# Unphurl

> URL intelligence for AI agents. One URL in, structured security and data quality signals out.

- **Type:** MCP server
- **Install:** `agentstack add mcp-123ergo-unphurl-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [123Ergo](https://agentstack.voostack.com/s/123ergo)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.5
- **License:** MIT
- **Upstream author:** [123Ergo](https://github.com/123Ergo)
- **Source:** https://github.com/123Ergo/unphurl-mcp

## Install

```sh
agentstack add mcp-123ergo-unphurl-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

```
 _   _ _   _ ____  _   _ _   _ ____  _
| | | | \ | |  _ \| | | | | | |  _ \| |
| | | |  \| | |_) | |_| | | | | |_) | |
| |_| | |\  |  __/|  _  | |_| |  _  "Check https://suspicious-domain.xyz"

> "Batch check all URLs in this spreadsheet"

> "Create a scoring profile called 'lead-qual' that weights parked domains at 30 and no MX record at 20"

> "Check my credit balance"

No commands to memorize. No syntax to learn. Your AI handles the tool calls.

## What you get back

Every check returns signals across **7 dimensions**:

| Dimension | What it tells you |
|-----------|-------------------|
| **Redirect behaviour** | Full chain (up to 10 hops), shortener detection, stopped reasons |
| **Brand impersonation** | Levenshtein + homoglyph analysis against 150+ brands |
| **Domain intelligence** | Age, registrar, expiration, status codes, nameservers (via RDAP) |
| **SSL/TLS** | Real handshake validation from Cloudflare's edge |
| **Parked detection** | 4-layer check: registrar pages, for-sale, empty content, parking services |
| **URL structure** | Length, path depth, subdomain count, entropy, IP detection, encoded chars |
| **DNS enrichment** | MX record existence (can the domain receive email?) |

Every signal is business intelligence. Domain age tells you how established a company is. No MX record means they can't receive email. Expiring domains mean a business might be shutting down. Combined with your AI's ability to process in bulk and output to spreadsheets, it becomes a lightweight due diligence engine.

## 16 Tools

| Tool | What it does | Auth |
|------|-------------|------|
| `signup` | Create a new account, get an API key | No |
| `resend_verification` | Resend verification email (3/hour limit) | Yes |
| `check_url` | Check a single URL across all 7 dimensions | Yes |
| `check_urls` | Batch check up to 500 URLs (handles async polling automatically) | Yes |
| `list_profiles` | List your custom scoring profiles | Yes |
| `create_profile` | Create or update a scoring profile with custom weights | Yes |
| `delete_profile` | Delete a scoring profile | Yes |
| `show_defaults` | Show all 25 scoring signals with default weights | No |
| `get_balance` | Check your pipeline check credit balance | Yes |
| `get_stats` | View usage statistics and score threshold counts | Yes |
| `get_pricing` | Show available credit packages and pricing | No |
| `purchase` | Purchase credits (returns Stripe Checkout URL) | Yes |
| `check_history` | View recent URL check history | Yes |
| `list_allowlist` | List trusted domains that suppress scoring amplifiers | Yes |
| `add_to_allowlist` | Add domains to your trusted allowlist (up to 100 per request) | Yes |
| `remove_from_allowlist` | Remove domains from your trusted allowlist | Yes |

## Power moves

### Batch check + filter

> "Check these 500 URLs. Give me two lists: the clean ones (score under 25) and the flagged ones (score 50 or higher). Export both as CSV."

Your AI gets the batch results, filters by score, and outputs the lists. No code, no scripting.

### Custom scoring profiles

Different jobs need different weights. A security bot cares about brand impersonation. A cold email tool cares about parked domains and missing MX records.

> "Create a profile called 'cold-email' that weights parked at 30, no_mx_record at 20, and domain_age_7 at 25. Then batch check my lead list using that profile."

### Combine with other tools

Unphurl inside an AI chat combines with everything else your agent has access to:

- **Spreadsheets**: Read a CRM export, batch-check every URL, write results back with risk scores
- **Web scraping**: Scrape a competitor's partner page, check every link for health
- **Documents**: Generate a branded PDF audit report from the results
- **Scheduled tasks**: "Check my critical URLs every Monday morning"

## How billing works

- A positive credit balance is required for all checks, even free lookups.
- **Known domains** (google.com, amazon.com, etc.): free, instant.
- **Cached domains** (analysed recently by anyone): free, instant.
- **Unknown domains** (first-time analysis): 1 credit each.
- Batch checks deduct credits upfront for unknowns. If you don't have enough, you get a summary showing exactly how many credits you need.
- Failed pipeline checks are automatically refunded.

## Companion skill

The `check-url-safety` skill teaches your AI to proactively check URLs before following or recommending them, without being asked.

**Claude Cowork or Claude Desktop:** Just ask: *"Install the Unphurl URL safety skill."*

**Claude Code, Cursor, or other dev tools:**

```bash
# Global (all projects)
cp node_modules/@unphurl/mcp-server/skills/check-url-safety.md ~/.claude/skills/

# Or for a specific project
cp node_modules/@unphurl/mcp-server/skills/check-url-safety.md .claude/skills/
```

## Build a business on it

Unphurl costs you $0.04-$0.09 per check. A website link audit takes 15 minutes and uses 50-100 credits. Charge $150-$500 per audit.

Service ideas: link health audits, lead list verification, SEO backlink audits, newsletter link monitoring, vendor vetting reports, brand protection monitoring, influencer vetting.

## Also available as

- **CLI**: `npx unphurl` ([npm](https://www.npmjs.com/package/unphurl))
- **Hosted MCP** for Claude Cowork (no local install): [mcp.unphurl.com](https://mcp.unphurl.com)
- **REST API**: [api.unphurl.com](https://api.unphurl.com)
- **Website**: [unphurl.com](https://unphurl.com)
- **Visual guides**: [unphurl.com/getting-started-guides](https://unphurl.com/getting-started-guides)

## License

MIT

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [123Ergo](https://github.com/123Ergo)
- **Source:** [123Ergo/unphurl-mcp](https://github.com/123Ergo/unphurl-mcp)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.5 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.5** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-123ergo-unphurl-mcp
- Seller: https://agentstack.voostack.com/s/123ergo
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.