@unphurl/mcp-server - npm Package Compare versions

Comparing version 0.2.2 to 0.2.3

dist/defaults.js

@@ -110,2 +110,7 @@ // Hardcoded default scoring weights and signal descriptions
     {
+        key: "js_fragment_redirect",
+        default_weight: 25,
+        description: "HTML page on object storage (S3, GCS, Azure Blob) reads the URL fragment client-side and redirects the visitor to the decoded destination — a common phishing delivery technique",
+    },
+    {
         key: "expiring_soon",
@@ -126,2 +131,2 @@ default_weight: 10,
 ];
-export const DEFAULTS_NOTE = "Profiles override specific weights. Signals not in a profile use these defaults. 24 configurable signals plus suspicious_tld (+3 points) which is internal only and not configurable.";
+export const DEFAULTS_NOTE = "Profiles override specific weights. Signals not in a profile use these defaults. 25 configurable signals plus suspicious_tld (+3 points) which is internal only and not configurable.";

dist/tools/profiles.js

@@ -14,3 +14,3 @@ // Profile tools — list, create, delete, and show defaults
 
-Profiles only override specific weights. Any signal not specified in a profile uses the default weight. Use show_defaults to see all 24 signals and their default weights.`,
+Profiles only override specific weights. Any signal not specified in a profile uses the default weight. Use show_defaults to see all 25 signals and their default weights.`,
         inputSchema: {},
@@ -38,3 +38,3 @@ }, async () => {
 
-Use show_defaults to see all 24 signals with their default weights and descriptions before creating a profile. Use check_url or check_urls with the "profile" parameter to score results with this profile.
+Use show_defaults to see all 25 signals with their default weights and descriptions before creating a profile. Use check_url or check_urls with the "profile" parameter to score results with this profile.
 
@@ -57,3 +57,3 @@ Maximum 20 profiles per account. Profile name "default" is reserved.
                 .record(z.string(), z.number().int().min(0).max(1000))
-                .describe("Custom weights for scoring signals. Only include signals you want to override. Available signals: brand_impersonation (default 40), domain_age_3 (35), domain_age_7 (25), domain_age_30 (15), domain_age_90 (5), ssl_invalid (10), http_only (5), redirects_3 (10), redirects_5 (25), chain_incomplete (15), parked (10), compound (10), brand_impersonation_floor (80), url_long (3), path_deep (3), subdomain_deep (3), subdomain_excessive (5), domain_entropy_high (5), url_contains_ip (10), encoded_hostname (5), tld_redirect_change (5), expiring_soon (10), domain_status_bad (15), no_mx_record (5)."),
+                .describe("Custom weights for scoring signals. Only include signals you want to override. Available signals: brand_impersonation (default 40), domain_age_3 (35), domain_age_7 (25), domain_age_30 (15), domain_age_90 (5), ssl_invalid (10), http_only (5), redirects_3 (10), redirects_5 (25), chain_incomplete (15), parked (10), compound (10), brand_impersonation_floor (80), url_long (3), path_deep (3), subdomain_deep (3), subdomain_excessive (5), domain_entropy_high (5), url_contains_ip (10), encoded_hostname (5), tld_redirect_change (5), js_fragment_redirect (25), expiring_soon (10), domain_status_bad (15), no_mx_record (5)."),
         },
@@ -99,3 +99,3 @@ }, async ({ name, weights }) => {
     server.registerTool("show_defaults", {
-        description: `Show all 24 scoring signals with their default weights and descriptions. This is the baseline scoring that applies when no custom profile is specified.
+        description: `Show all 25 scoring signals with their default weights and descriptions. This is the baseline scoring that applies when no custom profile is specified.
 
@@ -102,0 +102,0 @@ Use this to understand what each signal means and how much it contributes to the score before creating custom profiles. Profiles are sparse overrides on top of these defaults.

package.json

 {
   "name": "@unphurl/mcp-server",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "mcpName": "io.github.123Ergo/unphurl",
-  "description": "URL intelligence for AI agents and developers. Structured signals on all URLs. 16 tools, 24 signal weights. 20 free checks.",
+  "description": "URL intelligence for AI agents and developers. Structured signals on all URLs. 16 tools, 25 signal weights. 20 free checks.",
   "type": "module",
@@ -7,0 +7,0 @@ "bin": {

README.md

@@ -9,3 +9,3 @@ ```
 
-**URL intelligence for AI agents and developers. 16 MCP tools. 24 signals. 7 dimensions.**
+**URL intelligence for AI agents and developers. 16 MCP tools. 25 signals. 7 dimensions.**
 
@@ -12,0 +12,0 @@ Give your AI agent eyes for URLs. Unphurl analyses any URL across 7 dimensions (redirect behaviour, brand impersonation, domain age, SSL/TLS, parked detection, URL structure, DNS enrichment) and returns structured signals with a configurable 0-100 risk score. Signals, not verdicts. Your agent decides what to do with them.

New alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

55421

0.56%

Lines of code

908

0.55%

No dependency changes