unphurl

 _   _ _   _ ____  _   _ _   _ ____  _
| | | | \ | |  _ \| | | | | | |  _ \| |
| | | |  \| | |_) | |_| | | | | |_) | |
| |_| | |\  |  __/|  _  | |_| |  _ <| |___
 \___/|_| \_|_|   |_| |_|\___/|_| \_\_____|

URL intelligence from the terminal. One URL in, structured signals out.

Unphurl analyses any URL across 7 dimensions and 25 configurable signals. It tells you the age of the domain, whether it impersonates a known brand, if SSL is valid, if the domain is parked, how the redirect chain behaves, and whether it can receive email. You get a risk score from 0 to 100 built from raw signals, not opinions.

AI agents have hands to grab URLs. Unphurl gives them eyes.

Why it exists

Most URL security tools are built for security teams. Dashboards, threat feeds, enterprise pricing. Unphurl is built for developers, AI agents, and anyone who works in a terminal.

No dashboard. No login portal. npx unphurl and you're checking URLs.

What you get back

Every check returns signals across 7 dimensions:

Dimension	What it tells you
Redirect behaviour	Full chain (up to 10 hops), shortener detection, stopped reasons
Brand impersonation	Levenshtein + homoglyph analysis against 150+ brands
Domain intelligence	Age, registrar, expiration, status codes, nameservers (via RDAP)
SSL/TLS	Real handshake validation from Cloudflare's edge
Parked detection	4-layer check: registrar pages, for-sale, empty content, parking services
URL structure	Length, path depth, subdomain count, entropy, IP detection, encoded chars
DNS enrichment	MX record existence (can the domain receive email?)

Every signal is business intelligence. Domain age tells you how established a company is. No MX record means they can't receive email. Expiring domains mean a business might be shutting down. Parked detection tells you if a business is real. Redirect chains reveal middlemen and tracking.

What it costs

Every new account gets 20 free pipeline check credits. Most lookups are free. Known domains (Tranco Top 100K) and previously analysed domains return cached results at no cost. You only pay when an unknown domain runs through the full pipeline for the first time.

Package	Credits	Price	Per check
Starter	100	$9	$0.090
Standard	500	$39	$0.078
Pro	2,000	$99	$0.050
Scale	10,000	$399	$0.040

One-time purchases, no subscriptions. In typical use, 95-99% of URLs resolve free.

Install

npx unphurl https://example.com

Or install globally:

npm install -g unphurl

Quick start

# Sign up (get your API key)
unphurl signup --email [e-mail] --name "Your Name"

# Set your key
export UNPHURL_API_KEY=uph_your_key_here

# Check a URL
unphurl https://suspicious-domain.xyz

# Check 500 URLs from a file
unphurl --batch urls.txt

# Output JSON for piping
unphurl https://example.com --json | jq '.score'

Commands

Check URLs

# Single URL
unphurl https://suspicious-domain.xyz

# Batch check from file (one URL per line, # comments ignored)
unphurl --batch urls.txt

# Use a custom scoring profile
unphurl https://example.com --profile cold-email

# Raw JSON output
unphurl https://example.com --json

Filtering batch results

# Clean URLs (score under 25)
unphurl --batch urls.txt --json | jq -r '.results[] | select(.result.score < 25) | .url' > clean.txt

# Flagged URLs (score 50+)
unphurl --batch urls.txt --json | jq -r '.results[] | select(.result.score >= 50) | .url' > flagged.txt

# Export as CSV
unphurl --batch urls.txt --json | jq -r '.results[] | [.url, .result.score, .result.domain, .result.signals.phishing.is_phishing] | @csv' > results.csv

Account management

# Create an account
unphurl signup --email [e-mail] --name "Your Name"
unphurl signup --email [e-mail] --name "Your Name" --company "Acme Inc"

# View account info
unphurl account

# Rotate your API key (new key shown once, old key revoked immediately)
unphurl account rotate-key

# Delete your account permanently
unphurl account delete --confirm

Credits and billing

# Check your credit balance
unphurl --balance

# View available packages
unphurl pricing

# Buy pipeline checks (opens Stripe checkout)
unphurl purchase pkg_100

Scoring profiles

Profiles let you weight signals differently for different jobs. A security bot cares about brand impersonation. A cold email tool cares about parked domains and missing MX records. Create profiles for each use case.

# View all 24 default scoring weights
unphurl profiles defaults

# Create a custom profile (only include weights you want to change)
unphurl profiles create cold-email --weights '{"parked":30,"no_mx_record":20,"ssl_invalid":15}'

# List your profiles
unphurl profiles

# Show a profile with merged defaults
unphurl profiles show cold-email

# Delete a profile
unphurl profiles delete cold-email

History and stats

# View check history
unphurl history
unphurl history --page 2 --limit 50

# View usage statistics
unphurl stats
unphurl stats --json

Authentication

Set your API key as an environment variable:

export UNPHURL_API_KEY=uph_your_key_here

Or pass it directly:

unphurl https://example.com --key uph_your_key_here

Output options

By default, output is coloured for readability. To disable:

unphurl https://example.com --no-color
NO_COLOR=1 unphurl https://example.com

Use --json on any command for machine-readable JSON output.

How billing works

• A positive credit balance is required for all checks, even free lookups. Free lookups don't deduct credits, but you need at least 1 credit on your account.
• Known domains (Tranco Top 100K like google.com, amazon.com): free, instant.
• Cached domains (analysed recently by anyone): free, instant.
• Unknown domains (first-time analysis): 1 credit, runs the full 7-dimension pipeline.
• Batch checks deduct credits upfront for unknowns. If you don't have enough, the batch is rejected with a summary showing exactly how many credits you need.
• Failed pipeline checks are automatically refunded.

Build a business on it

Unphurl costs you $0.04-$0.09 per check. A website link audit takes 15 minutes and uses 50-100 credits. Charge $150-$500 per audit. The math works.

Service ideas: link health audits, lead list verification, SEO backlink audits, newsletter link monitoring, vendor vetting reports, brand protection monitoring.

Also available as

• MCP Server for AI tools: npx -y @unphurl/mcp-server (Claude Code, Cowork, ChatGPT, Cursor, Windsurf)
• Hosted MCP for Claude Cowork: mcp.unphurl.com
• REST API: api.unphurl.com
• Website: unphurl.com
• Visual guides: unphurl.com/getting-started-guides

License

MIT