{"uid":"cap_s_qgTFvJND0CuhsD2J2JM","slug":"agentbit-url-threat-screener-1211c2be","name":"AgentBit URL Threat Screener","description":"Screen a URL before your agent follows it: phishing-pattern heuristics (IP-literal hosts, punycode, credentials in the URL, shorteners, deep subdomain nesting), a safe server-side redirect trace with cross-host detection, and an optional URLhaus malware-database lookup. Returns a 0-100 risk score with named flags. Honest scope: heuristics + public threat data, not a sandbox.","url":"https://agentbit.app/v1/security/url-threat","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","description":"Absolute http(s) URL to screen"}}},"responseSchema":{"type":"json","example":{"url":"https://bit.ly/3example","host":"bit.ly","risk":"clear","flags":["URL_SHORTENER"],"urlhaus":{"note":"Set a free abuse.ch Auth-Key in Settings to enable the URLhaus lookup.","checked":false},"disclaimer":"Heuristic and public-threat-data screening, not a sandbox detonation.","risk_score":15,"redirect_trace":{"hops":[{"url":"https://bit.ly/3example","status":301},{"url":"https://example.com/","status":200}],"final_url":"https://example.com/","reachable":true,"final_status":200,"cross_host_redirect":true}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_zG81GQH01xEJknMmUXPGh","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Screens a URL for phishing, malware, and redirect risks using heuristics, a live redirect trace, and optional URLhaus lookup, returning a 0-100 risk score with named flags.","exampleAgentPrompt":"Before you follow this link, can you screen it for phishing or malware — check if https://bit.ly/3xYzAbc is safe, trace where it redirects, and give me a risk score?","exampleUseCases":[{"title":"Phishing link check before agent browsing","prompt":"I got a link in an email that looks suspicious — can you screen https://secure-login.paypa1.com/verify for phishing patterns and tell me its risk score before I open it?"},{"title":"Short URL redirect transparency","prompt":"Can you trace where https://t.co/abc123xyz actually leads, check if it crosses different hosts, and tell me whether it's safe to follow?"},{"title":"User-submitted URL moderation pipeline","prompt":"A user just submitted https://192.168.1.1/free-gift-claim to our platform — can you run it through your URL threat screener and flag any heuristic red flags or malware database hits?"}],"resultDescription":"A JSON object containing the original URL, extracted host, a named risk level (e.g. 'clear', 'suspicious', 'high'), a 0-100 numeric risk_score, an array of named flags (e.g. URL_SHORTENER, IP_LITERAL_HOST, PUNYCODE, CREDENTIALS_IN_URL, DEEP_SUBDOMAIN), a full redirect_trace with each hop's URL and HTTP status, the final resolved URL, reachability status, whether a cross-host redirect occurred, and an optional URLhaus malware database result. A disclaimer notes this is heuristic + public threat data screening, not sandbox detonation.","failureModes":["Invalid or non-absolute URL returns validation error","Unreachable target URL causes redirect trace to mark reachable: false","URLhaus lookup disabled unless an abuse.ch Auth-Key is configured","Network timeout during redirect trace may produce incomplete hop chain","URLs using non-HTTP schemes (ftp://, mailto:) may not be supported"],"whenToPreferThis":"Choose this endpoint when your agent needs to pre-screen a URL before following it, especially for links from untrusted sources like user input, emails, or web scrapes. It is ideal when you need fast heuristic analysis combined with live redirect tracing and optional malware database lookup in a single call. Prefer it over full sandbox detonation when latency matters and the risk profile doesn't require full execution analysis.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T18:54:21.107Z","isFirstParty":false}