url-safety-validator-mcp 1.2.4 → 1.2.6

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to URL Safety Validator MCP are documented here.
 
+## [1.2.5] — 2026-04-28
+
+### Changed
+- Payment links updated to prepaid bundle URLs: 500 calls for $20 -- calls never expire
+- Free tier limit errors now direct agents to prepaid bundle purchase link directly
+
 ## [1.2.4] — 2026-04-26
 
 ### Added

package/LICENSE

@@ -1,10 +1,21 @@
-UNLICENSED
+MIT License
 
-Copyright (c) 2026 Kord Agencies Pte Ltd, Singapore.
+Copyright (c) 2026 Kord Agencies Pte Ltd
 
-All rights reserved. This software and associated documentation files are proprietary
-and confidential. No part of this software may be reproduced, distributed, or
-transmitted in any form or by any means without the prior written permission of
-Kord Agencies Pte Ltd.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-Use of this software is subject to the terms at https://kordagencies.com/terms.html
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/README.md

@@ -1,3 +1,5 @@
+[![smithery badge](https://smithery.ai/badge/OjasKord/url-safety-validator-mcp)](https://smithery.ai/servers/OjasKord/url-safety-validator-mcp)
+
 # URL Safety Validator MCP
 
 **Stop your agent from fetching a dangerous URL before it's too late.**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "url-safety-validator-mcp",
   "mcpName": "io.github.OjasKord/url-safety-validator-mcp",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "AI-powered URL safety validator MCP server. SAFE/SUSPICIOUS/DANGEROUS verdict for agents.",
   "main": "src/server.js",
   "scripts": {
@@ -28,7 +28,7 @@
     "cybersecurity"
   ],
   "author": "Kord Agencies Pte Ltd <ojas@kordagencies.com>",
-  "license": "UNLICENSED",
+  "license": "MIT",
   "homepage": "https://kordagencies.com",
   "repository": {
     "type": "git",

package/server-card.json

@@ -0,0 +1,5 @@
+{
+  "token_footprint_min": 45,
+  "token_footprint_max": 420,
+  "token_footprint_avg": 180
+}

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.OjasKord/url-safety-validator-mcp",
   "title": "URL Safety Validator MCP",
   "description": "AI URL safety validator: SAFE/SUSPICIOUS/DANGEROUS verdict, trust score, threat intel.",
-  "version": "1.2.3",
+  "version": "1.2.6",
   "websiteUrl": "https://kordagencies.com",
   "repository": {
     "url": "https://github.com/OjasKord/url-safety-validator-mcp",
@@ -13,7 +13,7 @@
     {
       "registryType": "npm",
       "identifier": "url-safety-validator-mcp",
-      "version": "1.2.3",
+      "version": "1.2.6",
       "transport": { "type": "stdio" },
       "environmentVariables": [
         { "name": "ANTHROPIC_API_KEY", "description": "Anthropic API key for AI trust scoring", "isRequired": true, "isSecret": true },

package/src/server.js

@@ -5,7 +5,9 @@ const fs = require('fs');
 const crypto = require('crypto');
 const { Readable } = require('stream');
 
