LabscoMCP early access ↗
cybrlab-aiMCP SERVER

PreClick

Scan a link before an agent opens it — phishing and malware checks plus an intent test that flags when the page is not what the task was about.

by cybrlab-ai ↗Agent Guardrails, Content Safety & AuditCommunity

LABSCO SUMMARY

State your intent — it is a different signal from the risk score.

The threat scan and the intent check are separate mechanisms, and the second one catches what the first cannot: a legitimate site that is simply not the one your task called for. The distinction to hold onto is that a DENY on intent grounds is a policy gate, not a high risk score, so a clean-looking result and a refusal are not a contradiction. Low-information or instruction-shaped intent strings are treated as if you gave none.

What it is

A hosted URL preflight scanner built for agents that browse. Beyond threat detection it does something a blocklist cannot: you tell it what you were trying to do, and it judges whether the destination matches. A page that is technically clean but has nothing to do with booking a hotel is still a reason to stop.

What you get

  • url_scanner_scan — analyze a URL for phishing, malware and other threats, returning a risk score and a directive
  • url_scanner_scan_with_intent — the same scan plus an intent of up to 248 characters, returning intent_alignment as misaligned, no_mismatch_detected, inconclusive or not_provided
  • A policy gate separate from the score: a confirmed misaligned result returns DENY with the reason intent_inconsistent_destination, and thin identity evidence on a high-impact claim returns DENY with insufficient_service_verification — the risk score is unchanged in both cases
  • Both tools run either synchronously or as a task: include the task parameter and you get a taskId and a pollInterval back, then poll with tasks/get and tasks/result
  • Compatibility tools for clients that cannot call native Tasks methods — url_scanner_async_scan, url_scanner_async_scan_with_intent, url_scanner_async_task_status, url_scanner_async_task_result
  • Client libraries that skip the protocol entirely: preclick for Python 3.10+ and @cybrlab/preclick-mcp-client for Node.js 20+, both exposing scan(url) and scanWithIntent(url, intent) with polling and retries handled

Requirements

Nothing to install. Add https://preclick.ai/mcp as a streamable HTTP server. The hosted trial allows up to 100 requests a day with no API key; past that you send one as an X-API-Key header, provisioned by contacting CybrLab. The hosted deployment is stateless, so a client probing GET /mcp for an SSE stream gets HTTP 405 — treat that as "no stream here" and keep using POST. Synchronous calls have a bounded 90-second server wait, and tasks/result blocks for 30, after which you get a taskId and a poll interval to continue with. The service is for URLs you are authorized to assess.

Setup effort

Paste a URL — add the endpoint to your client

See installation options