🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP
Sign In

@unphurl/mcp-server

Package Overview
Dependencies
Maintainers
1
Versions
9
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@unphurl/mcp-server - npm Package Compare versions

Comparing version
0.1.1
to
0.1.2
+1
-1
package.json
{
"name": "@unphurl/mcp-server",
"version": "0.1.1",
"version": "0.1.2",
"description": "Unphurl domain intelligence MCP server — check URLs for security and quality signals from any AI tool",

@@ -5,0 +5,0 @@ "type": "module",

+96
-35

@@ -1,13 +0,28 @@

<p align="center">
<img src="unphurl-logo.png" alt="Unphurl" width="80" />
</p>
```
_ _ _ _ ____ _ _ _ _ ____ _
| | | | \ | | _ \| | | | | | | _ \| |
| | | | \| | |_) | |_| | | | | |_) | |
| |_| | |\ | __/| _ | |_| | _ <| |___
\___/|_| \_|_| |_| |_|\___/|_| \_\_____|
```
# @unphurl/mcp-server
**URL intelligence for AI tools. 13 MCP tools. 23 signals. 7 dimensions.**
Domain intelligence for AI tools. Unphurl analyses URLs across seven dimensions (redirect behaviour, brand impersonation, domain intelligence via RDAP, SSL/TLS validity, parked domain detection, URL structural analysis, and DNS enrichment) and returns structured signals with a configurable risk score. 23 scoring weights, all customizable per use case. One URL in, structured intelligence out. Your agent decides what to do with it.
Give your AI agent eyes for URLs. Unphurl analyses any URL across 7 dimensions (redirect behaviour, brand impersonation, domain age, SSL/TLS, parked detection, URL structure, DNS enrichment) and returns structured signals with a configurable 0-100 risk score. Signals, not verdicts. Your agent decides what to do with them.
Works with Claude Code, Claude Desktop, Claude Cowork, ChatGPT desktop, Cursor, Windsurf, and any MCP-compatible tool.
## What it costs
Every new account gets **3 free pipeline check credits** to test with real URLs. Most lookups are free. Known domains (Tranco Top 100K) and previously analysed domains return cached results at no cost. You only pay when an unknown domain runs through the full analysis pipeline. Packages start at $9 for 100 pipeline checks (one-time purchase, no subscription). In typical use, 95-99% of URLs resolve free.
Every new account gets **3 free pipeline check credits**. Most lookups are free. Known domains (Tranco Top 100K) and previously analysed domains return cached results at no cost. You only pay when an unknown domain runs through the full pipeline.
| Package | Credits | Price | Per check |
|---------|---------|-------|-----------|
| Starter | 100 | $9 | $0.090 |
| Standard | 500 | $39 | $0.078 |
| Pro | 2,000 | $99 | $0.050 |
| Scale | 10,000 | $399 | $0.040 |
One-time purchases, no subscriptions. In typical use, 95-99% of URLs resolve free.
## Quick start

@@ -35,21 +50,47 @@

The AI can create one for you. Just ask it to sign up for Unphurl. The `signup` tool works without an API key. After signup, add the key to your MCP configuration and restart.
The AI can create one for you. Just ask: *"Sign up for Unphurl."* The `signup` tool works without an API key. After signup, add the key to your MCP configuration and restart.
### 3. Optional: custom API URL
### 3. Start checking URLs
For local development or staging, set `UNPHURL_API_URL` in the env block. Defaults to `https://api.unphurl.com`.
Just talk to your AI:
## Tools
> "Check https://suspicious-domain.xyz"
| Tool | Description | Auth |
> "Batch check all URLs in this spreadsheet"
> "Create a scoring profile called 'lead-qual' that weights parked domains at 30 and no MX record at 20"
> "Check my credit balance"
No commands to memorize. No syntax to learn. Your AI handles the tool calls.
## What you get back
Every check returns signals across **7 dimensions**:
| Dimension | What it tells you |
|-----------|-------------------|
| **Redirect behaviour** | Full chain (up to 10 hops), shortener detection, stopped reasons |
| **Brand impersonation** | Levenshtein + homoglyph analysis against 150+ brands |
| **Domain intelligence** | Age, registrar, expiration, status codes, nameservers (via RDAP) |
| **SSL/TLS** | Real handshake validation from Cloudflare's edge |
| **Parked detection** | 4-layer check: registrar pages, for-sale, empty content, parking services |
| **URL structure** | Length, path depth, subdomain count, entropy, IP detection, encoded chars |
| **DNS enrichment** | MX record existence (can the domain receive email?) |
Every signal is business intelligence. Domain age tells you how established a company is. No MX record means they can't receive email. Expiring domains mean a business might be shutting down. Combined with your AI's ability to process in bulk and output to spreadsheets, it becomes a lightweight due diligence engine.
## 13 Tools
| Tool | What it does | Auth |
|------|-------------|------|
| `signup` | Create a new account, get an API key | No |
| `resend_verification` | Resend verification email (rate limited 3/hour) | Yes |
| `check_url` | Check a single URL for security/quality signals | Yes |
| `resend_verification` | Resend verification email (3/hour limit) | Yes |
| `check_url` | Check a single URL across all 7 dimensions | Yes |
| `check_urls` | Batch check up to 500 URLs (handles async polling automatically) | Yes |
| `list_profiles` | List custom scoring profiles | Yes |
| `create_profile` | Create or update a scoring profile | Yes |
| `list_profiles` | List your custom scoring profiles | Yes |
| `create_profile` | Create or update a scoring profile with custom weights | Yes |
| `delete_profile` | Delete a scoring profile | Yes |
| `show_defaults` | Show all 23 scoring signals with default weights | No |
| `get_balance` | Check pipeline check credit balance | Yes |
| `get_balance` | Check your pipeline check credit balance | Yes |
| `get_stats` | View usage statistics and score threshold counts | Yes |

