LayerCall - 2026 Pricing, Features, Reviews & Alternatives

LayerCall is a trust and fraud API for developers. Send any combination of IP address, email, phone number, domain and device fingerprint to one endpoint and get back a single weighted risk score from 0 to 100, a verdict of allow, review or block, and the individual signals that produced it.

What it detects

IP: commercial VPNs, proxies, Tor exit nodes, datacenter and hosting ranges, hijacked netblocks, and addresses recently reported for abuse. Tor and abuse feeds refresh every six hours.

Email: disposable and throwaway domains, role accounts, machine-generated handles, homograph and lookalike spoofs of well-known domains, missing SPF or DMARC, newly registered domains, and risky top-level domains.

Phone: national numbering-plan validation worldwide, line type, VoIP and premium-rate detection, and unallocated or fictional ranges.

Domain: registration age from RDAP, registrar, mail configuration and web presence.

Device: a browser fingerprint from a small script, with headless-browser and automation detection, plus repeat-device linkage that catches an attacker who rotates IPs and email addresses but keeps the same machine.

AI agents: cryptographic verification of Web Bot Auth signatures under RFC 9421, so a verified agent is proven rather than inferred from a user-agent string, and you decide what a verified agent is allowed to do.

An unknown is not a negative finding

When a signal cannot be established honestly, the field is null rather than a guess, and a signals_unavailable list tells you which checks could not complete. A fraud answer that says the value is clean and one that says we could not look are different answers, and treating the second as the first is how a false negative reaches production. Where the industry publishes a confident boolean, LayerCall publishes the uncertainty.

Built for developers

REST over HTTPS with a published OpenAPI specification and a Postman collection. Official Node and Python clients with zero dependencies, plus Express and Next.js middleware. A hosted MCP server so Claude, Cursor, ChatGPT, VS Code, Windsurf and Zed can call the same tools from inside an editor or agent. Integrations for Zapier and n8n.

A documented test mode with fixed sample values returns the same response shapes, error codes and rule behaviour as production, so integration tests are valid without spending credits.

Custom rules let you allow or block specific values, domains or ranges for your account. An optional reporting network lets you mark a value as confirmed fraud and benefit from what other customers have reported, using hashes rather than raw values.

Pricing and security

Credit-based, never per seat: one credit is one signal checked, seats are unlimited, and every plan includes every endpoint. Cached and test-mode lookups are free. You can set your own monthly spend cap, and the free tier is a hard cap rather than a surprise bill. The free plan is 1,000 lookups a month with no credit card and no daily limit.

Keys are hashed at rest, raw identifiers are never stored in the reputation network, and every response carries a request_id for support and audit.