MCP server

Fidro for AI assistants

Connect ChatGPT, Claude, Cursor, VS Code, Codex or Claude Code to your Fidro account and ask whether a signup looks risky, where an IP is, how much quota is left, or to block an address with a reason attached. 6 tools behind one URL, included on every plan, Free included.

POST https://fidro.io/mcp

OAuth 2.1 with PKCE
Streamable HTTP
6 tools
Every plan, including Free

Connect your assistant Create a free account

What you can ask

Fraud decisions get made in support threads, chargeback disputes and the editor where the signup form is being built. With Fidro connected, the assistant scores the signup itself and answers from live data in that conversation.

“Is alice@mailinator.com signing up from 185.220.101.1 risky?”

Scores both, names the checks that fired and recommends allow, challenge or block.

Calls validate_signup

“Where is 203.0.113.9 and is it hiding behind a VPN or proxy?”

Location and network from one tool, the anonymiser verdict from the other.

Calls lookup_ip validate_signup

“Block chargebacks@example.com, reason "disputed twice", severity 9.”

The next signup or payment from that address is flagged by the API.

Calls add_to_blocklist

“Show me everything on our blocklist with severity 8 or higher.”

Filters by type, value or severity, newest first.

Calls list_blocklist

“How much of my Fidro quota is left this month?”

Plan, requests used and the remaining allowance. Costs nothing to ask.

Calls get_account_status

“Wire Fidro into the register endpoint and show me what a disposable email returns.”

In Cursor, VS Code or Claude Code the assistant sees the live response shape and writes the handler to match.

Calls validate_signup

Connect in a minute

Every client needs the same two things: the server URL and a sign-in. The first request opens a Fidro consent screen in your browser. Approve it once and the assistant is connected to your account.

Claude Code

claude mcp add -s user --transport http fidro https://fidro.io/mcp
claude mcp login fidro

The -s user flag registers the server for every project. The second command opens the consent screen.

Codex

codex mcp add fidro --url https://fidro.io/mcp
codex mcp login fidro

Cursor

Add to .cursor/mcp.json:

{
    "mcpServers": {
        "fidro": {
            "url": "https://fidro.io/mcp"
        }
    }
}

Or open Cursor Settings, then MCP, then Add new MCP server, choose Streamable HTTP and paste the URL. Cursor asks you to sign in the first time it uses the server.

VS Code

Add to .vscode/mcp.json:

{
    "servers": {
        "fidro": {
            "type": "http",
            "url": "https://fidro.io/mcp"
        }
    }
}

Or run MCP: Add Server from the command palette, choose HTTP and paste the URL.

ChatGPT

Open Settings, then Connectors, then Create. Developer mode has to be on under Advanced settings.
Name it Fidro, paste the server URL, leave authentication on OAuth and save.
Click Connect and approve on the Fidro consent screen.

Server URL: https://fidro.io/mcp

Claude

Open Settings, then Connectors, then Add custom connector.
Name it Fidro and paste the server URL. Leave the client ID and secret empty.
Click Add, then Connect, and approve on the consent screen.

Server URL: https://fidro.io/mcp

Works on claude.ai and in Claude Desktop.

Gemini CLI

gemini mcp add --transport http fidro https://fidro.io/mcp

Windsurf

Add to mcp_config.json:

{
    "mcpServers": {
        "fidro": {
            "url": "https://fidro.io/mcp"
        }
    }
}

Any other client that speaks Streamable HTTP works with the same URL. Full setup notes and troubleshooting are in the MCP guide.

