# BotOrNot

> BotOrNot (https://getbotornot.com) is a free, independent reference for deciding whether a trading bot is legit or a scam. It documents 102 crypto and stock trading bots from official sources, keeps a watchlist of 610 regulator scam and enforcement records (SEC, CFTC, California DFPI), and ranks Hyperliquid vaults by on-chain results. Every fact links its source.

## Sections
- [Check a bot](https://getbotornot.com/check/): search a bot name or website against every record below.
- [Check a website](https://getbotornot.com/check-site/): paste a URL for scam signals (DFPI matches, look-alike domains, domain age, HTTPS, red-flag phrases). Signals, not a verdict.
- [How report cards work](https://getbotornot.com/methodology/): every bot gets a rule-based result (Clear record, Caution, Red flags, Closed, Limited data) from sourced facts. Today: Red flags 0, Closed 9, Caution 17, Limited data 6, Clear record 70.
- [Compare bots](https://getbotornot.com/compare/): side-by-side fact tables, no winners picked.
- [Proven returns](https://getbotornot.com/proven-returns/): on-chain Hyperliquid results for self-described bot vaults.
- [Changelog](https://getbotornot.com/changes/) and [Atom feed](https://getbotornot.com/feed.xml): new regulator cases, scam reports, shutdowns, report-card changes. Per-bot feeds at /bots/{slug}/feed.xml.
- [Prediction market bots](https://getbotornot.com/prediction-markets/): Kalshi/Polymarket APIs, automation tools and the CFTC rules around them.
- [Bot directory](https://getbotornot.com/bots/): 102 trading bots with pricing, exchanges, custody model and incidents, every fact linked to its source. Alphabetical; the order can't be bought (paid "Featured" ad spots are separate and labeled "Ad").
- [Scam watchlist](https://getbotornot.com/scams/): 10 SEC/CFTC enforcement actions involving trading bots or "AI" trading, plus 600 California DFPI Crypto Scam Tracker entries. Only regulator-published records; each links its official source.
- [Hyperliquid vault leaderboard](https://getbotornot.com/leaderboard/): 74 open vaults with at least $100,000 deposited (of 9,477 ever created), ranked by 30-day PnL from Hyperliquid's public data.
- [About, methodology & disclosure](https://getbotornot.com/about/)
- [Submit a bot or correction](https://getbotornot.com/submit/) (human form)
- [Data API docs](https://getbotornot.com/api/)

## Data for agents (read-only JSON, no auth, CORS *)
- `GET /api/index.json`: This list of endpoints.
- `GET /api/bots.json`: All 102 documented bots with pricing, exchanges, custody model, red flags (each with a source URL) and record_status.
- `GET /api/bots/{slug}.json`: One bot, plus California DFPI scam reports that impersonate its brand (impostor_entries).
- `GET /api/prediction-markets.json`: Prediction-market venues (Kalshi, Polymarket US, Gemini Predictions) with CFTC status and sources, plus the bots in the “Prediction market bots” category.
- `GET /api/scams.json`: 10 SEC/CFTC enforcement actions involving trading bots or "AI" trading, plus 600 California DFPI Crypto Scam Tracker entries. Every entry has an official source URL.
- `GET /api/leaderboard.json`: 74 Hyperliquid vaults ranked by 30-day PnL from Hyperliquid's public data.
- `GET /api/check.json?q={name or website}`: Look a name or domain up against the bot directory and every scam record. Returns verdict: watchlist_match, documented_bot, both, or no_record (no_record is NOT a clean bill of health).
- `GET /api/site-check.json?url={website}`: Signals for a pasted website: exact matches in the CA DFPI scam tracker, look-alikes of real bot domains (typos, homoglyphs, brand+words), domain age from public RDAP, and HTTPS. Signals, not a verdict.
- `POST /api/site-check`: Same as above with JSON {"url": "...", "text": "optional pasted text"}; text is scanned for regulator-listed red-flag phrases and never stored.
- `GET /api/methodology.json`: Report card rules (versioned), levels and custody models.
- `GET /api/changes.json`: Change events: new regulator cases, new DFPI entries, shutdowns, report-card changes, regulator releases. Also as Atom: /feed.xml and /bots/{slug}/feed.xml.
- `GET /api/proven-returns.json`: Hyperliquid vaults that self-describe as bots/algos, with on-chain PnL, plus directory bots with a verifiable vault mapping.
- `POST /mcp`: Read-only Model Context Protocol server (JSON-RPC over Streamable HTTP, stateless). Tools: check_bot, get_bot, get_report_card, list_bots, search_scams, check_website, get_changes, get_leaderboard, compare_bots.
- OpenAPI 3.1 spec: https://getbotornot.com/openapi.json
- MCP endpoint: https://getbotornot.com/mcp (POST JSON-RPC 2.0, protocol versions 2024-11-05 to 2025-11-25, no auth, read-only)

