Skip to main content
Glama
scamverifyai

ScamVerify

check_url

Read-onlyIdempotent

Analyze website URLs for security threats by checking domain age, SSL certificates, redirect chains, brand impersonation, and multiple threat intelligence sources to determine risk levels.

Instructions

Check a website URL for safety. Analyzes domain age, SSL certificate, redirect chains, brand impersonation, Google Web Risk, URLhaus, ThreatFox, and community reports. Returns risk score and detailed signals.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYesURL to check (must include protocol, e.g. https://example.com)
force_refreshNoForce a fresh lookup, bypassing cache (default: false)

Implementation Reference

  • The handler implementation for the 'check_url' tool which sends a POST request to the API.
    async ({ url, force_refresh }) => {
      try {
        const data = await apiPost('/api/v1/url/lookup', { url, force_refresh });
        return jsonResult(data);
      } catch (err) {
        return errorResult(err instanceof Error ? err.message : 'URL lookup failed');
      }
    },
  • src/index.ts:172-194 (registration)
    Registration of the 'check_url' tool using server.tool.
    server.tool(
      'check_url',
      'Check a website URL for safety. Analyzes domain age, SSL certificate, redirect chains, brand impersonation, Google Web Risk, URLhaus, ThreatFox, and community reports. Returns risk score and detailed signals.',
      {
        url: z.string().describe('URL to check (must include protocol, e.g. https://example.com)'),
        force_refresh: z.boolean().optional().describe('Force a fresh lookup, bypassing cache (default: false)'),
      },
      {
        title: 'Check URL Safety',
        readOnlyHint: true,
        destructiveHint: false,
        idempotentHint: true,
        openWorldHint: true,
      },
      async ({ url, force_refresh }) => {
        try {
          const data = await apiPost('/api/v1/url/lookup', { url, force_refresh });
          return jsonResult(data);
        } catch (err) {
          return errorResult(err instanceof Error ? err.message : 'URL lookup failed');
        }
      },
    );
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds valuable behavioral context beyond the annotations by enumerating specific data sources checked (domain age, brand impersonation, community reports) and disclosing the return format ('risk score and detailed signals') which compensates for the missing output schema. It does not contradict the readOnlyHint/idempotentHint annotations. Minor gap: no mention of caching behavior implications or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly constructed sentences with zero waste. First sentence front-loads the purpose and comprehensively lists analysis dimensions; second sentence addresses the return value. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema, the description appropriately discloses the return format ('risk score and detailed signals'). The combination of annotations (safety hints), schema (100% coverage), and description (analysis scope) provides complete invocation context. Minor gap: return structure specifics (object fields, enum values) are not described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage, the baseline is appropriately met. The description does not add parameter-specific semantics beyond the schema (e.g., cost implications of force_refresh, URL validation requirements), but given the comprehensive schema documentation including the protocol requirement example, additional description text is not strictly necessary.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Check') and resource ('website URL') with explicit intent ('for safety'). It effectively distinguishes from siblings like check_phone, check_email, and batch_url through its detailed enumeration of URL-specific analysis signals (SSL, redirect chains, URLhaus, etc.).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

While the detailed list of analysis sources (Google Web Risk, ThreatFox, etc.) implies usage context for security investigations, there is no explicit guidance on when to use this single-URL tool versus the sibling 'batch_url' tool, nor when to prefer this over 'check_document' or 'check_text' for safety analysis. Usage is implied but not stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/scamverifyai/scamverify-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server