URL Threat Check

URL threat screening for agents that click links. Layer 1 — structural heuristics that catch most commodity phishing: IP-literal hosts, punycode/homoglyph hosts (xn--), embedded credentials (user@host tricks), plain-http, known URL shorteners, deep subdomain nesting, excessive length or percent-encoding. Layer 2 — a safe server-side redirect trace: the URL is followed hop by hop (max 5) with SSRF protection at every step and no body execution, reporting each hop's status and flagging redirects that land on a different host than they started (URLs whose redirect chain dives into private network space are flagged hard). Layer 3 — when a free abuse.ch Auth-Key is configured, the URL is checked against URLhaus, the live malware-distribution database; a listing raises the score to high with the threat type and reference link. Output is a 0-100 risk score, clear/review/high verdict and named flags. Honest scope: this is heuristic and public-threat-data screening, not sandbox detonation — a clear result is not proof of safety.

$0.01

USDC per call · x402

Endpoint

POST /v1/security/url-threat

MCP name

agentbit.url_threat_check

Status

active

Latency / uptime (7d)

297 ms · 100%

Call with x402

1. Send the request. 2. Receive 402 with accepts[]. 3. Sign the payment and retry with the X-PAYMENT header.

curl -X POST https://agentbit.app/v1/security/url-threat \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://bit.ly/3example"}'

Input schema

{
    "type": "object",
    "properties": {
        "url": {
            "type": "string",
            "description": "Absolute http(s) URL to screen"
        }
    },
    "required": [
        "url"
    ]
}

Output schema

{
    "type": "object",
    "properties": {
        "url": {
            "type": "string"
        },
        "host": {
            "type": "string"
        },
        "risk_score": {
            "type": "integer"
        },
        "risk": {
            "type": "string",
            "enum": [
                "clear",
                "review",
                "high"
            ]
        },
        "flags": {
            "type": "array",
            "items": {
                "type": "string"
            }
        },
        "redirect_trace": {
            "type": [
                "object",
                "null"
            ]
        },
        "urlhaus": {
            "type": "object"
        },
        "disclaimer": {
            "type": "string"
        }
    }
}

Code examples

// JavaScript (x402-fetch)
import { wrapFetchWithPayment } from "x402-fetch";
const fetchWithPay = wrapFetchWithPayment(fetch, wallet);
const r = await fetchWithPay("https://agentbit.app/v1/security/url-threat", {
  method: "POST",
  headers: {"Content-Type": "application/json"},
  body: JSON.stringify({"url":"https://bit.ly/3example"})
});
console.log(await r.json());

# Python (x402 client)
from x402.clients.requests import x402_requests
s = x402_requests(account)
r = s.post("https://agentbit.app/v1/security/url-threat",
  json={"url":"https://bit.ly/3example"})
print(r.json())

// PHP
$r = Http::withHeaders(['X-PAYMENT' => $signedPayment])
  ->post('https://agentbit.app/v1/security/url-threat',
    array (
  'url' => 'https://bit.ly/3example',
));
$data = $r->json();