Skip to main content
Glama
scamverifyai

ScamVerify

check_qr

Read-onlyIdempotent

Analyze QR codes to detect potential scams by decoding and verifying URLs against threat intelligence databases for domain age, SSL, brand impersonation, and malware risks.

Instructions

Analyze a QR code image. Decodes the QR code server-side and, if it contains a URL, runs full URL verification (domain age, SSL, brand impersonation, URLhaus, ThreatFox, Google Web Risk). Useful for verifying QR codes on parking meters, restaurant menus, mail, and packages. Consumes URL quota only when a URL is found.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
image_urlNoURL of the QR code image to scan (provide either image_url or image_base64)
image_base64NoBase64-encoded QR code image (provide either image_url or image_base64). Supports data URI prefix.

Implementation Reference

  • The `check_qr` tool implementation including its registration, schema definition, and handler logic.
    // 6. check_qr
    server.tool(
      'check_qr',
      'Analyze a QR code image. Decodes the QR code server-side and, if it contains a URL, runs full URL verification (domain age, SSL, brand impersonation, URLhaus, ThreatFox, Google Web Risk). Useful for verifying QR codes on parking meters, restaurant menus, mail, and packages. Consumes URL quota only when a URL is found.',
      {
        image_url: z.string().optional().describe('URL of the QR code image to scan (provide either image_url or image_base64)'),
        image_base64: z.string().optional().describe('Base64-encoded QR code image (provide either image_url or image_base64). Supports data URI prefix.'),
      },
      {
        title: 'Scan QR Code',
        readOnlyHint: true,
        destructiveHint: false,
        idempotentHint: true,
        openWorldHint: true,
      },
      async ({ image_url, image_base64 }) => {
        try {
          const { buffer, mimeType, fileName } = await resolveImage(image_url, image_base64);
          const data = await apiMultipart('/api/v1/qr/analyze', buffer, mimeType, fileName);
          return jsonResult(data);
        } catch (err) {
          return errorResult(err instanceof Error ? err.message : 'QR analysis failed');
        }
      },
    );
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds valuable operational details beyond annotations: specific external services queried (URLhaus, ThreatFox, Google Web Risk), conditional processing logic ('if it contains a URL'), and resource consumption rules ('Consumes URL quota only when a URL is found'). Does not contradict annotations (readOnlyHint=true aligns with 'Analyze/Decodes/verification' operations).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with zero waste. First sentence front-loads the core action and conditional logic. Second provides usage context. Third states resource constraints. Every sentence earns its place with specific, non-redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Comprehensive for the processing logic (decoding + verification pipeline) despite lacking output schema. Lists specific threat intelligence sources checked. Minor gap: does not describe return value structure or content (e.g., decoded string format, threat score object) which would help since no output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents both image_url and image_base64 parameters. The description mentions 'QR code image' generally but does not add parameter-specific semantics (e.g., format requirements, size limits) beyond what the schema already provides. Baseline 3 is appropriate for high-coverage schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource combination ('Analyze a QR code image') with clear scope. Distinguishes from siblings like check_url by specifying QR code decoding happens first, followed by conditional URL verification. Lists specific verification checks (domain age, SSL, brand impersonation, etc.) that define the tool's unique capabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides concrete usage contexts ('parking meters, restaurant menus, mail, and packages') that clarify when to use this tool. However, lacks explicit guidance on when to use check_url directly versus this tool (e.g., 'if you already have a URL string, use check_url instead').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/scamverifyai/scamverify-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server