url-safety-validator-mcp 1.1.0 → 1.2.1

package/package.json

@@ -1,14 +1,12 @@
 {
   "name": "url-safety-validator-mcp",
-  "version": "1.1.0",
+  "mcpName": "io.github.OjasKord/url-safety-validator-mcp",
+  "version": "1.2.1",
   "description": "AI-powered URL safety validator MCP server. SAFE/SUSPICIOUS/DANGEROUS verdict for agents.",
   "main": "src/server.js",
   "scripts": {
     "start": "node src/server.js"
   },
-  "license": "UNLICENSED",
-  "homepage": "https://kordagencies.com",
-  "mcpName": "io.github.OjasKord/url-safety-validator-mcp",
   "keywords": [
     "mcp",
     "agent",
@@ -19,8 +17,28 @@
     "malware",
     "security",
     "threat-intelligence",
-    "web-risk"
+    "web-risk",
+    "url-checker",
+    "link-safety",
+    "phishing-detection",
+    "google-web-risk",
+    "safe-browsing",
+    "malware-detection",
+    "url-scanner",
+    "cybersecurity"
   ],
-  "author": "Kord Agencies Pte Ltd",
+  "author": "Kord Agencies Pte Ltd <ojas@kordagencies.com>",
+  "license": "UNLICENSED",
+  "homepage": "https://kordagencies.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OjasKord/url-safety-validator-mcp.git"
+  },
+  "bugs": {
+    "url": "https://github.com/OjasKord/url-safety-validator-mcp/issues"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
   "dependencies": {}
 }

package/server.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.OjasKord/url-safety-validator-mcp",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "AI URL safety validator: SAFE/SUSPICIOUS/DANGEROUS verdict, trust score, threat intel.",
   "title": "URL Safety Validator",
   "websiteUrl": "https://kordagencies.com",
@@ -14,7 +14,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "url-safety-validator-mcp",
-      "version": "1.0.0",
+      "version": "1.2.0",
       "transport": { "type": "stdio" },
       "environmentVariables": [
         {
@@ -28,6 +28,12 @@
           "description": "Google Web Risk API key (commercial). Server degrades gracefully without it.",
           "isRequired": false,
           "isSecret": true
+        },
+        {
+          "name": "GOOGLE_SAFE_BROWSING_API_KEY",
+          "description": "Google Safe Browsing API key (free tier available).",
+          "isRequired": false,
+          "isSecret": true
         }
       ]
     }

package/src/server.js

@@ -5,7 +5,7 @@ const fs = require('fs');
 const crypto = require('crypto');
 const { Readable } = require('stream');
 
-const VERSION = '1.1.0';
+const VERSION = '1.2.1';
 const PORT = process.env.PORT || 3000;
 const STATS_KEY = process.env.STATS_KEY || 'ojas2026';
 const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY || '';
@@ -14,7 +14,7 @@ const GOOGLE_SAFE_BROWSING_API_KEY = process.env.GOOGLE_SAFE_BROWSING_API_KEY ||
 const STRIPE_WEBHOOK_SECRET = process.env.STRIPE_WEBHOOK_SECRET || '';
 const PERSIST_FILE = '/tmp/urlsafety_stats.json';
 
-const LEGAL_DISCLAIMER = 'Results sourced from Google Web Risk, Google Safe Browsing, and AI analysis. We do not log or store your query content. Results are for informational purposes only and do not constitute security advice. Verdict is a risk signal — not a guarantee of safety or danger. Provider maximum liability is limited to subscription fees paid in the preceding 3 months. Full terms: kordagencies.com/terms.html';
+const LEGAL_DISCLAIMER = 'Results sourced from Google Web Risk, Google Safe Browsing, and AI analysis. We do not log or store your query content. Results are for informational purposes only and do not constitute security advice. Verdict is a risk signal -- not a guarantee of safety or danger. Provider maximum liability is limited to subscription fees paid in the preceding 3 months. Full terms: kordagencies.com/terms.html';
 
 const FREE_LIMIT = 10;
 
@@ -208,11 +208,10 @@ Return this exact JSON structure:
 
