Content
[](https://smithery.ai/servers/OjasKord/url-safety-validator-mcp)
# URL Safety Validator MCP
[](https://toolrank.dev/ranking)
**Stop your agent from fetching a dangerous URL before it's too late.**
Agents that process emails, scrape pages, or consume API responses encounter URLs from untrusted sources constantly. This server gives your agent a single call to gate every URL before it proceeds — returning a SAFE/SUSPICIOUS/DANGEROUS verdict backed by Google Web Risk, Google Safe Browsing, and AI analysis.
---
## What It Does
One tool: `check_url`. One call returns:
- **Verdict:** SAFE / SUSPICIOUS / DANGEROUS
- **AI trust score:** 0–100 (0 = definitely dangerous, 100 = definitely safe)
- **Threat categories:** phishing, malware, unwanted_software, typosquatting, newly_registered, suspicious_redirect, brand_impersonation
- **SSL status:** valid or not
- **Domain age:** registration date and age in days
- **Redirect chain flag:** detected from URL parameters
- **Database signals:** raw results from Google Web Risk and Google Safe Browsing
- **AI reasoning:** 2–3 sentence plain-English explanation
- **AI confidence:** HIGH / MEDIUM / LOW
AI-powered analysis — NOT a simple database lookup.
---
## When to Call This Tool
Call `check_url` BEFORE your agent:
- Fetches content from a URL found in an email
- Visits a link extracted from a scraped page or document
- Passes a URL to a browser tool or web scraper
- Stores or forwards a URL from any untrusted source
- Approves any outbound link in a content pipeline
If the verdict is DANGEROUS — halt. If SUSPICIOUS — flag for review. If SAFE — proceed.
---
## Data Sources
| Source | Type | Coverage |
|---|---|---|
| Google Web Risk | Commercial API | Malware, phishing, unwanted software |
| Google Safe Browsing | Free | Malware, phishing, unwanted software (fallback when Web Risk key absent) |
| RDAP | Free | Domain registration date |
| Anthropic Claude | AI | Trust scoring and reasoning synthesis |
---
## Pricing
| Tier | Calls | Price |
|---|---|---|
| Free | 10/month | No API key needed |
| Starter | 500-call bundle | $20 |
| Pro | 2,000-call bundle | $70 |
---
## Remote Usage (No Install)
```
https://url-safety-validator-mcp-production.up.railway.app
```
Add `x-api-key: YOUR_KEY` header for Pro/Enterprise tiers. Leave blank for free tier.
---
## Local Install (stdio)
```bash
npm install -g url-safety-validator-mcp
```
```json
{
"mcpServers": {
"url-safety-validator": {
"command": "url-safety-validator-mcp",
"env": {
"ANTHROPIC_API_KEY": "your-key",
"GOOGLE_WEB_RISK_API_KEY": "your-key"
}
}
}
}
```
---
## Harness Integration
### Claude Code / Claude Desktop (.mcp.json)
```json
{
"mcpServers": {
"url-safety-validator": {
"type": "http",
"url": "https://url-safety-validator-mcp-production.up.railway.app"
}
}
}
```
### LangChain (Python)
```python
from langchain_mcp_adapters.client import MultiServerMCPClient
client = MultiServerMCPClient({
"url-safety-validator": {
"url": "https://url-safety-validator-mcp-production.up.railway.app",
"transport": "http"
}
})
tools = await client.get_tools()
```
### OpenAI Agents SDK (Python)
```python
from agents import Agent, HostedMCPTool
agent = Agent(
name="Assistant",
tools=[HostedMCPTool(tool_config={
"type": "mcp",
"server_label": "url-safety-validator",
"server_url": "https://url-safety-validator-mcp-production.up.railway.app",
"require_approval": "never"
})]
)
```
### LangGraph
Same as LangChain above — langchain-mcp-adapters works with LangGraph natively.
---
## Example Response
```json
{
"url": "https://suspicious-domain.xyz/login",
"hostname": "suspicious-domain.xyz",
"verdict": "DANGEROUS",
"trust_score": 4,
"ssl_valid": true,
"domain_age_days": 12,
"redirect_chain_detected": false,
"threat_categories": ["phishing", "newly_registered"],
"reasoning": "Domain registered 12 days ago and impersonates a financial institution's login page. Google Web Risk flags this as SOCIAL_ENGINEERING.",
"ai_confidence": "HIGH",
"analysis_type": "AI-powered -- NOT a simple database lookup"
}
```
---
## Legal
Results are for informational purposes only. Verdict is a risk signal — not a guarantee of safety or danger. We do not log or store your query content. Full terms: kordagencies.com/terms.html
Provider: Kord Agencies Pte Ltd, Singapore.
