{
  "markdown": "# LayerCall SDKs\n\n[![npm](https://img.shields.io/npm/v/layercall?label=npm&color=cb3837)](https://www.npmjs.com/package/layercall)\n[![PyPI](https://img.shields.io/pypi/v/layercall?label=PyPI&color=3775a9)](https://pypi.org/project/layercall/)\n[![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE)\n[![Dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](#)\n\nOfficial clients for [LayerCall](https://www.layercall.com) — score an IP,\nemail, phone number, domain, or a whole signup for fraud in a single call.\n\n| | Install | Docs |\n| --- | --- | --- |\n| **Node / TypeScript** | `npm i layercall` | [node/README.md](node/README.md) |\n| **Python** | `pip install layercall` | [python/README.md](python/README.md) |\n| **CLI** | `npx layercall ip 8.8.8.8` | below |\n\nBoth clients have **zero dependencies**. A trust check sits on your signup\npath, which is the worst place in an application to introduce a dependency\ntree.\n\n[Get a free API key](https://www.layercall.com/get-key) — 1,000 lookups a\nmonth, no card required, no daily cap.\n\n## Try it without installing anything\n\n```bash\nexport LAYERCALL_API_KEY=tl_live_...\nnpx layercall ip 8.8.8.8\nnpx layercall email someone@mailinator.com\nnpx layercall domain example.com\nnpx layercall user --ip 1.2.3.4 --email a@b.com\n```\n\n## What it returns\n\nEvery endpoint returns the same shape: a `0–100` `risk_score`, an\n`allow | review | block` verdict, and the signals behind it.\n\n```json\n{\n  \"ip\": \"185.220.101.1\",\n  \"risk_score\": 60,\n  \"verdict\": \"review\",\n  \"signals\": {\n    \"is_vpn\": true,\n    \"is_proxy\": true,\n    \"is_datacenter\": true,\n    \"is_tor\": true,\n    \"recent_abuse\": false\n  },\n  \"geo\": { \"country\": \"DE\", \"city\": \"Berlin\", \"asn\": \"AS60729\" },\n  \"vpn_provider\": null\n}\n```\n\n## Two things worth reading before you integrate\n\n**Prefer step-up over rejection.** The `review` band starts where an ordinary\ncommercial VPN lands, and most VPN users are ordinary customers. Send them an\nOTP or a 3-D Secure challenge instead of a refusal: a real user clears it in\nseconds, an attacker cannot, and a false positive costs friction rather than a\ncustomer. This is what Stripe Radar and Sift both converged on.\n\n**`null` means unknown, not \"no\".** `newly_registered` is `null` when a TLD\npublishes no RDAP (`.de`, `.ru`, `.ac.uk` among them), and `mailbox_exists` is\n`null` when the mail provider does not answer honestly — Gmail and Yahoo accept\nmail for addresses that do not exist. Treating either as a negative finding is\nthe specific mistake these fields exist to prevent.\n\n## Endpoints\n\n| | |\n| --- | --- |\n| `POST/GET /v1/score/ip` | VPN, proxy, Tor, datacenter, geo, ASN |\n| `/v1/verify/email` | Syntax, MX, disposable, role account, domain age |\n| `/v1/lookup/phone` | Numbering-plan validation worldwide, line type |\n| `/v1/score/domain` | RDAP age, registrar, MX/SPF/DMARC, risky TLD |\n| `/v1/score/device` | Device fingerprint reputation + bot probability |\n| `/v1/score/user` | All of the above weighted into one verdict |\n| `/v1/verify/agent` | Web Bot Auth (RFC 9421) — prove an AI agent is who it claims |\n| `/v1/batch` | Up to 500 values of one type |\n\nFull reference: [layercall.com/docs](https://www.layercall.com/docs) ·\nOpenAPI 3.1: [layercall.com/openapi.json](https://www.layercall.com/openapi.json)\n\n## Testing without spending anything\n\nTest-mode keys return deterministic **synthetic** data, drawn from ranges\nreserved for exactly this purpose — RFC 5737 addresses, `example.com`, the\n555-01XX fiction block. Same shape and fields as production, so your assertions\nare real ones. They never bill, never hit live data sources, and never write to\nthe shared reputation network.\n\nEvery fixture is documented, so you can assert on exact values rather than\n\"did it return a number\": [layercall.com/docs/test-mode](https://www.layercall.com/docs/test-mode)\n\n## MCP — call it from an AI agent\n\nLayerCall speaks the Model Context Protocol over Streamable HTTP, so Claude\nCode, Claude Desktop, ChatGPT, Cursor, VS Code, Windsurf and Zed can run a\nfraud check mid-conversation. There is nothing to install — it is a remote\nserver, so you add a URL and your API key:\n\n```json\n{\n  \"mcpServers\": {\n    \"layercall\": {\n      \"url\": \"https://www.layercall.com/api/mcp\",\n      \"headers\": { \"Authorization\": \"Bearer YOUR_API_KEY\" }\n    }\n  }\n}\n```\n\nSeven tools are exposed: `score_ip`, `verify_email`, `lookup_phone`,\n`score_domain`, `score_device`, `verify_agent` and `score_user`.\n\n> VS Code names the top-level key `servers`, not `mcpServers`. That one\n> difference is the usual reason a copied config silently does nothing.\n\nPer-client setup: [layercall.com/docs/mcp](https://www.layercall.com/docs/mcp)\n\n## Framework middleware\n\nDrop-in for the two places this usually goes. The middleware attaches\n`req.trust` and leaves the decision to you:\n\n```ts\nimport { layercall } from \"layercall/express\";\n\napp.post(\"/signup\", layercall(), (req, res) => {\n  if (req.trust.verdict === \"block\") return res.status(403).json({ error: \"...\" });\n  if (req.trust.verdict === \"review\") flagForManualReview(req.trust);\n  createAccount(req.body);\n});\n```\n\nThere is deliberately no `autoBlock: true`. A one-line install that starts\nrejecting people is the wrong default for a fraud tool — the failure is silent,\nit lands on real customers, and you find out from a support ticket.\n\nBy default it only scores `POST`/`PUT`/`PATCH`, because a global `app.use()`\nbills a lookup for every request including `favicon.ico`.\n\nSee [node/src/express.ts](node/src/express.ts) and\n[node/src/next.ts](node/src/next.ts) (`scoreRequest`, `withTrust`).\n\n## Guides\n\nWritten for someone mid-incident rather than someone shopping. Each one ends\nwith what a naive version gets wrong — including the parts that need no\nLayerCall at all.\n\n- [How to stop fake signups](https://www.layercall.com/guides/stop-fake-signups)\n- [How to block disposable email addresses at signup](https://www.layercall.com/guides/block-disposable-emails)\n- [How to detect VPN and proxy users at signup](https://www.layercall.com/guides/detect-vpn-at-signup)\n- [How to stop free trial abuse](https://www.layercall.com/guides/stop-free-trial-abuse)\n- [How to add fraud checks without losing real customers](https://www.layercall.com/guides/score-signup-without-blocking-real-users)\n\n## License\n\nMIT\n",
  "bytes": 6319,
  "sha": "814a6fe9cc80e5376b55d2aa9ba611890f2e74826f2319a0d3031a8639cfa500",
  "repo_slug": "layercall/layercall-sdk",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_com_layercall_trust_api_615bd117/readme"
}