ActiveLayer MCP server

Let Claude, ChatGPT, Claude Code, Cursor or any other MCP client set up ActiveLayer spam protection for a site and review what it blocked, straight from the conversation.

What you can ask

• "Protect the contact form on example.com from spam" creates a project, links to the dashboard to generate your API key, and gives the agent platform-specific integration steps.
• "How much spam did my site block this week?"
• "Why was the submission from [email protected] flagged?"
• "That message was not spam, fix it."
• "How many checks do I have left this month?"

Connect

Claude (web, desktop, mobile)

Settings → Connectors → Add custom connector. Paste the server URL and sign in to your ActiveLayer account when prompted. Once ActiveLayer is listed in the Connectors Directory, you can add it with one click instead.

ChatGPT

Settings → Apps & Connectors → Create (developer mode), paste the server URL, choose OAuth. Or install ActiveLayer from the app directory once it is listed.

Claude Code

claude mcp add --transport http activelayer https://app.activelayer.com/mcp

The first tool call opens your browser to sign in.

Cursor, Windsurf, other MCP clients

{
  "mcpServers": {
    "activelayer": {
      "url": "https://app.activelayer.com/mcp"
    }
  }
}

Tools

Tool	Access	What it does
list_projects	read	Your projects, their platform, API key status and connected WordPress sites.
get_usage	read	Plan, allowance, checks used and remaining.
list_detections	read	Recent spam checks with verdict, overall score, threshold, sender, excerpt and feedback. Filter by project, verdict and period.
get_detection	read	One check's submitted fields, verdict, overall score, threshold and feedback.
check_submission	read	Score any text through the detector with ActiveLayer's demo key. Does not use your quota.
create_project	write	Create a project with integration steps. Generate its API key in the dashboard and copy it directly into your site configuration.
report_feedback	write	Mark a detection as a false positive or false negative.

One prompt, protect-form, chains these into the full setup flow for a site.

Authentication and data

The server uses OAuth 2.1 with PKCE and dynamic client registration. You sign in to your ActiveLayer account in the browser and approve the connection; the client never sees your password and no API key is involved. Access tokens expire after one day and refresh for up to thirty days. Removing the connector from your AI client stops it from using ActiveLayer; to cut access off immediately, contact support.

Every tool is scoped to your account. The server reads your projects, plan usage and detection logs, and writes only what the tools above describe: new projects and feedback on detections. API keys are generated separately in the dashboard and are never returned to your AI client. Demo checks send the supplied fields to the ActiveLayer detection API using a first-party demo account and consume a separate rate limit. Nothing from your conversations is stored beyond the tool inputs needed to answer.

See the privacy policy and terms.

Requirements

A free ActiveLayer account with the short account setup completed. Email confirmation is optional. Create one if you do not have one yet; the connector will ask you to sign in on first use.