Skip to main content
Glama

Lordevo Shop (x402 website checks)

Phishing lookalike domain check (homograph, punycode, typosquatting) ($0.002/call)

domain_lookalike
Read-onlyIdempotent

$0.002 per call (x402, USDC on Base; free trial: add "trial": true or use try_free). [Web and domain checks] Phishing lookalike domain check. Offline host-name check for phishing patterns: punycode, mixed-alphabet homographs, typo lookalikes of phished brands, brand off its official domain, risky TLD, login/wallet words. trust/2: signals with evidence, risk level low_observed_risk / elevated / high, 0-100 risk score, coverage, not_a_guarantee (a normal name says nothing about the site). < 50 ms. Method + error rates: https://shop.lordevo.com/docs/trust-methodology

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "host": "<host>"
    },
    "name": "domain_lookalike"
  }
}

Input Schema

NameRequiredDescriptionDefault
hostYesHost name to check, e.g. xn--pple-43d.com or paypa1-secure.example (a URL also works; the host part is used)
trialNoOptional. true = free if a trial call is left (3 per IP per UTC day), else the payment terms.

Output Schema

NameRequiredDescriptionDefault
hostNo
riskNo
toolNo
cacheNo
_trialNoPresent when the call was a free trial call.
schemaNo
reasonsNo
signalsNo
unicodeNo
verdictNoDeprecated alias of risk.level, removed after 2027-01-31
coverageNo
providerNo
punycodeNo
price_usdNo
risk_scoreNo
mixed_scriptNo
brand_lookalikeNo
methodology_urlNo
not_a_guaranteeNo
not_a_guarantee_textNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / trial / description
      Previous value: -"Optional. true = answer free if a trial call is left (3 per IP per UTC day); otherwise you get the payment terms."New value: +"Optional. true = free if a trial call is left (3 per IP per UTC day), else the payment terms."
  2. Changed1 schema field changed
    • changedInput schema / properties / host / description
      Previous value: -"Public host name, e.g. example.com or www.example.com (a URL also works)"New value: +"Host name to check, e.g. xn--pple-43d.com or paypa1-secure.example (a URL also works; the host part is used)"
  3. Changed2 schema fields changed
    • addedInput schema / properties / trial
      Added value: +{
      +  "description": "Optional. true = answer free if a trial call is left (3 per IP per UTC day); otherwise you get the payment terms.",
      +  "type": "boolean"
      +}
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
      +  "anyOf": [
      +    {
      +      "required": [
      +        "tool",
      +        "host",
      +        "schema",
      +        "risk",
      +        "signals",
      +        "coverage",
      +        "not_a_guarantee"
      +      ]
      +    },
      +    {
      +      "properties": {
      +        "accepts": {
      +          "type": "array"
      +        },
      +        "error": {
      +          "type": "string"
      +        },
      +        "resource": {
      +          "type": "object"
      +        },
      +        "x402Version": {
      +          "type": "integer"
      +        }
      +      },
      +      "required": [
      +        "x402Version",
      +        "accepts"
      +      ]
      +    },
      +    {
      +      "properties": {
      +        "charged": {
      +          "type": "boolean"
      +        },
      +        "error": {
      +          "type": "string"
      +        },
      +        "message": {
      +          "type": "string"
      +        }
      +      },
      +      "required": [
      +        "error"
      +      ]
      +    }
      +  ],
      +  "properties": {
      +    "_trial": {
      +      "description": "Present when the call was a free trial call.",
      +      "type": "object"
      +    },
      +    "brand_lookalike": {
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "cache": {
      +      "type": "object"
      +    },
      +    "coverage": {
      +      "properties": {
      +        "blocklist_checked": {
      +          "type": "boolean"
      +        },
      +        "checked": {
      +          "type": "array"
      +        },
      +        "failed": {
      +          "type": "array"
      +        },
      +        "not_checked": {
      +          "type": "array"
      +        },
      +        "point_in_time": {
      +          "type": "string"
      +        }
      +      },
      +      "required": [
      +        "not_checked",
      +        "blocklist_checked"
      +      ],
      +      "type": "object"
      +    },
      +    "host": {
      +      "type": "string"
      +    },
      +    "methodology_url": {
      +      "type": "string"
      +    },
      +    "mixed_script": {
      +      "type": "boolean"
      +    },
      +    "not_a_guarantee": {
      +      "const": true,
      +      "type": "boolean"
      +    },
      +    "not_a_guarantee_text": {
      +      "type": "string"
      +    },
      +    "price_usd": {
      +      "type": "number"
      +    },
      +    "provider": {
      +      "type": "string"
      +    },
      +    "punycode": {
      +      "type": "boolean"
      +    },
      +    "reasons": {
      +      "type": "array"
      +    },
      +    "risk": {
      +      "properties": {
      +        "calibration": {},
      +        "confidence": {
      +          "enum": [
      +            "low",
      +            "medium",
      +            "high"
      +          ],
      +          "type": "string"
      +        },
      +        "level": {
      +          "enum": [
      +            "low_observed_risk",
      +            "elevated",
      +            "high",
      +            "unknown"
      +          ],
      +          "type": "string"
      +        },
      +        "observed_bad_rate": {
      +          "type": [
      +            "object",
      +            "null"
      +          ]
      +        },
      +        "score": {
      +          "maximum": 100,
      +          "minimum": 0,
      +          "type": "integer"
      +        },
      +        "thresholds": {
      +          "type": "object"
      +        }
      +      },
      +      "required": [
      +        "level",
      +        "score",
      +        "confidence"
      +      ],
      +      "type": "object"
      +    },
      +    "risk_score": {
      +      "type": "integer"
      +    },
      +    "schema": {
      +      "const": "trust/2",
      +      "type": "string"
      +    },
      +    "signals": {
      +      "items": {
      +        "properties": {
      +          "basis": {
      +            "enum": [
      +              "observed",
      +              "inferred"
      +            ],
      +            "type": "string"
      +          },
      +          "direction": {
      +            "enum": [
      +              "raises",
      +              "lowers"
      +            ],
      +            "type": "string"
      +          },
      +          "evidence": {
      +            "items": {
      +              "properties": {
      +                "header": {
      +                  "type": "string"
      +                },
      +                "kind": {
      +                  "type": "string"
      +                },
      +                "observed_at": {
      +                  "type": "string"
      +                },
      +                "record": {},
      +                "snippet": {
      +                  "type": [
      +                    "string",
      +                    "null"
      +                  ]
      +                },
      +                "url": {
      +                  "type": "string"
      +                },
      +                "value": {}
      +              },
      +              "required": [
      +                "kind"
      +              ],
      +              "type": "object"
      +            },
      +            "minItems": 1,
      +            "type": "array"
      +          },
      +          "id": {
      +            "type": "string"
      +          },
      +          "severity": {
      +            "type": "string"
      +          },
      +          "title": {
      +            "type": "string"
      +          },
      +          "value": {},
      +          "weight": {
      +            "type": "number"
      +          }
      +        },
      +        "required": [
      +          "id",
      +          "direction",
      +          "weight",
      +          "basis",
      +          "evidence"
      +        ],
      +        "type": "object"
      +      },
      +      "type": "array"
      +    },
      +    "tool": {
      +      "type": "string"
      +    },
      +    "unicode": {
      +      "type": "string"
      +    },
      +    "verdict": {
      +      "deprecated": true,
      +      "description": "Deprecated alias of risk.level, removed after 2027-01-31",
      +      "enum": [
      +        "low_observed_risk",
      +        "elevated",
      +        "high",
      +        "unknown"
      +      ],
      +      "type": "string"
      +    }
      +  },
      +  "type": "object"
      +}
  4. Added

