RelayShield Scam Checks

Checks one URL, or up to 25 URLs in a single call, against RelayShield's threat-intelligence corpus for known phishing, malware, and scam abuse. Provide either `url` (a single http:// or https:// link) or `urls` (an array of up to 25 links). Returns a per-link verdict of FLAGGED or unknown with the reasons behind each verdict, plus counts of checked, flagged, and incomplete links. A verdict of unknown means nothing is known against the link; this tool never reports a link as safe.

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "A single link starting with http:// or https://. Omit when sending urls."
    },
    "urls": {
      "type": "array",
      "maxItems": 25,
      "items": {
        "type": "string"
      },
      "description": "Up to 25 links to check in one call. Omit when sending url."
    }
  }
}

Returns a read-only risk assessment of a cryptocurrency wallet address. It never moves funds or initiates transactions. Provide `address`; the chain (EVM, Solana, TON, or Bitcoin) is detected from the address format automatically. Returns a risk level of CRITICAL, HIGH, MEDIUM, LOW, or unknown, with the specific sanctions, scam, drainer, and phishing flags behind it. A verdict of unknown means nothing is known against the address; it does not mean the address is safe.

{
  "type": "object",
  "properties": {
    "address": {
      "type": "string",
      "description": "Wallet address to screen. Chain is auto-detected."
    }
  },
  "required": [
    "address"
  ]
}

Scores a suspicious email for phishing signals from its parsed fields. Provide any of: from_address, from_name, reply_to, return_path, subject, body_text, and links (up to 25). Returns a risk level and score with the specific flags behind them; links in the email are also checked against RelayShield's threat-intelligence corpus. A verdict of unknown means nothing conclusive was found; this tool never reports an email as safe.

{
  "type": "object",
  "properties": {
    "from_address": {
      "type": "string",
      "description": "The claimed sender's address, e.g. [email protected]."
    },
    "from_name": {
      "type": "string",
      "description": "The claimed sender's display name."
    },
    "reply_to": {
      "type": "string",
      "description": "Reply-To address, if present and different from from_address."
    },
    "return_path": {
      "type": "string",
      "description": "Envelope sender, if available. Informational only."
    },
    "subject": {
      "type": "string",
      "description": "Message subject."
    },
    "body_text": {
      "type": "string",
      "description": "Plain-text body, used for urgency/deadline/threat phrasing."
    },
    "links": {
      "type": "array",
      "maxItems": 25,
      "items": {
        "type": "string"
      },
      "description": "Links found in the body, up to 25."
    }
  }
}

Checks whether an email address appears in known data breaches. Provide `email`. Returns the number of breaches found with the named sources behind each; a count of zero means no breaches were found in the corpus, not that the address is safe. Read-only: it only looks up breach records. Requires the RELAYSHIELD_API_KEY environment variable; without it, the tool returns setup instructions instead of calling the API.

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email",
      "description": "Email address to check. Case-insensitive."
    }
  },
  "required": [
    "email"
  ]
}