scamgate

Privacy · scamgate

Privacy

This covers scamgate in every form: the command line, the MCP server, the hook, the Hermes plugin and the Claude Code plugin. Last updated 26 October 2026.

01In short

scamgate runs on your machine. It has no accounts, no telemetry and no server of its own. Nothing about the links you check, the payments you check or the commands your agent runs is sent anywhere. The author receives no data from it.

02Downloads

To refresh its phishing lists, scamgate downloads whole lists. A download carries nothing about what you check.

  • The OpenPhish community feed, from openphish.com.
  • The Phishing.Database active-domains list, from raw.githubusercontent.com.
  • The abuse.ch URLhaus list, only if you give scamgate a URLhaus key.
  • The Phishing.Database active-links list, only if you ask for it with scamgate update-feeds --all.

The lists download when you run scamgate update-feeds, when your agent calls the update_feeds tool, and on the automatic refresh, which the Hermes and Claude Code plugins run every 6 hours unless you turn it off. Each provider sees an ordinary download request from your IP address, under its own terms.

03What it sends

  • Your URLhaus key, if you set one, goes only to urlhaus-api.abuse.ch, as part of that list's download address. The Claude Code plugin keeps it in your system's secure credential store.
  • Domain-age lookups are off unless you set SCAMGATE_RDAP=live or run scamgate domain-age yourself. Then scamgate asks the domain's public registry (RDAP) when an unknown domain was registered, which tells that registry which domain you checked. The answers are cached on your machine. The Claude Code plugin never turns this on.

Nothing else leaves your machine.

04What it stores

Everything stays on your machine, in two folders you can delete at any time:

  • The phishing lists, in a scamgate folder in your cache folder ($XDG_CACHE_HOME, by default ~/.cache).
  • A private state folder, scamgate in your state folder ($XDG_STATE_HOME, by default ~/.local/state): a log of what was blocked or asked, with links redacted; a signing key for your own allow and deny rules; and salted hashes of payees you recorded with record-payment.

05This website

This site is static pages on GitHub Pages, with no cookies, analytics or third-party scripts. GitHub hosts it and handles requests to it under the GitHub privacy statement.

06Contact

Questions or corrections: open an issue at github.com/odaiameera/scamgate/issues. For a security problem, follow SECURITY.md.