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the readOnly/idempotent annotations: discloses latency (<50 ms), the exact result shape (signals with evidence, risk level low_observed_risk/elevated/high, 0-100 score, coverage), an important caveat (not_a_guarantee — a normal name says nothing about the site), and a methodology/error-rate link. Price and trial mechanics are also spelled out, which matters for an agent deciding whether to call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but nearly every clause carries information; the offline-vs-live scoping is front-loaded. Minor waste: pricing appears in both title and description, and the trial option is stated in both description and schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema, full annotation coverage, and 100% parameter coverage, the description only has to supply selection guidance and behavioral caveats — which it does, including latency, the not_a_guarantee limitation, and a methodology reference. Nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented, including that a full URL is accepted. The description restates the trial flag and mentions punycode-style host examples but adds no syntax or validation detail the schema does not already carry; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Phishing lookalike domain check') and enumerates exactly which patterns are examined: punycode, mixed-alphabet homographs, typo lookalikes, brand off official domain, risky TLD, login/wallet words. The key differentiator from siblings like dns_lookup or url_trust — 'Offline host-name check' — is stated explicitly, so an agent can separate it from live-fetching tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clarifies the tool works offline on a host name (no network resolution implied) and routes price-sensitive callers to the alternative route ('add "trial": true or use try_free'). It does not, however, state when to prefer this over the substantial overlapping siblings (domain_intel, url_trust, security_scan_lite), leaving that comparison to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources