AI
Codex
Add FFraud to OpenAI Codex with one command: check a website's security and fix it in your repo, guard sign-ups, and check IPs from your logs.
OpenAI's Codex reaches FFraud through its MCP server at https://ffraud.com/api/mcp, in the CLI and in the IDE extension: one command, no key, nothing to install. Codex then checks a whole website, an IP address, an email or a domain, and fixes what it finds in your code.
#Add FFraud to Codex
codex mcp add ffraud --url https://ffraud.com/api/mcpThe command writes those two lines into ~/.codex/config.toml, which the CLI and the IDE extension share. For one project only, put them in .codex/config.toml inside a trusted project.
#See that it is connected
codex mcp listffraud is in the list. Inside the Codex TUI, /mcp shows it; in the IDE extension, open the gear menu and MCP servers, and restart the extension after adding it.
#Three prompts that work
Check your website and fix it
Check the security of example.com with FFraud. Then add the missing security headers to our server config in this repo, the most important first.The agent runs site_check, reads each finding's exact fix and writes it into your nginx, Next.js, Vercel or Netlify config. Once the change is live, ask: "Deployed. Check example.com again with FFraud, fresh." A fresh check runs again unless the site was checked in the last minute.
Guard your sign-up
Add an FFraud check to our sign-up: before an account is created, check the visitor's IP address and email, and turn away throwaway inboxes. The API is described at https://ffraud.com/llms.txt.The agent reads FFraud's API from llms.txt and writes the two calls into your sign-up handler. Both are free and need no key.
Check the addresses in your logs
Take the IP addresses behind the failed logins in logs/auth.log, check them with FFraud, and tell me which to block and why.The agent pulls the addresses out of the file, checks up to 20 per ip_check call, and answers with FFraud's own reason for each.
#Reading the answers
The model gets FFraud's full JSON and explains it in its own words. These are the fields worth asking about.
| Tool | Read first | Then |
|---|---|---|
| site_check | grade (A to F) and summary: how many things to fix and which comes first. | findings, the most severe first, each with its fix: the exact header line, DNS record or server setting. passed lists what is already right; checked_at says when the check ran. |
| ip_check | fraud_score (0 to 100) and risk (none, low, medium, high or critical). | reason says why in plain words; vpn, proxy, tor, relay and hosting say what kind of connection it is; recent_abuse and threat_tags say what it was seen doing. |
| email_check | email_type: temp (a throwaway inbox), alias, normal or invalid. | did_you_mean catches a typo in the domain; normalized_email spots one mailbox signing up twice. |
A VPN or a datacenter alone rarely means fraud: many real people use both. Ask the model to weigh them with the other signals and to quote FFraud's reason.
#Higher limits with a free key
No key is needed. A free key from your dashboard raises the limits: website checks go from 20 an hour per address to 300 an hour per account.
[mcp_servers.ffraud]
url = "https://ffraud.com/api/mcp"
env_http_headers = { "X-API-Key" = "FFRAUD_API_KEY" }Codex sends the value of the FFRAUD_API_KEY environment variable, so export it before you start Codex and the key stays out of the file.
Does it work in the Codex IDE extension too?
Yes. The CLI and the extension read the same ~/.codex/config.toml, so one setup serves both.
Can the model change anything through FFraud?
No. All five tools only read, and site_check only reads what any visitor of the site sees.
What does FFraud see when the model calls a tool?
The website, IP address, email or domain the call sends, the same as a check on ffraud.com. The conversation itself stays with your client.