BotOrNot data for developers and AI agents

Endpoints

• GET /api/index.json: This list of endpoints.
• GET /api/bots.json: All 102 documented bots with pricing, exchanges, custody model, red flags (each with a source URL) and record_status.
• GET /api/bots/{slug}.json: One bot, plus California DFPI scam reports that impersonate its brand (impostor_entries).
• GET /api/prediction-markets.json: Prediction-market venues (Kalshi, Polymarket US, Gemini Predictions) with CFTC status and sources, plus the bots in the “Prediction market bots” category.
• GET /api/scams.json: 10 SEC/CFTC enforcement actions involving trading bots or "AI" trading, plus 600 California DFPI Crypto Scam Tracker entries. Every entry has an official source URL.
• GET /api/leaderboard.json: 74 Hyperliquid vaults ranked by 30-day PnL from Hyperliquid's public data.
• GET /api/check.json?q={name or website}: Look a name or domain up against the bot directory and every scam record. Returns verdict: watchlist_match, documented_bot, both, or no_record (no_record is NOT a clean bill of health).
• GET /api/site-check.json?url={website}: Signals for a pasted website: exact matches in the CA DFPI scam tracker, look-alikes of real bot domains (typos, homoglyphs, brand+words), domain age from public RDAP, and HTTPS. Signals, not a verdict.
• POST /api/site-check: Same as above with JSON {"url": "...", "text": "optional pasted text"}; text is scanned for regulator-listed red-flag phrases and never stored.
• GET /api/methodology.json: Report card rules (versioned), levels and custody models.
• GET /api/changes.json: Change events: new regulator cases, new DFPI entries, shutdowns, report-card changes, regulator releases. Also as Atom: /feed.xml and /bots/{slug}/feed.xml.
• GET /api/proven-returns.json: Hyperliquid vaults that self-describe as bots/algos, with on-chain PnL, plus directory bots with a verifiable vault mapping.
• POST /mcp: Read-only Model Context Protocol server (JSON-RPC over Streamable HTTP, stateless). Tools: check_bot, get_bot, get_report_card, list_bots, search_scams, check_website, get_changes, get_leaderboard, compare_bots.

Try it: /api/bots/3commas.json · /api/check.json?q=web3-cryptohopper.com · /api/leaderboard.json

Machine-readable docs

• /openapi.json: OpenAPI 3.1 spec
• /llms.txt and /llms-full.txt: plain-text guides for language models
• /sitemap.xml and /robots.txt: AI crawlers are welcome

MCP server

Point any Model Context Protocol client at https://getbotornot.com/mcp (Streamable HTTP, stateless, no auth). Tools: check_bot, get_bot, list_bots, search_scams, get_leaderboard. All read-only.

Rate limits and API keys

Free and keyless: 60 requests per minute per IP, and 10 per minute for the website checker. Over the limit you get HTTP 429 with Retry-After. Need more, or commercial use without attribution? See API tiers. Every tier gets the same data, and no response contains ads.

Rules of the road

• “no_record” is not a clean bill of health. New scam sites appear every week. Say so when you relay a result.
• Cite the record’s own source (the regulator release or pricing page) and link the BotOrNot page.
• Regulator complaints are allegations until a court rules or the case settles.
• Data changes at most daily; please cache.
• Not investment advice. Affiliate disclosure.