inside the fraud tool. They get made in a support thread, a Slack channel, a chargeback dispute, or the editor where someone is wiring up the signup form. Fidro's API answers the question "is this signup risky?" in under 200 milliseconds, but the person asking usually has to open a dashboard, paste the email and the IP into the playground, and carry the answer back to wherever the decision is being made.

MCP is an open standard that lets an AI assistant discover and call a service's tools directly. With the Fidro server connected, the assistant scores the signup itself, reads the individual checks, and answers from live data in the conversation you are already having. When the answer is "block it", the assistant can add the email to your blocklist with the reason attached, so the next attempt is caught at the API.

There is no prompt to paste. Every tool is discovered on connection; the only configuration is the URL and a sign-in.

What the server exposes

Six tools, deliberately few:

• validate_signup scores an email address, an IP address, or both, the same way the /validate endpoint does: disposable and role email detection, VPN, proxy, Tor and datacenter detection, country mismatch and your own blocklists. It returns the 0 to 100 score, an allow, review or block recommendation and each check that fired.
• lookup_ip returns country, region, city, timezone and network details for one IP without scoring it.
• get_account_status shows your plan, the live requests used this month, the remaining quota and whether blocklists are available.
• list_blocklist, add_to_blocklist and remove_from_blocklist read and change the emails, IPs, domains and card fingerprints your account blocks. These need Starter or above, as they do through the API.

Each tool is annotated so the assistant knows which are read-only and which change state, and every call is scoped to the account you signed in with.

Use cases

These are the workflows we designed the tool set around.

Answer "does this signup look right?" where the question is asked

"Is alice@mailinator.com signing up from 185.220.101.1 risky?"

The assistant calls validate_signup with both values and explains the result: disposable email domain, Tor exit node, score 91, block. Because it can read the individual checks rather than only the score, it can tell you why, which is what a support agent or a founder reviewing a trial actually wants to know.

Investigate a chargeback or an abuse report

"Here is the IP from the dispute. Where is it, and is it hiding behind anything?"

lookup_ip gives the location and network, validate_signup says whether it is a VPN, proxy or datacenter address and whether it matches the country on the card. Two questions that used to mean two tabs and a copy-paste are one sentence.

Keep the blocklist current from the conversation where the decision is made

"Block chargebacks@example.com, reason 'disputed twice', severity 9."

add_to_blocklist creates the entry with the reason attached. The next signup or payment from that address is flagged by the API without anyone touching the dashboard. Ask "show me everything on our blocklist with severity 8 or higher" and list_blocklist filters it for you. Removing an entry needs an explicit confirmation, so the assistant will show you what it is about to delete and ask first.

Build the integration with the live API next to you

In Cursor, VS Code or Claude Code the assistant already has your signup handler open. Ask it to "wire up Fidro on the register endpoint and show me what a disposable email returns." It calls validate_signup against your real account, sees the exact response shape, and writes the handler to match. The docs, the live response and the code are in one place, and the example calls land in your audit log like any other request.

Check a batch without writing a script

Paste twenty signups from this morning's export and ask which ones to review. The assistant calls validate_signup for each and returns a ranked list. Each call is a live request and counts against your quota, so get_account_status first is a reasonable habit; the assistant can do that for you too.

Know where you stand before a launch

"How much of my Fidro quota is left this month?"

get_account_status answers with the plan, the requests used and the remaining allowance. No quota is spent asking.

What it will not do

Some boundaries were deliberate.

• OAuth only. The MCP endpoint refuses API keys. You approve an assistant once on a consent screen; it receives a token limited to your account, and the key you use in production never leaves the dashboard.
• Account scoped. A connected assistant sees the account you signed in with and nothing else.
• No account changes. It cannot create or delete API keys, change your plan or touch billing.
• Confirmation for the irreversible tool. remove_from_blocklist requires confirm: true, which a well-behaved assistant only sends after checking with you.
• Quota applies. Validations and lookups made through an assistant are live requests. They count against the monthly quota and appear in the audit log under a key called "Connected assistants (MCP)", so nothing happens off the books.
• Rate limited. The server has its own limiter, so a runaway agent loop cannot burn through your allowance in one go.

Access tokens expire after an hour and refresh silently for up to 90 days. Every connected assistant is listed under Connected assistants on the API keys page, with a Disconnect button that revokes it immediately.

Getting connected

Every client is covered on the MCP page and in the MCP guide: ChatGPT, Claude, Claude Code, Codex, Cursor, VS Code, Gemini CLI and Windsurf. Each one needs the URL and a sign-in.

If you are not a customer yet, the free plan includes 200 validations a month and MCP access from the first minute, no card required.