Use Lookproof in your AI agent

Step 1: start with a dry run

The server runs with uv's uvx, which downloads lookproof-mcp from PyPI into its own environment. There is nothing to clone or install by hand.

uvx lookproof-mcp --version
uvx lookproof-mcp --check   # compares every tool's price with the live 402 response; pays nothing

Without X402_PAY=1, every tool is a dry run: it reports the price and returns no data, and nothing is signed or paid. Set up your client below without the payment settings first, ask a question, and check that the agent finds the tools and their prices.

Step 2: a wallet and a spending cap

Use a dedicated wallet with a few dollars of USDC on Base mainnet, never your main wallet. Store its key in a file only you can read, so it never sits in an MCP client's config file:

install -m 600 /dev/null ~/.lookproof-wallet.key
nano ~/.lookproof-wallet.key        # paste the private key, save

• X402_PAY=1 turns payments on.
• PRIVATE_KEY_FILE is the path to the key file. The server refuses a file that other users can read.
• MAX_SPEND_USD caps what one server process can spend (default $0.10). Calls beyond it are refused, not paid.

Every tool description states its price, so the agent can see what a call costs before making it, and the free get_spending tool shows what the session has spent.

Claude Code

Dry run:

claude mcp add lookproof -- uvx lookproof-mcp

With payments (remove the dry-run server first with claude mcp remove lookproof):

claude mcp add lookproof \
  --env X402_PAY=1 \
  --env PRIVATE_KEY_FILE=$HOME/.lookproof-wallet.key \
  --env MAX_SPEND_USD=0.25 \
  -- uvx lookproof-mcp

Check the connection with /mcp inside Claude Code.

Claude Desktop

Add this to claude_desktop_config.json (Settings, Developer, Edit Config) and restart Claude Desktop. Leave out env for a dry run.

{
  "mcpServers": {
    "lookproof": {
      "command": "uvx",
      "args": [
        "lookproof-mcp"
      ],
      "env": {
        "X402_PAY": "1",
        "PRIVATE_KEY_FILE": "/home/you/.lookproof-wallet.key",
        "MAX_SPEND_USD": "0.25"
      }
    }
  }
}

Replace /home/you with your home directory. If Claude Desktop cannot find uvx, use its full path (which uvx on macOS and Linux, where uvx on Windows). On Windows, write the key path as C:\\Users\\you\\.lookproof-wallet.key.

Cursor, Windsurf and VS Code

Cursor: add this to ~/.cursor/mcp.json, or to .cursor/mcp.json in a project, then restart Cursor.

{
  "mcpServers": {
    "lookproof": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "lookproof-mcp"
      ],
      "env": {
        "X402_PAY": "1",
        "PRIVATE_KEY_FILE": "/home/you/.lookproof-wallet.key",
        "MAX_SPEND_USD": "0.25"
      }
    }
  }
}

Windsurf: open the MCP config file from Cascade's MCP settings (in stable builds ~/.codeium/windsurf/mcp_config.json) and add:

{
  "mcpServers": {
    "lookproof": {
      "command": "uvx",
      "args": [
        "lookproof-mcp"
      ],
      "env": {
        "X402_PAY": "1",
        "PRIVATE_KEY_FILE": "/home/you/.lookproof-wallet.key",
        "MAX_SPEND_USD": "0.25"
      }
    }
  }
}

VS Code: add this to .vscode/mcp.json in your workspace, then start the server from the file.

{
  "servers": {
    "lookproof": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "lookproof-mcp"
      ],
      "env": {
        "X402_PAY": "1",
        "PRIVATE_KEY_FILE": "/home/you/.lookproof-wallet.key",
        "MAX_SPEND_USD": "0.25"
      }
    }
  }
}

As for Claude Desktop: leave out env for a dry run, and replace /home/you with your home directory. Keep these files out of version control if they name your key file.

Claude.ai and ChatGPT

Hosted connector coming soon. Connectors in claude.ai and ChatGPT need a hosted server, and lookproof-mcp runs on your own machine. Until then, use Claude Code, Claude Desktop or an editor above.

Other agents: REST and OpenAPI

Any agent that can send HTTP requests can use the API at https://api.lookproof.dev. Point it at the machine-readable descriptions:

• OpenAPI 3.1 document: every endpoint, input, price and error.
• SKILL.md: how an agent chooses a tool, pays and reads results.
• llms.txt: an index of the docs for language models.

# A request without payment gets 402 Payment Required with the exact price.
curl -i "https://api.lookproof.dev/v1/mail/dmarc?domain=example.com"

Each request is paid per call with x402 in USDC on Base, so no account is needed. An x402 client pays and retries automatically. See payments, the API reference and errors. For an API key instead of a wallet, see pricing.

Example

Prompt:

Is example.com protected against email spoofing? Check SPF, DMARC and MTA-STS.

This is a dry-run reply, not a paid result: without X402_PAY=1, each tool call returns the price and no data.

{"dry_run": true, "would_cost_usd": 0.08, "network": "eip155:8453", "pay_to": "0x<lookproof-address>",
 "note": "Dry run, nothing paid and no data. The user can set X402_PAY=1 to enable payments."}

With payments on, the agent gets the full Lookproof result (status, data and findings) plus what the call cost and what is left of the session budget.

Good to know

• Checks read public DNS and public HTTPS responses. No email is sent and no mailbox is probed.
• Every result has coded findings with an explanation and a recommendation, so the agent can explain what to fix.
• Results say when they were observed and how long they are fresh. See freshness.
• Each payment is locked to the amount, asset, network and receiving address of the 402 the server just received. Source and security notes: lookproof-mcp on GitHub.