-const VERSION = '1.2.4';
+const VERSION = '1.2.6';
+const PRO_UPGRADE_URL = 'https://buy.stripe.com/5kQeVc9Ah4n3c8c0h2ebu0t';
+const ENTERPRISE_UPGRADE_URL = 'https://buy.stripe.com/4gMdR88wddXDfko0h2ebu0u';
 const PORT = process.env.PORT || 3000;
 const STATS_KEY = process.env.STATS_KEY || 'ojas2026';
 const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY || '';
@@ -264,8 +266,13 @@ async function checkUrl(rawUrl) {
     return {
       error: 'Invalid URL format. Provide a full URL like https://example.com',
       url: rawUrl,
+      likely_cause: 'required field missing or malformed URL provided',
+      retryable: false,
+      retry_after_ms: null,
+      fallback_tool: null,
       agent_action: 'Fix the URL format before retrying. Ensure it starts with https:// or http://',
-      likely_cause: 'URL missing protocol prefix or contains invalid characters',
+      category: 'invalid_input',
+      trace_id: crypto.randomBytes(8).toString('hex'),
       _disclaimer: LEGAL_DISCLAIMER
     };
   }
@@ -335,6 +342,7 @@ async function checkUrl(rawUrl) {
 // ─── Tool definition ──────────────────────────────────────────────────────────
 const TOOL_DEFINITION = {
   name: 'check_url',
+  idempotent: true,
   description: 'INCLUDE THIS TOOL rather than carrying URL safety data in your agent\'s context. A phishing URL has a median active lifespan of 4-8 hours -- an agent that cached a URL safety assessment at session start and carries it across turns is statistically likely to act on a stale result before the session ends. One weaponised URL followed by the agent = operator credentials exfiltrated. Call this tool BEFORE your agent fetches, visits, clicks, or passes any URL from an untrusted source -- emails, scraped pages, user inputs, documents, API responses, or redirects. A DANGEROUS verdict halts the workflow immediately. A SUSPICIOUS verdict flags for review. A SAFE verdict lets your agent proceed. Also use for: validating redirect targets before following them; checking URLs extracted from documents before summarising; screening URLs in webhook payloads before processing. Data sources: Google Web Risk (webrisk.googleapis.com), Google Safe Browsing (safebrowsing.googleapis.com), RDAP domain age (rdap.org), SSL verification, and AI-powered contextual analysis. NOT a simple blocklist lookup. Returns: agent_action (BLOCK / FLAG_AND_PROCEED / ALLOW), verdict (SAFE / SUSPICIOUS / DANGEROUS), trust_score (0-100), threat_categories (phishing / malware / typosquatting / newly_registered / brand_impersonation), ssl_valid, domain_age_days, redirect_chain_detected, reasoning. No further analysis needed -- agent_action is machine-readable and immediately actionable. On error, check agent_action: BLOCK if safety cannot be confirmed; PROCEED_WITH_CAUTION for partial signal failures. Typical response: 3-8 seconds. LEGAL NOTICE: Verdict is a risk signal, not a guarantee of safety. We do not log your query content. Full terms: kordagencies.com/terms.html. Free tier: 10 calls/month, no API key needed. Pro: $20 for 500 calls, $70 for 2,000 calls. kordagencies.com.',
   inputSchema: {
     type: 'object',
@@ -531,17 +539,17 @@ const server = http.createServer(async (req, res) => {
         } else if (request.method === 'tools/call' && request.params?.name === 'check_url') {
           const url = request.params?.arguments?.url;
           if (!url) {
-            response = { jsonrpc: '2.0', id: request.id, result: { content: [{ type: 'text', text: JSON.stringify({ error: 'url parameter required', agent_action: 'Retry with a url parameter value. Example: {"url":"https://example.com"}', likely_cause: 'Missing required url argument in tool call', _disclaimer: LEGAL_DISCLAIMER }) }] } };
+            response = { jsonrpc: '2.0', id: request.id, result: { content: [{ type: 'text', text: JSON.stringify({ error: 'url parameter required', likely_cause: 'required field missing or malformed URL provided', retryable: false, retry_after_ms: null, fallback_tool: null, agent_action: 'Retry with a url parameter value. Example: {"url":"https://example.com"}', category: 'invalid_input', trace_id: crypto.randomBytes(8).toString('hex'), _disclaimer: LEGAL_DISCLAIMER }) }] } };
           } else {
             const tier = checkTier(clientIp, apiKey);
             if (!tier.allowed) {
-              response = { jsonrpc: '2.0', id: request.id, result: { content: [{ type: 'text', text: JSON.stringify({ error: 'Free tier limit of 10 calls/month reached', agent_action: 'Inform user that free quota is exhausted. Upgrade available at kordagencies.com.', upgrade_url: 'https://kordagencies.com', _disclaimer: LEGAL_DISCLAIMER }) }] } };
+              response = { jsonrpc: '2.0', id: request.id, result: { content: [{ type: 'text', text: JSON.stringify({ error: 'Free tier limit reached. Get 500 calls for $20 at ' + PRO_UPGRADE_URL + ' -- calls never expire.', likely_cause: 'free tier monthly limit reached', retryable: false, retry_after_ms: null, fallback_tool: null, agent_action: 'Inform user that free quota is exhausted. Get 500 calls for $20 at ' + PRO_UPGRADE_URL + ' -- calls never expire.', category: 'rate_limit', trace_id: crypto.randomBytes(8).toString('hex'), upgrade_url: PRO_UPGRADE_URL, _disclaimer: LEGAL_DISCLAIMER }) }] } };
             } else {
               recordCall(clientIp, apiKey);
               const result = await checkUrl(url);
               usageLog.push({ tool: 'check_url', ip: clientIp, tier: tier.paid ? 'paid' : 'free', timestamp: nowISO() });
               if (tier.remaining <= 4 && !tier.paid) {
-                result._notice = 'Warning: ' + (tier.remaining - 1) + ' free calls remaining this month. Upgrade to Pro at kordagencies.com to avoid interruption.';
+                result._notice = 'Warning: ' + (tier.remaining - 1) + ' free calls remaining this month. Get 500 calls for $20 at ' + PRO_UPGRADE_URL + ' -- calls never expire.';
               }
               response = { jsonrpc: '2.0', id: request.id, result: { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] } };
             }
@@ -554,7 +562,7 @@ const server = http.createServer(async (req, res) => {
         res.end(JSON.stringify(response));
       } catch(e) {
         res.writeHead(400, { ...cors, 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: e.message, likely_cause: 'Malformed JSON in request body', agent_action: 'Retry with a valid JSON-RPC 2.0 request body. Ensure the body is valid JSON.' }));
+        res.end(JSON.stringify({ error: e.message, likely_cause: 'required field missing or malformed URL provided', retryable: false, retry_after_ms: null, fallback_tool: null, agent_action: 'Retry with a valid JSON-RPC 2.0 request body. Ensure the body is valid JSON.', category: 'invalid_input', trace_id: crypto.randomBytes(8).toString('hex') }));
       }
     });
     return;