6 tools your assistant can use

Each tool is labelled read only, writes, or destructive, so you know before you connect what an assistant can change. Open any tool to see what it does and what it needs.

validate_signup Validate Signup Read only Live lookup Every plan, counts against quota

Score a signup for fraud risk from an email address and/or IP address. Use this when someone asks whether a signup, lead or user looks risky, whether an email is disposable, or whether an IP is a VPN, proxy, Tor exit or datacenter. Returns a 0 to 100 risk score, an allow, challenge or block recommendation and the individual checks. Pass event (signup, login, checkout, password_reset) and user_id to give Fidro memory: it then records the event, counts signups and logins from the same IP, subnet, email pattern and user over fixed windows, and returns velocity counts plus anomaly flags such as ip_signup_burst or impossible_travel that also raise the score. Counts as one live request against the monthly quota.

email: Email address to check. Required unless ip is given.
ip: IPv4 or IPv6 address to check. Required unless email is given.
country_code: Two-letter ISO country code the user claims to be in, e.g. GB. Needs ip; used for a mismatch check.
include_public_data: Also check the shared public blocklist (default true).
event: What happened: signup, login, checkout, password_reset, check, or custom:<name>. Giving it records the event and enables velocity and anomaly flags.
user_id: Your own identifier for the person, so repeat activity by the same user can be tracked across IPs and countries.

lookup_ip Look Up IP Read only Live lookup Every plan, counts against quota

Geolocate an IP address and return its country, region, city, timezone and network details without scoring it. Use this when someone asks where an IP is or which network it belongs to. For a risk verdict use validate_signup instead. Counts as one live request against the monthly quota.

ip*: IPv4 or IPv6 address

get_account_status Get Account Status Read only Every plan

Show the connected Fidro account: current plan, live requests used this month against the plan limit, whether blocklists are available, and how many API keys exist. Use this when someone asks how much quota is left, which plan they are on, or why a tool refused to run. Does not count against the quota.

No inputs.

list_blocklist List Blocklist Read only Starter and above

List the emails, IPs, domains and card fingerprints your account blocks, newest first. Use this when someone asks what is currently blocked or wants to find an entry before removing it. Filter by type, a partial value or severity. Needs a plan with blocklists (Starter and above). Does not count against the quota.

type: Only entries of this type
value: Partial match on the blocked value, e.g. a domain or an IP prefix
severity: Only entries with exactly this severity (1 to 10)
limit: Maximum entries to return (default 100)

add_to_blocklist Add to Blocklist Writes Starter and above

Block an email address, IP address, domain or card fingerprint for your account so future validations flag it. Use this when someone asks to block, ban or blacklist a value. Adding a value that is already blocked returns the existing entry rather than a duplicate. Needs a plan with blocklists (Starter and above).

type*: What kind of value is being blocked
value*: The email, IP, domain or card fingerprint to block
reason: Why it is blocked, shown in the dashboard (max 500 characters)
severity: 1 (mild) to 10 (severe); default 5
is_public: Share this entry with the public blocklist other accounts can opt into (default false)

remove_from_blocklist Remove from Blocklist Destructive, needs confirm Starter and above

Permanently remove one entry from your blocklist by id (find ids with list_blocklist). Use this when someone asks to unblock or allow a value again. Requires confirm=true; ask the user before calling. Needs a plan with blocklists (Starter and above).

id*: Id of the blocklist entry, from list_blocklist
confirm*: Must be true. Confirm with the user first; this cannot be undone.

Security and permissions

Connecting an assistant gives it limited, revocable access to your Fidro account. Here is what that means in practice.

Your API key stays private

Assistants sign in with OAuth, never with your API key. You approve the connection once on a consent screen and the assistant receives its own token, so your production key never leaves your dashboard.

Access is limited to your account

A connected assistant sees the account you signed in with and nothing else. Its access token expires after an hour and refreshes silently for up to 90 days.

Disconnect in one click

Every connected assistant is listed under Connected assistants on the API keys page. Disconnecting revokes its access immediately.

Every request is counted and logged

Validations and lookups made through an assistant are live requests. They count against your quota and appear in your audit log under Connected assistants (MCP), so you always know what was checked.

No changes to your account or billing

An assistant cannot create or delete API keys, change your plan or touch billing. The one tool that cannot be undone, remove_from_blocklist, always asks for your confirmation first.

Protected from runaway loops

The MCP server has its own rate limit, so an agent stuck in a loop cannot use up your monthly allowance in one go.

Setup guide and troubleshooting Launch post OAuth resource metadata Privacy policy Terms

Connect an assistant to a free account

The Free plan includes 200 validations a month and MCP access from the first minute. No card required.

Start for free Read the docs