Security & Testing

getbotornot.com

Provides a sourced directory and risk assessment of trading bots, checking names/domains against regulator scam records and returning report cards, prediction-market venues, and documented bot fact sheets.

1 endpoint12 known toolsFirst detected October 16, 2026Last detected October 16, 2026

ENDPOINT 1

https://getbotornot.com/mcp

No auth detected

MCP server metadata

Name: botornot
Version: 2.0.0

Capabilities

tools

Server instructions

Read-only tools for checking trading bots, websites and scams. Always cite the source URLs in results. A no_record verdict or a clean website check is not proof of safety. Report cards are rule-based classifications, not ratings. Not investment advice.

Known tools 12

check_bot

Check a trading bot name or website/domain against BotOrNot's sourced bot directory and every regulator scam record (SEC, CFTC and a state regulator crypto scam tracker).

Inferred read-only

get_bot

Full sourced fact sheet for one documented bot by slug (see list_bots): pricing, markets, custody model, red flags with sources, report card, impostor scam reports.

Inferred read-only

get_report_card

The rule-based BotOrNot report card for a bot (Clear record, Caution, Red flags, Closed, Limited data) with the exact sourced facts and rule ids that produced it.

Inferred read-only

get_prediction_markets

Prediction-market venues (Kalshi, Polymarket US, Gemini Predictions) with their CFTC status and official sources, plus the documented prediction-market bots and their report cards.

Inferred read-only

list_bots

List documented trading bots (slug, name, category, report card, official_url).

Inferred read-only

compare_bots

Side-by-side sourced facts and report cards for two bots by slug.

Inferred read-only

search_scams

Search regulator scam and enforcement records (SEC, CFTC and a state regulator crypto scam tracker) by name, website or keyword.

Inferred read-only

check_website

Scam signals for a website: exact matches in a state regulator scam tracker, look-alikes of real bot domains (typos, homoglyphs, brand+words), domain age from public RDAP, HTTPS, and optional red-flag phrases in pasted text.

Inferred read-only

get_changes

Recent change events: new regulator cases, new state scam-tracker reports, bot shutdowns, report-card changes and keyword-matched SEC/CFTC releases.

Inferred read-only

check_telegram

Check a Telegram @handle or t.

Inferred read-only

get_incidents

Verified security incidents (hacks, exploits, key leaks) at trading bots: date, what happened, users affected, estimated loss as named in the sources, refund status and source URLs.

Potential side effects

get_leaderboard

Hyperliquid vault leaderboard from on-chain data: open vaults with >= $100k TVL ranked by 30-day PnL (USD).

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.botornot]
url = "https://getbotornot.com/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "botornot": {
      "type": "http",
      "url": "https://getbotornot.com/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: botornot
Remote MCP URL: https://getbotornot.com/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "botornot": {
      "url": "https://getbotornot.com/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "botornot": {
      "type": "http",
      "url": "https://getbotornot.com/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "botornot",
  "transport": "streamable-http",
  "url": "https://getbotornot.com/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.