$ whoami

allow. challenge. block.

monapi is a self-hosted decision API: IP, domain or email in, explainable decision out — with score, signals and evidence. No US service, no third-country transfer, no black box.

./console — try it live git clone — github

monapi — engine response

$ curl -H 'X-API-Key: …' api.monapi.io/v1/check/ip/185.220.101.1?profile=checkout

{
  "decision": "challenge",
  "score": 40,
  "confidence": 0.7,
  "profile": "checkout",
  "signals": [
    {
      "id": "feed:tor_exits:0",
      "category": "anonymizer",
      "weight": 40,
      "source": "tor_exits",
      "severity": "high"
    }
  ],
  "enrichment": {
    "asn": 60729,
    "asn_organization": "TORSERVERS-NET",
    "country_iso": "DE",
    "hostname": "berlin01.tor-exit.artikel10.org"
  },
  "timing_ms": { "total": 96 }
}

allow

score < 30 — clean signals, normal traffic

challenge

30–79 — uncertain: soft-block, captcha, throttle

block

≥ 80 — clear-cut: disposable, known abuse, botnet

Thresholds and weights are policy, not physics — configurable per profile.

$ cat features.txt

feeds

firehol L1-L3, tor exits, disposable domains — refreshed every 15 min

ipv4+ipv6

both protocols, no silent allow fallback

enrichment

ASN, organization, country, rDNS — local MMDB, no account

profiles

?profile=checkout — thresholds and weights per surface

email checks

syntax, MX, disposable, role accounts, typos — no SMTP probing

self-hosted

SQLite + in-memory trie, zero external calls at request time

$ ls integrations/

Two lines, not a hundred.

The API is plain HTTP. The packages exist so you skip the timeout, fail-open and type handling every integrator writes from scratch — and so an agent can use the same decision as a tool, including one that explains its own verdicts.

./docs/clients

integrate

$ npm install @monapi/client

const { decision, score, signals } =
  await checkEmail("kontakt@gamil.com", "lead")
// challenge — email:domain_typo, did_you_mean: gmail.com

$ claude mcp add monapi -- uv run monapi-mcp

# 6 tools: check email/ip/domain, batch, explain, profiles

$ grep gdpr README.md

IP addresses are personal data.

Every request to IPQualityScore, Sift or Castle is a third-country transfer — with SCC paperwork and a Transfer Impact Assessment. monapi runs on your infrastructure: feeds and the GeoIP database are held locally, nothing leaves at request time. The topic is settled, not managed.

deploy

$ git clone github.com/dplusf/monapi-engine && cd monapi-engine

$ docker compose up --build

# api on :8007, site on :3007, worker syncs feeds, geoip refreshed daily

$ cat OPERATOR

Built and operated by projektsued GmbH in Kirchheim near Munich, Germany. We build and run systems like this for others, too: monitoring, anti-abuse, platform operations.

./contact