@@ -60,16 +101,34 @@ | `get_pricing` | Show available credit packages and pricing | No |

## How billing works
## Power moves
- A positive credit balance is required for all check requests, even for free lookups (Tranco and cached domains). Free lookups don't deduct credits, but you need at least 1 credit on your account.
- Batch checks (`check_urls`): credits for all unknown URLs are deducted upfront. If you don't have enough credits for every unknown in the batch, the entire batch is rejected. You still get a smart summary showing how many URLs are known, cached, and unknown, and exactly how many credits you need to purchase.
- Failed pipeline checks are automatically refunded. If the pipeline fails completely and returns zero signals, the credit is restored. Partial results (some signals succeeded, some timed out) are not refunded since you received intelligence.
### Batch check + filter
## Filtering batch results
> "Check these 500 URLs. Give me two lists: the clean ones (score under 25) and the flagged ones (score 50 or higher). Export both as CSV."
After a batch check with `check_urls`, ask your AI to filter the results:
Your AI gets the batch results, filters by score, and outputs the lists. No code, no scripting.
> "Check these 500 URLs. Give me two lists: the clean ones (score under 25) and the flagged ones (score 50 or higher). Export both as CSV."
### Custom scoring profiles
The agent gets the batch results, filters by score, and outputs the lists you need. No code, no jq, no scripting. This is one of the advantages of the MCP path: your AI is the filter.
Different jobs need different weights. A security bot cares about brand impersonation. A cold email tool cares about parked domains and missing MX records.
> "Create a profile called 'cold-email' that weights parked at 30, no_mx_record at 20, and domain_age_7 at 25. Then batch check my lead list using that profile."
### Combine with other tools
Unphurl inside an AI chat combines with everything else your agent has access to:
- **Spreadsheets**: Read a CRM export, batch-check every URL, write results back with risk scores
- **Web scraping**: Scrape a competitor's partner page, check every link for health
- **Documents**: Generate a branded PDF audit report from the results
- **Scheduled tasks**: "Check my critical URLs every Monday morning"
## How billing works
- A positive credit balance is required for all checks, even free lookups.
- **Known domains** (google.com, amazon.com, etc.): free, instant.
- **Cached domains** (analysed recently by anyone): free, instant.
- **Unknown domains** (first-time analysis): 1 credit each.
- Batch checks deduct credits upfront for unknowns. If you don't have enough, you get a summary showing exactly how many credits you need.
- Failed pipeline checks are automatically refunded.
## Companion skill

@@ -79,5 +138,5 @@

**If you use Claude Cowork or Claude Desktop:** Just ask Claude: "Install the Unphurl URL safety skill." Claude can set it up for you.
**Claude Cowork or Claude Desktop:** Just ask: *"Install the Unphurl URL safety skill."*
**If you use Claude Code, Cursor, or another developer tool:**
**Claude Code, Cursor, or other dev tools:**

@@ -92,16 +151,18 @@ ```bash

The skill teaches the agent to:
- Check unfamiliar URLs before recommending them
- Use batch checking for multiple URLs (more efficient)
- Handle zero-credit situations gracefully
- Skip well-known domains that don't need checking
## Build a business on it
## Links
Unphurl costs you $0.04-$0.09 per check. A website link audit takes 15 minutes and uses 50-100 credits. Charge $150-$500 per audit.
- [API Documentation](https://unphurl.com/docs)
- [CLI Tool](https://www.npmjs.com/package/unphurl)
- [Website](https://unphurl.com)
Service ideas: link health audits, lead list verification, SEO backlink audits, newsletter link monitoring, vendor vetting reports, brand protection monitoring, influencer vetting.
## Also available as
- **CLI**: `npx unphurl` ([npm](https://www.npmjs.com/package/unphurl))
- **Hosted MCP** for Claude Cowork (no local install): [mcp.unphurl.com](https://mcp.unphurl.com)
- **REST API**: [api.unphurl.com](https://api.unphurl.com)
- **Website**: [unphurl.com](https://unphurl.com)
- **Visual guides**: [unphurl.com/getting-started-guides](https://unphurl.com/getting-started-guides)
## License
MIT