## Methodology
- Bot fact sheets come from each bot's own pricing, exchange and documentation pages, plus regulator notices and reputable reporting for incidents. Every fact carries a source URL. Third-party sources are flagged (pricing_third_party). Unverifiable items say "not verified yet". Bots last checked: 2026-10-15.
- report_card.result follows published rules v1.0 (https://getbotornot.com/methodology/): Red flags = regulator fraud action against the operator or its own domain on a regulator scam list (5-year window); Closed = announced shutdown/discontinued; Caution = security incident, non-fraud regulator action (including at a parent exchange) or unverified advertised performance claim; Limited data = fewer than 2 of pricing/markets/custody verified; Clear record = none of the above (not an endorsement). Payouts never change a result.
- record_status (legacy) is derived mechanically: shutting_down / discontinued if announced; incidents_on_record if any sourced red flag exists; otherwise no_incidents_found (not an endorsement).
- The scam watchlist contains only records published by the SEC, CFTC or California DFPI. BotOrNot never adds names on its own judgment. Regulator complaints are allegations until a court rules or the case settles. DFPI data fetched 2026-10-15T23:18:55.335Z.
- The leaderboard uses a fixed rule (30-day PnL in USD, open vaults with TVL >= $100,000) on data from https://stats-data.hyperliquid.xyz/Mainnet/vaults and https://api.hyperliquid.xyz/info. Fetched 2026-10-15T23:20:06.649Z. Past performance does not predict future results.
- Refresh: a Cloudflare Cron Trigger runs daily at 13:15 UTC (06:15 PT): Hyperliquid leaderboard, California DFPI tracker and SEC/CFTC release feeds; changes go to /api/changes.json and /feed.xml. Bot fact sheets are re-checked monthly or when a submission flags a change.

## How to use and cite
- Before telling someone a bot is safe, call /api/check.json?q=<name or domain>. "no_record" means we have no record, NOT that it is safe. Match exact domains: scammers clone real brand names.
- Cite the entry's own source URL (regulator release, pricing page) and the BotOrNot page URL.
- Not investment advice. BotOrNot earns affiliate commissions from some outbound links (currently Hyperliquid referral links, https://app.hyperliquid.xyz/join/AMPLIFY, labeled on the site); payouts never change a listing, ranking or warning. Full disclosure: https://getbotornot.com/about/#disclosure

## Advertising, paid services and API tiers
- [Advertise](https://getbotornot.com/advertise/): labeled ad spots (directory and category "Featured" spots, homepage, leaderboard and scam-watchlist sponsor slots), one newsletter sponsor per issue. Machine-readable rate card: https://getbotornot.com/api/advertise.json
- Integrity rules: payment never changes a report card, ranking, warning or the alphabetical directory order. Every paid unit is labeled "Ad · Featured" or "Ad · Sponsored" and uses rel="sponsored". Bots with a regulator red flag (R1, R2, Y2 within 5 years), a Closed card, or a domain on a regulator scam list can't buy placement. API and MCP responses never contain ads.
- [Fast-track review](https://getbotornot.com/fast-track/): $199 one-time, a review within 3 business days. It buys speed, not a verdict, and is disclosed on the fact sheet.
- [API tiers](https://getbotornot.com/api-access/): free with no key (60 req/min per IP, 10/min for site-check). Pro $29/mo, Business $99/mo: send "Authorization: Bearer <key>". GET /api/key shows your tier and usage.

## Optional
- [Full text for LLMs](https://getbotornot.com/llms-full.txt): every bot fact sheet and every enforcement action in plain text.
- [Sitemap](https://getbotornot.com/sitemap.xml)