Changelog

MCP at /mcp

The MCP server now lives at dregs.com/mcp, alongside the REST API. Tools have titles, identity and device lookups include a dashboard link, and assistants confirm before they write.

Free email domains

Dregs now keeps a maintained list of free and public email providers (Gmail, Outlook, Proton, and the rest), separate from disposable addresses. Scoring can treat a free mailbox differently from a throwaway without mixing the two.

Identity reviews test proposed analyzers

When an identity review proposes a new or changed analyzer, Dregs runs the draft against a sample of your users and shows a before/after table on the review screen. You can see whether the change actually helps before you accept it.

More accurate disposable domain lists

Disposable email detection now combines the imported public list with our own additions and exclusions, so we can add domains and correct false positives without waiting for the next import. Registration blocking and authenticity checks use the combined list.

Plan limits stay in sync

Monthly operations limits and the grace period now follow the plan as billed, so a change on our side shows up in the dashboard instead of leaving a stale cap.

Registration bombing escalation

New customers get a default escalation when Dregs corroborates registration bombing and applies the Registration Bombing Suspected badge. Existing customers got the same rule. It stays in the dashboard unless you add a notification channel.

Authenticity Check, 0-100

The synchronous check endpoint is now POST /api/tools/authenticity-check and returns an Authenticity score on the same 0-100 scale as the dashboard and identity API. The older identity-check path still works as an alias.

Authenticated authenticity checks work again

Signed-in authenticity checks were failing with a server error. They work again, so you can use the check as a gate before sending confirmation emails.

Account takeover detection

Dregs now treats account takeover as a standard detection: activity from a new device combined with a password or profile change, and quiet when the device or network is already familiar. Corroborated cases get an Account Takeover Suspected badge and a default critical escalation. A new browser on a known network is unusual context, not an incident on its own.

Disposable email checker accepts domains

The disposable email checker now accepts a bare domain, not only a full address.

Disposable email checker

We shipped a free disposable email checker, backed by the same lists Dregs uses for Authenticity scoring. Paste an address to see whether it belongs to a known throwaway provider.

MCP server

Coding assistants can connect to Dregs over MCP to look up live identities, events, devices, and analyzers.

Disregarded accounts stay out of matching

When you disregard an operator account, Dregs also ignores the devices, IPs, and sessions that account used, so support logins and load tests no longer look like shared infrastructure on everyone else's identities.

Mappings in Settings

Team admins can connect event names and identity fields to Dregs's canonical types on the Mappings tab in Settings. The list is built from what you've already sent, with suggestions for unmapped rows.

Analyzers that understand your events

New behavior analyzers key off those canonical types (registration, login, password reset, and similar) instead of guessing at each customer's event names.

Event and identity mappings

Dregs can map your event names and identity fields to a shared set of canonical types, so analyzers recognize a signup or an email address even when every product names those differently.

Analyzer configs

Analyzer thresholds and similar settings have their own Configs tab in Training, with your account's values separate from the shared defaults. You can tune a detector without editing its script.

Pointer and keyboard collection

The tracking script now records clicks, mouse movement, scrolling, and similar interaction. Humanity scoring can tell a real pointer from a script that never moved the mouse.

Your own copy of global resources

You can copy a global analyzer, dataset, or mapping into your account and change the copy without altering the shared default.

Clearer onboarding and billing

The in-dashboard onboarding steps are easier to follow, and the billing screen shows when a subscription is set to cancel at the end of the period.

Demo mode

The dashboard can mask names, emails, and other personal details so a walkthrough doesn't expose real user data.

Test an analyzer before you save it

You can run a draft analyzer against a real identity and see the observations before you activate the change.

Dashboard consistency

Empty states and form controls are more consistent across lists and settings.

Slack notifications

You can connect a Slack workspace and send escalations there, including through Slack's app install flow.

Alerts are now escalations

We renamed Alerts to Escalations. The dashboard list and rules are the same idea; notifications still go through channels. Escalations remain visible in the dashboard even when no channel is attached.

Tighter account protections

Passwords must be at least 12 characters. After several failed logins, the account locks for a few minutes, and longer if the failures continue. Confirmation codes stop accepting guesses after too many tries; requesting a new code starts over.

Promo codes at checkout

Stripe Checkout accepts promo codes, and a few billing labels and buttons are clearer.

A home dashboard that fits your volume

The home view adapts to how much data you have: a simple layout when you're starting out, and date ranges, items that need attention, and rule activity once you have volume. A persistent banner appears when you hit a plan limit.

Secret key API access

Most API endpoints accept your secret key, so server-side integrations don't have to mint a user session first.

Retention is a window, not a delete

Older events stay stored. Lists and scoring only use activity inside your plan's retention window, and scores are left alone when an identity has nothing in that window.

Score history

Each identity has a score history graph, so you can see how Humanity, Authenticity, Uniqueness, and Behavior moved over time and open the observations behind a point. Alert emails use the same templates as the rest of our mail, and the alerts table is easier to scan.

Account email

Confirmation, password reset, and the other account messages are HTML emails rather than bare text.

Self-service billing

You can pick a plan, check out with Stripe, and manage billing from the dashboard. The pricing page matches what's in the product. We dropped the beta banner.

Broader scoring coverage

Scoring covers more of the abuse patterns on our use-case pages. Analyzers can look up related identities, devices, and lists while they run, so a single signal is less likely to be the whole story.

Self-service signup

You can create an account, accept the terms, and start a trial without waiting on us. Profile, password, and account deletion live on the Account page. When a trial ends, scoring pauses through a grace period while events still land.

Trainer access

Dregs staff can work in your account as trainers: review identities, adjust analyzers, and improve scoring for you and for everyone, without using your password.

Dataset overlays

You can add or exclude entries on top of a global dataset (a domain, an IP, and similar) without replacing the whole list.

Search that understands scores

Lists of identities, events, and devices have a search bar that mixes free text with filters such as humanity:10-40, so you can find a band of suspicious accounts without exporting a spreadsheet.

Disregard a device or identity

Mark a device or identity as disregarded when it's yours: support staff, load tests, or an office shared browser. Dregs skips it in scoring and in other users' relationship matching.

Identity review and datasets

You can request an AI review of an identity; it may suggest analyzer changes. Datasets are versioned lists that analyzers can look up, so publishing a new list doesn't interrupt scoring mid-cycle.

Editable analyzers

Analyzers are JavaScript you can view and edit in the dashboard. Dregs can also send an identity for review and take suggested rules from that review.

Alert rule previews

Creating an alert rule now shows who would currently match, and each alert carries more of the detail you need to act on it.

Alert rules you can time and keep

An alert rule can start from an effective date so it doesn't fire on old identities the moment you save it. Email alerts that hadn't been sending now go out. Deleted rules are kept for history instead of disappearing from past alerts.

Notification channels

Notifications go through channels. The first channel type is webhooks, so your application can hear about alerts without polling the dashboard.

Badges and alerts

Identities can carry badges, applied by analyzers or by rules you write. Alerts fire when scores or badges match conditions you set, so the cases that need a look don't wait for someone to open the identity list.

Identity relationships

Dregs records when identities look related (same device, similar email, shared IP, and similar) and shows those links on the identity page and in the API. That's the difference between one odd account and a small crowd sharing infrastructure.

The dashboard is live

The Dregs dashboard is generally available. Add the tracking snippet and Dregs starts scoring the people on your site across Humanity, Authenticity, Uniqueness, and Behavior. Identities, devices, and events show up as they arrive.

The home view charts activity and score mix, so you can see the shape of your user base without opening every record. Onboarding walks through API credentials and the first snippet, so the empty state has a next step.