About Dregs

Dregs is a fraud detection and abuse prevention platform for SaaS operators. It scores the identities in your product on Humanity, Authenticity, Uniqueness, and Behavior, from the events you already send.

We built it to deal with the dregs of internet society: the badly behaved humans and bots who abuse your free trials, create duplicate accounts for nefarious purposes, cram your user table full of fake signups, game your referral programs, and now and then attack your systems outright and bother your legitimate users.

Running a SaaS these days has come to mean spending a decent chunk of your time and operating budget (and your team's morale) locked in a game of endless whack-a-mole with these unscrupulous characters.

What Dregs Does

Score every user on four dimensions

Dregs scores each identity from 0 to 100 on Humanity, Authenticity, Uniqueness, and Behavior. The scores update as new activity arrives, and each one opens into its observations. A low score is evidence you can read, so a person can spot a false positive and overrule it.

Decide who to quarantine

Custom rules and lists sit on top of the scores. Badge rules label an identity, and escalation rules notify you when a pattern you named shows up, in the dashboard, by email, or in Slack. You set the line. A likely duplicate can lose a trial benefit while a clean account is left alone, which means less manual review of the whole user table.

Send scores into your stack

Webhooks and the API carry scores, badges, and escalations into the application you already run. Your backend applies the policy: hold a signup for review, rate-limit a session, or block an account. The channels manual covers email, Slack, and signed webhooks.

Install with a snippet or an agent

The install is a tracking snippet, the same shape as an analytics tag, written up in Getting Started. Teams that would rather hand it off connect Claude Code, Codex, or Cursor to the Dregs MCP server. The agent reads the manual, proposes the changes in your repository, and waits for review. The same steps are in the dashboard onboarding, with your public key filled in, including a manual path with no agent in the repo.

Who Uses Dregs

Dregs is for the people who have to live with a SaaS user table.

• SaaS operators and founders fighting free trial abuse and junk signups
• Trust and safety teams reviewing fake signups, duplicate accounts, and registration bombing
• Growth teams whose referral programs are being gamed

If credential stuffing or account takeover is the mess in front of you, those are on the use cases list too.

What Makes Dregs Different

Four scores in one place

Bot detection on its own answers one question, usually at the door, and it also blocks useful automation. Device fingerprinting on its own tells you a browser looks familiar, which a determined signup can still work around. Dregs keeps the four scores together, so an account has to look legitimate on more than one axis. If you're weighing other fraud tools, the comparisons cover how Dregs sits next to them.

The same events as your analytics

Dregs reads the event stream you already produce for a product analytics tool. Identify the user, then track signups, logins, and the actions that matter in the product. It usually sits next to Mixpanel, PostHog, or Google Analytics, and the scores start from that same stream.

You keep the judgment

Scores, badges, and escalations are inputs to your policy. Your rules decide who gets a second look, who gets limited, and who is left alone. The terms treat every output as informational. False positives stay yours to overrule, because each score opens into the observations behind it.

Used on Loadster first

Dregs was dogfooded on Loadster, Andy Hawkes's other company, against live trial abuse and fake signups. The four scores are the questions Loadster was already forcing us to answer.

An agent can install it and investigate

Dregs exposes an MCP server next to the API, at https://dregs.com/mcp. Claude Code, Codex, and Cursor can follow the install in your repository, and later pull an identity, its observations, and its links while you investigate a suspicious account. You approve what the agent changes.

The Dregs Origin Story

Andy Hawkes founded Dregs after years of fighting SaaS abusers over at Loadster, his other company.

After dealing with the same abuse patterns over and over and trying the usual piecemeal defenses against them, only to still see determined humans and the occasional bot get through all too often, it became clear that sorting out the good users from the troublemakers really boils down to four main questions:

• Is this actually a human?
• Is the profile data authentic?
• Is this the only account for this identity?
• Is this identity behaving like we want our users to behave?

These four questions ended up being the inspiration for the four main scores in Dregs: Humanity, Authenticity, Uniqueness, and Behavior. Each one is a 0-100 reading of that question.

How Dregs Works

Install, events, scores, then your policy. The longer version is How Dregs Works in the manual.

1. Create an account and a public key. Getting Started has the snippet, which loads from https://dregs.com/dregs.js.
2. Add the script yourself, or hand the same steps to Claude Code, Codex, or Cursor through the MCP server.
3. Identify users and send events. Device data starts on the first page view. Scores use the identity plus the actions you track.
4. Dregs scores each identity on the four dimensions and keeps the observations behind each score.
5. Badge rules and escalation rules flag the patterns you named. Webhooks can deliver the result to your backend, which applies your policy.

Questions go to dregs@dregs.com. The contact page lists that inbox, the manual, and the free trial. We don't publish a response-time guarantee.

Key Facts

Frequently Asked Questions