RelayShield Scam Checks

What it can reach

From its install config and its own description; a sandbox run will confirm this later.

Checks on v1.30.0

1. Real tool

   passrules 2026-09-29.1 · 3 hours ago

2. Static scan

   passrules 2026-09-29.1 · 3 hours ago

3. Claims check

   skippedrules 2026-09-29.1 · 3 hours ago
   • infoLLM claims check is not configured on this deploy.

Install

Each app still asks you to confirm. Everything is pinned to the version checked above.

{
  "servers": {
    "relayshield-free-mcp": {
      "type": "http",
      "url": "https://relayshieldadmin-relayshield-free-mcp.hf.space/mcp"
    }
  }
}

Tools it offers

As the server describes them. This text comes from the publisher and is shown as-is.

• check_link

  Checks one URL, or up to 25 URLs in a single call, against RelayShield's threat-intelligence corpus for known phishing, malware, and scam abuse. Provide either `url` (a single http:// or https:// link) or `urls` (an array of up to 25 links). Returns a per-link verdict of FLAGGED or unknown with the reasons behind each verdict, plus counts of checked, flagged, and incomplete links. A verdict of unknown means nothing is known against the link; this tool never reports a link as safe.

• check_wallet

  Returns a read-only risk assessment of a cryptocurrency wallet address. It never moves funds or initiates transactions. Provide `address`; the chain (EVM, Solana, TON, or Bitcoin) is detected from the address format automatically. Returns a risk level of CRITICAL, HIGH, MEDIUM, LOW, or unknown, with the specific sanctions, scam, drainer, and phishing flags behind it. A verdict of unknown means nothing is known against the address; it does not mean the address is safe.

• check_email

  Scores a suspicious email for phishing signals from its parsed fields. Provide any of: from_address, from_name, reply_to, return_path, subject, body_text, and links (up to 25). Returns a risk level and score with the specific flags behind them; links in the email are also checked against RelayShield's threat-intelligence corpus. A verdict of unknown means nothing conclusive was found; this tool never reports an email as safe.

• check_breach

  Checks whether an email address appears in known data breaches. Provide `email`. Returns the number of breaches found with the named sources behind each; a count of zero means no breaches were found in the corpus, not that the address is safe. Read-only: it only looks up breach records. Requires the RELAYSHIELD_API_KEY environment variable; without it, the tool returns setup instructions instead of calling the API.