MCP server

Fidro for AI assistants

Connect ChatGPT, Claude, Cursor, VS Code, Codex or Claude Code to your Fidro account and ask it whether a signup looks risky, where an IP is, how much quota is left, or to block an address with a reason attached. Six tools, one URL, on every plan including Free.

POST https://fidro.io/mcp
  • OAuth 2.1 with PKCE
  • Streamable HTTP
  • 6 tools
  • Every plan, including Free
Connect your assistant Create a free account

What you can ask

Fraud decisions get made in support threads, chargeback disputes and the editor where the signup form is being built. With Fidro connected, the assistant scores the signup itself and answers from live data in that conversation.

“Is alice@mailinator.com signing up from 185.220.101.1 risky?”

Scores both, names the checks that fired and recommends allow, review or block.

Calls validate_signup

“Where is 203.0.113.9 and is it hiding behind a VPN or proxy?”

Location and network from one tool, the anonymiser verdict from the other.

Calls lookup_ip validate_signup

“Block chargebacks@example.com, reason "disputed twice", severity 9.”

The next signup or payment from that address is flagged by the API.

Calls add_to_blocklist

“Show me everything on our blocklist with severity 8 or higher.”

Filters by type, value or severity, newest first.

Calls list_blocklist

“How much of my Fidro quota is left this month?”

Plan, requests used and the remaining allowance. Costs nothing to ask.

Calls get_account_status

“Wire Fidro into the register endpoint and show me what a disposable email returns.”

In Cursor, VS Code or Claude Code the assistant sees the live response shape and writes the handler to match.

Calls validate_signup

Connect in a minute

Every client needs the same two things: the URL and a sign-in. The first tool call sends you to a consent screen in your browser; approve it once and the assistant gets a token limited to your account.

Claude Code

claude mcp add -s user --transport http fidro https://fidro.io/mcp
claude mcp login fidro

The -s user flag registers the server for every project. The second command opens the consent screen.

Codex

codex mcp add fidro --url https://fidro.io/mcp
codex mcp login fidro

Cursor

Add to .cursor/mcp.json:

{
    "mcpServers": {
        "fidro": {
            "url": "https://fidro.io/mcp"
        }
    }
}

Or open Cursor Settings, then MCP, then Add new MCP server, choose Streamable HTTP and paste the URL. Cursor asks you to sign in the first time it uses the server.

VS Code

Add to .vscode/mcp.json:

{
    "servers": {
        "fidro": {
            "type": "http",
            "url": "https://fidro.io/mcp"
        }
    }
}

Or run MCP: Add Server from the command palette, choose HTTP and paste the URL.

ChatGPT

  1. Open Settings, then Connectors, then Create. Developer mode has to be on under Advanced settings.
  2. Name it Fidro, paste the server URL, leave authentication on OAuth and save.
  3. Click Connect and approve on the Fidro consent screen.

Server URL: https://fidro.io/mcp

Claude

  1. Open Settings, then Connectors, then Add custom connector.
  2. Name it Fidro and paste the server URL. Leave the client ID and secret empty.
  3. Click Add, then Connect, and approve on the consent screen.

Server URL: https://fidro.io/mcp

Works on claude.ai and in Claude Desktop.

Gemini CLI

gemini mcp add --transport http fidro https://fidro.io/mcp

Windsurf

Add to mcp_config.json:

{
    "mcpServers": {
        "fidro": {
            "url": "https://fidro.io/mcp"
        }
    }
}

Any other client that speaks Streamable HTTP works with the same URL. Full setup notes and troubleshooting are in the MCP guide.

Tools

This list is read from the running server, so it is exactly what a connected assistant sees. Every tool carries hints that tell the assistant whether it only reads, changes something, or cannot be undone.

validate_signup

Validate Signup Read only Live lookup Every plan, counts against quota

Score a signup for fraud risk from an email address and/or IP address. Use this when someone asks whether a signup, lead or user looks risky, whether an email is disposable, or whether an IP is a VPN, proxy, Tor exit or datacenter. Returns a 0 to 100 risk score, an allow, review or block recommendation and the individual checks. Counts as one live request against the monthly quota.

email
Email address to check. Required unless ip is given.
ip
IPv4 or IPv6 address to check. Required unless email is given.
country_code
Two-letter ISO country code the user claims to be in, e.g. GB. Needs ip; used for a mismatch check.
include_public_data
Also check the shared public blocklist (default true).

lookup_ip

Look Up IP Read only Live lookup Every plan, counts against quota

Geolocate an IP address and return its country, region, city, timezone and network details without scoring it. Use this when someone asks where an IP is or which network it belongs to. For a risk verdict use validate_signup instead. Counts as one live request against the monthly quota.

ip*
IPv4 or IPv6 address

get_account_status

Get Account Status Read only Every plan

Show the connected Fidro account: current plan, live requests used this month against the plan limit, whether blocklists are available, and how many API keys exist. Use this when someone asks how much quota is left, which plan they are on, or why a tool refused to run. Does not count against the quota.

No inputs.

list_blocklist

List Blocklist Read only Starter and above

List the emails, IPs, domains and card fingerprints your account blocks, newest first. Use this when someone asks what is currently blocked or wants to find an entry before removing it. Filter by type, a partial value or severity. Needs a plan with blocklists (Starter and above). Does not count against the quota.

type
Only entries of this type
value
Partial match on the blocked value, e.g. a domain or an IP prefix
severity
Only entries with exactly this severity (1 to 10)
limit
Maximum entries to return (default 100)

add_to_blocklist

Add to Blocklist Writes Starter and above

Block an email address, IP address, domain or card fingerprint for your account so future validations flag it. Use this when someone asks to block, ban or blacklist a value. Adding a value that is already blocked returns the existing entry rather than a duplicate. Needs a plan with blocklists (Starter and above).

type*
What kind of value is being blocked
value*
The email, IP, domain or card fingerprint to block
reason
Why it is blocked, shown in the dashboard (max 500 characters)
severity
1 (mild) to 10 (severe); default 5
is_public
Share this entry with the public blocklist other accounts can opt into (default false)

remove_from_blocklist

Remove from Blocklist Destructive, needs confirm Starter and above

Permanently remove one entry from your blocklist by id (find ids with list_blocklist). Use this when someone asks to unblock or allow a value again. Requires confirm=true; ask the user before calling. Needs a plan with blocklists (Starter and above).

id*
Id of the blocklist entry, from list_blocklist
confirm*
Must be true. Confirm with the user first; this cannot be undone.

What it will and will not do

OAuth only

The endpoint refuses API keys. You approve an assistant once on a consent screen; it gets a token limited to your account, and your production key never leaves the dashboard.

Scoped to your account

A connected assistant sees the account you signed in with and nothing else. Access tokens expire after an hour and refresh silently for up to 90 days.

Revoke in one click

Every connected assistant is listed under Connected assistants on the API keys page. Disconnect revokes its tokens immediately.

Nothing off the books

Validations and lookups made through an assistant are live requests: they count against your quota and appear in the audit log under a key called Connected assistants (MCP).

No account changes

It cannot create or delete API keys, change your plan or touch billing. The only irreversible tool, remove_from_blocklist, needs an explicit confirmation.

Rate limited

The server has its own limiter, so a runaway agent loop cannot burn through your monthly allowance in one go.

Setup guide and troubleshooting Launch post OAuth resource metadata Privacy policy Terms

Connect an assistant to a free account

The Free plan includes 200 validations a month and MCP access from the first minute. No card required.

Start free