Unphurl

Create a new Unphurl account. Returns an API key (shown once, store it securely). After signup, the user must check their email and click the verification link. The API key won't work for URL checks until the email is verified. Verification link expires after 24 hours. If the link expires, use the "resend_verification" tool to request a new one. The account starts with 20 free pipeline check cre

Resend the email verification link for an existing Unphurl account. Use this when a user signed up but their verification link expired (links are valid for 24 hours) and they need a new one. The user's API key won't work until their email is verified. For security, the response is always the same regardless of whether the email exists, is already verified, or was rate limited. This prevents acco

Check a single URL for security and data quality signals. Returns a risk score (0-100), detailed signal breakdown, and metadata. Unphurl analyses URLs across seven dimensions: redirect behaviour, brand impersonation, domain intelligence (age, registrar, expiration, status codes, nameservers via RDAP), SSL/TLS validity, parked domain detection, URL structural analysis (length, path depth, subdomai

Check multiple URLs in a single batch. Returns results for all URLs, handling async processing automatically. Each URL is analysed across seven dimensions: redirect behaviour, brand impersonation, domain intelligence (age, registrar, expiration, status codes, nameservers via RDAP), SSL/TLS validity, parked domain detection, URL structural analysis, and DNS enrichment. Known and cached URLs return

Pre-flight credit estimator for a list of URLs. Returns counts + credit estimate. Free, no credits consumed. Call this before check_urls to show the user how many credits the batch will cost. Classifies each URL against three free gates: - tranco: URL's registrable domain is in the Tranco top 100K (trusted, treated as clean with score 0, no pipeline needed) - cached: URL's hostname is already in

List all custom scoring profiles on this account. Returns profile names and their custom weight overrides. Profiles are named weight sets that change how Unphurl scores URLs. Different use cases need different scoring. A cold email agent cares about dead domains. A security bot cares about phishing. Profiles let one account serve multiple use cases. Profiles only override specific weights. Any s

Create or update a custom scoring profile. Profiles are sparse overrides: only specify the weights you want to change. Everything else keeps its default value. If a profile with this name already exists, it is updated with the new weights (full replacement, not merge). Weights are points, not percentages. Each weight is the number of points that signal adds to the score when it fires. They don't

Delete a custom scoring profile. This is permanent. Any future check requests using this profile name will fall back to default weights. Use list_profiles to see your current profiles before deleting.

Show all 25 scoring signals with their default weights and descriptions. This is the baseline scoring that applies when no custom profile is specified. Use this to understand what each signal means and how much it contributes to the score before creating custom profiles. Profiles are sparse overrides on top of these defaults. This tool does not require an API key. The defaults are hardcoded and

Check your pipeline check credit balance. Shows credits remaining, total purchased, total used, and lifetime free lookups count. Credits are consumed only when unknown domains run through the full analysis pipeline. Known domains (Tranco Top 100K) and cached domains (previously analysed by any Unphurl customer) are always free. If credits_remaining is 0, you can still check known and cached doma

Show available pipeline check credit packages and pricing. Returns all packages with credit counts and prices. Packages (one-time purchase, no subscription): - Starter: 100 credits for $9 ($0.09 each) - Standard: 500 credits for $39 ($0.078 each) - Pro: 2,000 credits for $99 ($0.0495 each) - Scale: 10,000 credits for $399 ($0.0399 each) Most URL lookups are free (known domains and cached domains

Purchase pipeline check credits. Returns a Stripe Checkout URL that the user must open in a browser to complete payment. The AI cannot complete the payment. Tell the user to open the URL in their browser, complete the Stripe checkout, and then confirm they've paid. Credits are added to the account automatically once Stripe confirms payment. After purchase, use get_balance to verify credits have

View recent URL check history. Shows what URLs have been checked, their scores, phishing status, and whether each check was free or used a pipeline credit. Results are paginated. Use page and limit parameters to navigate. Default is 20 results per page, maximum 100. History is retained for 90 days. Account-level stats (total credits, balance) never expire.

View your account usage statistics. Shows total URLs submitted, breakdown by gate (Tranco lookups, cache lookups, pipeline checks), free rate percentage, score threshold counts, and credit balance. Use this to understand your usage patterns: how many of your checks resolved free (known or cached domains) vs paid pipeline checks, and how many URLs scored above key thresholds. This is useful for:

List all domains on this account's trusted allowlist. Allowlisted domains suppress the compound signal and brand impersonation floor in scoring. The full pipeline still runs — all signals remain visible for monitoring. Use this to see which domains are currently trusted. Returns the list of domains, current count, and the 1,000-domain limit.

Add one or more domains to this account's trusted allowlist. Allowlisted domains suppress the compound signal and brand impersonation floor in scoring. The full pipeline still runs — all signals remain visible so you can monitor trusted domains for SSL expiry, parking, or other changes. Submit the registrable domain only (e.g. partnerco.com). Subdomains and full URLs are rejected. Adding partner

Remove one or more domains from this account's trusted allowlist. Once removed, those domains resume normal scoring on the next check. Use list_allowlist to see what is currently on the list before removing.

Generate a branded PDF audit report. Pass the complete audit JSON object and your reseller details. Returns a 24-hour download link.