Skip to main content
Glama
Vinaysati
by Vinaysati

urlhausLookup

Read-only

Check a URL or host against URLhaus (abuse.ch) to identify malware distribution and abuse listings; supply one URL or hostname/IP.

Instructions

Look up a URL or host in URLhaus (abuse.ch). Provide either a full URL for URL lookup or a hostname/IP for host lookup. Requires ABUSECH_AUTH_KEY.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlNoFull URL to look up (e.g., http://evil.com/malware.exe); provide exactly one of url or host
hostNoHostname or IP to look up (e.g., evil.com or 1.2.3.4); provide exactly one of url or host

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.3.0

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, and destructiveHint, so the safety profile is covered. The description adds a non-obvious operational requirement — 'Requires ABUSECH_AUTH_KEY' — which is exactly the kind of credential/auth context the annotations cannot express, and it clarifies that the two input modes trigger different lookups. It stops short of describing return content or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with the purpose front-loaded, followed by the input-mode rule and the auth prerequisite. Every sentence carries information; no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read-only lookup with full annotation coverage, the description is nearly complete: purpose, both input modes, exclusivity, and the auth prerequisite are all present. The only gap is the absence of any indication of what the lookup returns, which matters slightly since no output schema exists, but the agent can still call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and both parameters already document their format and the 'exactly one of url or host' constraint. The description reinforces that mutual exclusivity but adds no syntax, format, or semantics beyond what the schema already carries, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Look up a URL or host in URLhaus (abuse.ch)') and names both lookup modes, so the agent immediately understands the operation. It does not explicitly distinguish itself from the sibling urlhausTag, which is a tag-based query against the same source, so the differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains how to invoke it (full URL for URL lookup, hostname/IP for host lookup) but never states when to prefer this tool over siblings like urlhausTag or the other threat-intel lookups. Usage is implied by the input shape rather than declared, leaving the agent to infer the routing decision.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.