Docs

AI

Cursor

Add FFraud to Cursor with three lines of mcp.json: check a website's security and fix it in your code, guard sign-ups, and check IPs from your logs.

Cursor's agent reaches FFraud through its MCP server at https://ffraud.com/api/mcp: three lines of config, no key, nothing to install. The agent then checks a whole website, an IP address, an email or a domain, and fixes what it finds in your code.

#Add FFraud to Cursor

~/.cursor/mcp.json
{
  "mcpServers": {
    "ffraud": { "url": "https://ffraud.com/api/mcp" }
  }
}

~/.cursor/mcp.json gives FFraud to every project. For one project only, put the same lines in .cursor/mcp.json inside it.

#See that it is connected

Open Customize in Cursor's sidebar: ffraud is listed there and can be switched on and off. If it does not connect, the Output panel shows why under MCP Logs.

#Three prompts that work

Check your website and fix it

Prompt
Check the security of example.com with FFraud. Then add the missing security headers to our server config in this repo, the most important first.

The agent runs site_check, reads each finding's exact fix and writes it into your nginx, Next.js, Vercel or Netlify config. Once the change is live, ask: "Deployed. Check example.com again with FFraud, fresh." A fresh check runs again unless the site was checked in the last minute.

Guard your sign-up

Prompt
Add an FFraud check to our sign-up: before an account is created, check the visitor's IP address and email, and turn away throwaway inboxes. The API is described at https://ffraud.com/llms.txt.

The agent reads FFraud's API from llms.txt and writes the two calls into your sign-up handler. Both are free and need no key.

Check the addresses in your logs

Prompt
Take the IP addresses behind the failed logins in logs/auth.log, check them with FFraud, and tell me which to block and why.

The agent pulls the addresses out of the file, checks up to 20 per ip_check call, and answers with FFraud's own reason for each.

#Reading the answers

The model gets FFraud's full JSON and explains it in its own words. These are the fields worth asking about.

ToolRead firstThen
site_checkgrade (A to F) and summary: how many things to fix and which comes first.findings, the most severe first, each with its fix: the exact header line, DNS record or server setting. passed lists what is already right; checked_at says when the check ran.
ip_checkfraud_score (0 to 100) and risk (none, low, medium, high or critical).reason says why in plain words; vpn, proxy, tor, relay and hosting say what kind of connection it is; recent_abuse and threat_tags say what it was seen doing.
email_checkemail_type: temp (a throwaway inbox), alias, normal or invalid.did_you_mean catches a typo in the domain; normalized_email spots one mailbox signing up twice.

A VPN or a datacenter alone rarely means fraud: many real people use both. Ask the model to weigh them with the other signals and to quote FFraud's reason.

#Higher limits with a free key

No key is needed. A free key from your dashboard raises the limits: website checks go from 20 an hour per address to 300 an hour per account.

~/.cursor/mcp.json
{
  "mcpServers": {
    "ffraud": {
      "url": "https://ffraud.com/api/mcp",
      "headers": { "X-API-Key": "${env:FFRAUD_API_KEY}" }
    }
  }
}

Cursor fills ${env:FFRAUD_API_KEY} from your environment, so the key stays out of the file.

Does Cursor ask before it calls FFraud?

Yes, by default Cursor asks before it uses an MCP tool. All five tools only read, so you can add them to the tools that run without asking.

Can the model change anything through FFraud?

No. All five tools only read, and site_check only reads what any visitor of the site sees.

What does FFraud see when the model calls a tool?

The website, IP address, email or domain the call sends, the same as a check on ffraud.com. The conversation itself stays with your client.

PreviousClaude CodeNextCodex