 Rules:
 - trust_score 0-29 = DANGEROUS, 30-64 = SUSPICIOUS, 65-100 = SAFE
-- If Google Web Risk flagged it OR PhishTank confirmed it, verdict MUST be DANGEROUS
-- If URLhaus found it as malware, verdict MUST be DANGEROUS
+- If Google Web Risk flagged it OR Google Safe Browsing confirmed it, verdict MUST be DANGEROUS
 - Domain age under 30 days = add "newly_registered" to threat_categories and lower trust_score by at least 20
 - No SSL on a login-looking URL = lower score significantly
-- Consider the full picture — a newly registered domain with no database hits is still SUSPICIOUS not SAFE`;
+- Consider the full picture -- a newly registered domain with no database hits is still SUSPICIOUS not SAFE`;
 
   const body = JSON.stringify({
     model: 'claude-sonnet-4-6',
@@ -249,14 +248,14 @@ async function checkUrl(rawUrl) {
     checkGoogleWebRisk(href),
     checkGoogleSafeBrowsing(href),
     checkDomainAge(hostname),
-    protocol === 'https:' ? checkSSL(hostname) : Promise.resolve({ valid_ssl: false, error: 'HTTP only — no SSL' })
+    protocol === 'https:' ? checkSSL(hostname) : Promise.resolve({ valid_ssl: false, error: 'HTTP only -- no SSL' })
   ]);
 
   const signals = { google_web_risk: webRisk, google_safe_browsing: safeBrowsing, domain_age: domainAge, ssl };
 
   const ai = await getAITrustScore(href, hostname, signals);
 
-  // Determine final verdict — hard overrides
+  // Determine final verdict -- hard overrides
   let verdict = ai.available ? ai.verdict : 'SUSPICIOUS';
   let trust_score = ai.available ? ai.trust_score : 40;
 
@@ -287,9 +286,9 @@ async function checkUrl(rawUrl) {
     domain_registered: domainAge.available ? domainAge.registration_date : null,
     redirect_chain_detected,
     threat_categories: ai.available ? ai.threat_categories : [],
-    reasoning: ai.available ? ai.reasoning : 'AI analysis unavailable — verdict based on database signals only.',
+    reasoning: ai.available ? ai.reasoning : 'AI analysis unavailable -- verdict based on database signals only.',
     ai_confidence: ai.available ? ai.confidence : null,
-    analysis_type: 'AI-powered — NOT a simple database lookup',
+    analysis_type: 'AI-powered -- NOT a simple database lookup',
     database_signals: {
       google_web_risk: webRisk.available ? { flagged: webRisk.flagged, threat_types: webRisk.threat_types } : { available: false, reason: webRisk.reason },
       google_safe_browsing: safeBrowsing.available ? { flagged: safeBrowsing.flagged, threat_types: safeBrowsing.threat_types } : { available: false, reason: safeBrowsing.reason }
@@ -306,7 +305,7 @@ async function checkUrl(rawUrl) {
 // ─── Tool definition ──────────────────────────────────────────────────────────
 const TOOL_DEFINITION = {
   name: 'check_url',
-  description: 'Call this tool BEFORE your agent fetches, visits, or passes any URL from an untrusted source — emails, scraped pages, user inputs, API responses, documents. Returns SAFE/SUSPICIOUS/DANGEROUS verdict, AI trust score 0-100, threat categories, SSL status, domain age, and redirect chain detection. AI-powered analysis — NOT a simple database lookup. Cross-checks Google Web Risk, URLhaus, and PhishTank in one call. LEGAL NOTICE: Verdict is a risk signal, not a guarantee. We do not log your query content. Full terms: kordagencies.com/terms.html. Free tier: first 10 calls/month, no API key needed.',
+  description: 'Call this tool BEFORE your agent fetches, visits, or passes any URL from an untrusted source -- emails, scraped pages, user inputs, API responses, documents. Returns SAFE/SUSPICIOUS/DANGEROUS verdict, AI trust score 0-100, threat categories, SSL status, domain age, and redirect chain detection. AI-powered analysis -- NOT a simple database lookup. Cross-checks Google Web Risk and Google Safe Browsing in one call. LEGAL NOTICE: Verdict is a risk signal, not a guarantee. We do not log your query content. Full terms: kordagencies.com/terms.html. Free tier: first 10 calls/month, no API key needed.',
   inputSchema: {
     type: 'object',
     properties: {
@@ -404,7 +403,15 @@ const server = http.createServer(async (req, res) => {
         ? depCheck('webrisk.googleapis.com', `/v1/uris:search?threatTypes=MALWARE&uri=https%3A%2F%2Fexample.com&key=${GOOGLE_WEB_RISK_API_KEY}`)
         : Promise.resolve({ ok: false, status: 0, error: 'key not set' }),
       GOOGLE_SAFE_BROWSING_API_KEY
-        ? depCheck('safebrowsing.googleapis.com', `/v4/threatMatches:find?key=${GOOGLE_SAFE_BROWSING_API_KEY}`)
+        ? (() => {
+            const sbBody = JSON.stringify({ client: { clientId: 'kord-dep-check', clientVersion: '1.0' }, threatInfo: { threatTypes: ['MALWARE'], platformTypes: ['ANY_PLATFORM'], threatEntryTypes: ['URL'], threatEntries: [{ url: 'https://example.com' }] } });
+            return new Promise((resolve) => {
+              const r = https.request({ hostname: 'safebrowsing.googleapis.com', path: `/v4/threatMatches:find?key=${GOOGLE_SAFE_BROWSING_API_KEY}`, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(sbBody) } }, (res2) => { res2.resume(); resolve({ ok: res2.statusCode < 500, status: res2.statusCode }); });
+              r.on('error', () => resolve({ ok: false, status: 0, error: 'unreachable' }));
+              r.setTimeout(5000, () => { r.destroy(); resolve({ ok: false, status: 0, error: 'timeout' }); });
+              r.write(sbBody); r.end();
+            });
+          })()
         : Promise.resolve({ ok: false, status: 0, error: 'key not set' }),
       depCheck('rdap.org', '/domain/example.com'),
       depCheck('api.anthropic.com', '/v1/models', ANTHROPIC_API_KEY ? { 'x-api-key': ANTHROPIC_API_KEY, 'anthropic-version': '2023-06-01' } : {})
@@ -457,7 +464,7 @@ const server = http.createServer(async (req, res) => {
     return;
   }
 
