Build on ChainPatrol

Build on ChainPatrol

Check whether a URL, domain, handle or address is known malicious, submit reports with evidence, pull takedowns and metrics, receive webhooks, and connect AI agents through the MCP server.

Check whether a URL, domain, handle or address is known malicious, submit reports with evidence, pull takedowns and metrics, receive webhooks, and connect AI agents through the MCP server.

What’s available

What’s available

ToolWhat it does
External APIAsset checks against the blocklist, reports with evidence attachments, takedowns, metrics, organization assets, detection configs, dark web credential search and disputes. See the API overview
JavaScript SDKA threat detector, relay, storage and API client for protecting your app’s users from phishing and scam URLs
CLICheck assets, file reports, review proposals and query detection and takedown data from a terminal or a script
WebhooksAsset status changes and new suspected threats, pushed to your endpoint
MCP serverConnect Claude, Cursor and other AI agents to ChainPatrol, hosted or run locally through the CLI
IntegrationsSlack, Telegram and Discord bots, a public reporting page and app integrations. See integrations

What teams build with it

What teams build with it

Four patterns we see most.

Four patterns we see most.

01

01

Check links before customers see them

Call the asset check from your support tooling, moderation pipeline or app to warn on known malicious URLs and addresses.

02

02

File reports from your own tools

Send suspected phishing with screenshots and email evidence straight from your SOC or support queue.

03

03

Mirror the blocklist

Pull the asset list by status and type with cursor pagination for a bulk sync.

04

04

Pipe metrics into your dashboards

Threats found, takedowns filed and completed, and response times by brand and type.

Getting access

Getting access

API keys are created per organization in the dashboard and scoped to read only or read and write. Requests authenticate with an X-API-KEY header, and breaking changes follow the published deprecation policy with at least 90 days’ notice.

API keys are created per organization in the dashboard and scoped to read only or read and write. Requests authenticate with an X-API-KEY header, and breaking changes follow the published deprecation policy with at least 90 days’ notice.

Access for security tools

Access for security tools

Browsers, antivirus tools, security apps, marketplaces and wallets can request read-only access to check assets against the blocklist.

Browsers, antivirus tools, security apps, marketplaces and wallets can request read-only access to check assets against the blocklist.

What you can build on

What you can build on

Asset checks

Look up any URL, domain, handle or address.

Reports with evidence

Submit suspected threats with attachments.

Takedowns and metrics

List takedowns and pull metrics by brand.

Detection configs

Create and tune detection per brand.

Webhooks

Status changes pushed to your endpoint.

MCP server

Give AI agents ChainPatrol tools.

Frequently asked questions

Brands get API access with their ChainPatrol program. Browsers, antivirus tools, security apps, marketplaces and wallets can request read-only access to the blocklist.

Yes. The asset check endpoint and the JavaScript SDK are built for that.

Yes, through the MCP server, hosted or run locally through the CLI.

The API lists takedowns and their status, and lets you file reports with evidence. Takedowns themselves are filed by ChainPatrol’s team.

Start with the docs

Start with the docs

Everything is documented, with examples.

Everything is documented, with examples.