fast_check answers from what has already been scanned and returns immediately; new_scan actually renders the page and takes most of a minute. Putting them behind different names means an agent triaging a list of URLs does not accidentally queue a full scan for every one. The saved-query layer is what turns this from lookup into monitoring — a CQL filter stored once and re-run, rather than a query string an agent has to reconstruct correctly each time.
A client for the urlDNA threat-intelligence platform, exposing scanning, corpus search, saved queries and brand monitoring. The same toolset runs over stdio for a desktop client or over Streamable HTTP for a hosted deployment.
- An instant check on whether a URL has already been scanned, answering SAFE, MALICIOUS or UNRATED without paying for a new scan (fast_check).
- A full scan submitted and waited on — roughly 30 to 60 seconds — and any completed scan retrieved by its ID (new_scan, get_scan).
- Search across the scan corpus in urlDNA's own query language, spanning domain, IP, technology and the malicious flag, with AND and OR expressions and pagination — where the second page onward requires a premium account (search).
- Saved queries as objects you manage rather than strings you retype: listed, read with their filters, created from one or more conditions, replaced wholesale, deleted, and run to return every matching scan (list_queries, get_query, create_query, update_query, delete_query, query_scans).
- Brand monitoring: the available brands filtered by name and by visibility across all, free, premium or your own, one brand's full detail, and every scan associated with a brand with further query filtering on top (list_brands, get_brand, brand_scans).
- The platform's own OpenAPI specification and documentation, fetched as a tool call so the agent can look a field up instead of guessing (search_docs).
A urlDNA API key, sent as an x-api-key header or environment value. There is a hosted server at https://mcp.urldna.io/ that any Streamable HTTP client can point at with nothing installed; running it yourself takes uv and a clone of the repository, with PORT and MCP_PATH controlling where the HTTP mode binds. Paging past the first page of search results, and some brand visibility filters, need a premium account.