-  // HTTP POST MCP handler — mandatory
+  // HTTP POST MCP handler -- mandatory
   if (req.method === 'POST' && req.url !== '/webhook/stripe') {
     let body = '';
     req.on('data', c => body += c);
@@ -485,7 +492,7 @@ const server = http.createServer(async (req, res) => {
           } else {
             const tier = checkTier(clientIp, apiKey);
             if (!tier.allowed) {
-              response = { jsonrpc: '2.0', id: request.id, result: { content: [{ type: 'text', text: JSON.stringify({ error: 'Free tier limit of 10 calls/month reached. You have seen it work — upgrade to Pro ($29/month) at kordagencies.com.', upgrade_url: 'https://kordagencies.com' }) }] } };
+              response = { jsonrpc: '2.0', id: request.id, result: { content: [{ type: 'text', text: JSON.stringify({ error: 'Free tier limit of 10 calls/month reached. You have seen it work -- upgrade to Pro ($29/month) at kordagencies.com.', upgrade_url: 'https://kordagencies.com' }) }] } };
             } else {
               if (tier.remaining <= 4 && !tier.paid) {
                 // will add notice to result
@@ -518,7 +525,7 @@ const server = http.createServer(async (req, res) => {
 
 server.listen(PORT, () => {
   console.log(`URL Safety Validator MCP v${VERSION} running on port ${PORT}`);
-  console.log(`Google Web Risk: ${GOOGLE_WEB_RISK_API_KEY ? 'configured' : 'NOT SET — set GOOGLE_WEB_RISK_API_KEY'}`);
+  console.log(`Google Web Risk: ${GOOGLE_WEB_RISK_API_KEY ? 'configured' : 'NOT SET -- set GOOGLE_WEB_RISK_API_KEY'}`);
   console.log(`Anthropic API: ${ANTHROPIC_API_KEY ? 'configured' : 'NOT SET'}`);
 });