An agent handed a URL will fetch it, and the interesting attacks — a redirect chain ending somewhere else, a domain that looks like your bank — are invisible in the string itself. Inspecting first turns that into a decision. The allowlist is the part that keeps it affordable and fast: the domains you already trust should never cost a check. Note the account is created from inside the connection, which is convenient and worth knowing before you connect it.
A URL-inspection service for agents: given a link, it reports what is actually behind it across several dimensions rather than just whether it resolves.
- check_url and check_urls — one link or many, across the full signal set
- Redirect behaviour and brand impersonation among the dimensions examined
- Profiles — create, list and delete them, plus the defaults they inherit
- An allowlist you can add to and remove from
- Account tools — balance, pricing, purchase, check history and usage statistics
Npx, and an account created through the server itself. Every account starts with free credits; well-known domains resolve without spending them, and their documentation says most lookups are free in typical use. Credits are bought outright rather than by subscription.
One command plus a key — npx -y @unphurl/mcp-server, then supply credentials