For malicious URL detection, the strongest fits are PreClick, a MCP-native URL preflight scanner built for autonomous agents 1, and Google Safe Browsing, which searches URLs against known threat lists through its API 7. Other candidates include ContrastAPI, which checks URLs against URLhaus for known malware distribution and offers an MCP server 2, and IPQualityScore's Malicious URL Scanner 4, plus Tirith, which scores URLs for homograph and IDN attacks 8.
- 1
PreClickpreclick.aiwebsite read, tools not yet checked
An MCP-native URL scanner that uses ML to detect malicious URLs and brand impersonation before an agent opens them 1.
official:MCP server · PreClick — An MCP-native URL preflight scanning service for autonomous agents.
- 2
Google Safe Browsing APIgoogleapis.comverified and signed
Searches URLs against Google's known threat lists and returns matching threat entries 7.
official:API · Safe Browsing API
for agents: safebrowsing.urls.search · safebrowsing.threatMatches.find · safebrowsing.threatLists.list
- 3
ContrastAPIcontrastcyber.comverified and signed
Checks a URL or domain against abuse.ch URLhaus for known malware-distribution and phishing evidence, available through its MCP server 2.
official:MCP server · ContrastAPI
for agents: Phishing Check · threat_intel · phishing_check
- 4
IPQS Malicious URL Scanneripqualityscore.comverified and signed
Scans a URL for malicious risk as part of the IPQS fraud detection and threat intelligence API 4.
official:API · IPQualityScore API+1 community tools built for it
for agents: maliciousUrlScanner · emailValidation · phoneValidation
- 5
Tirithtirith.shverified and signed
Scores a URL for homograph and IDN attacks, punycode, mixed-script characters, insecure transport and URL shorteners 8.
for agents: Analyze URL · Analyze shell command
Sources
- 1PreClick - Malicious URL Detection for Safe Agentic Browsingpreclick.ai · read 2026-10-29
- 2ContrastAPI — Security Intelligence APIapi.contrastcyber.com · read 2026-10-29
- 4Fraud Detection & IP Intelligence Platform | IPQSipqualityscore.com · read 2026-10-29
- 7Google Safe Browsinggoogleapis.com ·
- 8Tirith — Terminal Securitytirith.sh · read 2026-10-29
For agents: the 10 actions behind this answer
· PreClick website read, tools not yet checked
High-accuracy MCP-native URL scanner for secure agentic browsing. ML-powered malicious URL detection with browser automation and brand impersonation detection.
Phishing Check · ContrastAPI verified and signed
Phishing URL detection e.g. Is paypal-secure.net a phishing site?
radar-get-email-security-top-tlds-by-malicious · Cloudflare API verified and signed
Get top TLDs by email malicious classification
maliciousUrlScanner · IPQualityScore API verified and signed
Malicious URL Scanner
· SkanQRCode website read, tools not yet checked
Commercial URL safety API detecting quishing and zero-day phishing in under 500ms. Drop-in REST API and MCP server for mobile scanners and AI agents.
· isMalicious website read, tools not yet checked
Check IPs, domains, URLs, emails, phones and crypto wallets against indexed threat indicators. Streaming reports, blocklist API, free API key.
safebrowsing.urls.search · Safe Browsing API verified and signed
Searches for URLs matching known threats.
Analyze URL · Tirith verified and signed
Score a URL for homograph/IDN attacks, punycode, mixed-script characters, insecure transport, and URL shorteners. e.g. https://bit.ly/xyz e.g. curl -k http://10.0.0.1/admin
url-security-validator · AIM-Guard-MCP found in code, not yet checked
Validate URL safety (phishing, malware, HTTPS enforcement)
scan_url · relayshield-mcp found in code, not yet checked
Submit a URL for malware and phishing analysis across 70+ security engines.
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.