Unphurl

skills: {'id': 'signup', 'name': 'signup', 'description': 'Create a new Unphurl account. Returns an API key (shown once, store it securely).\n\nAfter signup, the user must check their email and click the verification link. The API key won\'t work for URL checks until the email is verified. Verification link expires after 24 hours. If the link expires, use the "resend_verification" tool to request a new one.\n\nThe account starts with 20 free pipeline check credits so the user can test with real URLs. Known domain lookups (google.com, github.com, etc.) and cached domain lookups are always free. To check more unknown domains through the full analysis pipeline, the user can purchase credits via the "purchase" tool.\n\nOnce the user has their API key, they need to add it to their MCP server configuration as UNPHURL_API_KEY.\n\nThis tool does not require an API key.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'resend_verification', 'name': 'resend_verification', 'description': "Resend the email verification link for an existing Unphurl account.\n\nUse this when a user signed up but their verification link expired (links are valid for 24 hours) and they need a new one. The user's API key won't work until their email is verified.\n\nFor security, the response is always the same regardless of whether the email exists, is already verified, or was rate limited. This prevents account enumeration.\n\nRate limited to 3 requests per email per hour.\n\nThis tool does not require an API key.", 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'check_url', 'name': 'check_url', 'description': 'Check a single URL for security and data quality signals. Returns a risk score (0-100), detailed signal breakdown, and metadata.\n\nUnphurl analyses URLs across seven dimensions: redirect behaviour, brand impersonation, domain intelligence (age, registrar, expiration, status codes, nameservers via RDAP), SSL/TLS validity, parked domain detection, URL structural analysis (length, path depth, subdomain count, entropy), and DNS enrichment (MX records). The score is calculated from these signals using either default weights or a custom scoring profile.\n\nHigher scores mean more suspicious. The score is a signal, not a verdict. You decide the threshold based on the use case.\n\nBilling: Most lookups are free. Known domains (Tranco Top 100K like google.com, github.com) return instantly with score 0 at no cost. Previously analysed domains return cached signals at no cost. Only unknown domains that run through the full analysis pipeline cost 1 pipeline check credit. The response\'s meta.pipeline_check_charged field tells you whether this check consumed a credit.\n\nUse the "profile" parameter to score results with custom weights. For example, a "cold-email" profile might weight parked domains heavily while ignoring brand impersonation. Use list_profiles to see available profiles, or show_defaults to see all signal weights.\n\nIf the account has zero credits and the URL requires a full pipeline check, returns a 402 error with a link to purchase more credits.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'check_urls', 'name': 'check_urls', 'description': 'Check multiple URLs in a single batch. Returns results for all URLs, handling async processing automatically.\n\nEach URL is analysed across seven dimensions: redirect behaviour, brand impersonation, domain intelligence (age, registrar, expiration, status codes, nameservers via RDAP), SSL/TLS validity, parked domain detection, URL structural analysis, and DNS enrichment. Known and cached URLs return results immediately. Unknown URLs are queued for pipeline processing. This tool automatically polls for results until all URLs are complete or the 5-minute timeout is reached. You don\'t need to manage polling or job tracking.\n\nIf the timeout is reached before all results are complete, returns whatever is available with a clear message indicating which URLs are still processing. The user can check results later via check_history.\n\nMaximum 500 URLs per call. For larger datasets, call this tool multiple times with chunks of up to 500 URLs.\n\nBilling: Same as check_url. Known and cached domains are free. Only unknown domains running through the full pipeline cost 1 credit each. The summary shows pipeline_checks_charged (the actual number of credits consumed). If you don\'t have enough credits for the unknowns in the batch, the entire batch is rejected with a 402 error telling you exactly how many credits are needed.\n\nDuplicate URLs in the list are automatically deduplicated (processed once, charged once). Invalid URLs get individual error status without rejecting the batch.\n\nUse the "profile" parameter to score all results with custom weights.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'estimate_urls', 'name': 'estimate_urls', 'description': "Pre-flight credit estimator for a list of URLs. Returns counts + credit estimate. Free, no credits consumed.\n\nCall this before check_urls to show the user how many credits the batch will cost. Classifies each URL against three free gates:\n- tranco: URL's registrable domain is in the Tranco top 100K (trusted, treated as clean with score 0, no pipeline needed)\n- cached: URL's hostname is already in Unphurl's reputation cache (results available, no pipeline needed)\n- unknown: URL needs full pipeline analysis (costs 1 credit per URL)\n\nReturns counts for each gate plus total, credits_needed, credits_min, and credits_max. credits_min and credits_max are both equal to the unknown count in the current implementation.\n\nMaximum 500 URLs per call. Rate limit: 10 requests per minute. Does not follow redirects; classifies each URL as submitted.\n\nTypical agent flow:\n1. Collect a list of URLs\n2. Call estimate_urls to get the cost breakdown\n3. Show the user the breakdown and ask for approval\n4. On approval, call check_urls on the unknowns only", 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'list_profiles', 'name': 'list_profiles', 'description': 'List all custom scoring profiles on this account. Returns profile names and their custom weight overrides.\n\nProfiles are named weight sets that change how Unphurl scores URLs. Different use cases need different scoring. A cold email agent cares about dead domains. A security bot cares about phishing. Profiles let one account serve multiple use cases.\n\nProfiles only override specific weights. Any signal not specified in a profile uses the default weight. Use show_defaults to see all 25 signals and their default weights.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'create_profile', 'name': 'create_profile', 'description': 'Create or update a custom scoring profile. Profiles are sparse overrides: only specify the weights you want to change. Everything else keeps its default value.\n\nIf a profile with this name already exists, it is updated with the new weights (full replacement, not merge).\n\nWeights are points, not percentages. Each weight is the number of points that signal adds to the score when it fires. They don\'t need to total 100. A profile with weights totalling 90 is conservative (max possible score is 90). A profile with weights totalling 130 is aggressive (multiple signals quickly push to the cap of 100). The threshold the agent sets for action matters more than the weight totals.\n\nUse show_defaults to see all 25 signals with their default weights and descriptions before creating a profile. Use check_url or check_urls with the "profile" parameter to score results with this profile.\n\nMaximum 20 profiles per account. Profile name "default" is reserved.\n\nCommon profiles:\n- Cold email: weight parked (30), chain_incomplete (25), ssl_invalid (15) higher. Lower brand_impersonation (10).\n- Security bot: keep brand_impersonation high (40), increase domain_age_7 (30), redirects_5 (25).\n- Lead gen: weight parked (35), http_only (20), chain_incomplete (20) for dead business detection.\n- SEO audit: weight redirects_5 (30), chain_incomplete (30), parked (25) for link quality.\n\nSee the Unphurl API documentation for all 19 use case weight examples.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'delete_profile', 'name': 'delete_profile', 'description': 'Delete a custom scoring profile. This is permanent. Any future check requests using this profile name will fall back to default weights.\n\nUse list_profiles to see your current profiles before deleting.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}; uptime_30d 1.0%; p95 159.6ms; conformance: pass

How to connect

https://mcp.unphurl.com/mcp

curl -X POST https://mcp.unphurl.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'