Inspector

io.github.gridinsoftPublished by GitHub account gridinsoftv1.0.7Updated Oct 30, 2026

Website safety and trust analysis. Verify domain reputation and detect phishing with GridinSoft.

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

GridinSoft Inspector MCP server that lets an assistant check domain reputation, verify whether a site is safe, and scan URLs for phishing or malware.

What you can do
  • Look up a domain's reputation score, security verdict, categories and report link
  • Quickly check whether a website is safe, malicious or a scam
  • Scan a specific URL or login page for phishing, malware and fraudulent redirects
  • Check remaining API credits and subscription plan status
  • Run the same checks from the command line as well as through the MCP server
When to use it
Useful when you want an assistant to vet links, domains or login pages before trusting them, or to answer questions about a site's reliability and safety. It fits research, support and security-triage workflows where a reputation lookup is enough.
Requirements
Node.js 22 or newer with npm/npx available to the MCP host, and a GridinSoft Inspector API key supplied in the GRIDINSOFT_API_KEY environment variable. The package runs locally over stdio and calls the Inspector REST API over HTTPS, so network access is needed. URL scans can take up to 90 seconds, so a client request timeout of at least 120 seconds is recommended.
Before you install
Each lookup spends paid API credits (3 per domain inspection, 10 per URL scan; new accounts get 100 free credits per month), and the adapter does not retry because a submitted scan may already have consumed credits. An Unknown verdict means no assessment is available, not that the target is safe. The API key is a secret passed via GRIDINSOFT_API_KEY, and the domains and URLs you submit are sent to GridinSoft.

Installation

In SourceWeft

  1. Open Inspector in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@gridinsoft/mcp-inspector

A Model Context Protocol server for domain reputation and URL analysis, powered by GridinSoft Inspector.

Requirements

  • Node.js 22 or newer, with npm/npx available to your MCP host.
  • A GridinSoft Inspector API key from your profile.

The npm package runs locally over stdio and calls the Inspector REST API over HTTPS. https://inspector.gridinsoft.com/mcp is the documentation page; /mcp/v1 is the REST bridge used by this package. Neither URL is a native remote MCP Streamable HTTP or SSE endpoint.

Connect an MCP client

Add this entry to your client's MCP server configuration:

json
{  "mcpServers": {    "gridinsoft": {      "command": "npx",      "args": ["-y", "@gridinsoft/mcp-inspector"],      "env": {        "GRIDINSOFT_API_KEY": "your_api_key_here"      }    }  }}

Use the configuration location and command transport supported by your MCP host. If it cannot find npx, supply the absolute path to your Node.js installation's npx executable.

URL scans may take up to 90 seconds. Where your client supports it, set its MCP request timeout to at least 120 seconds. The adapter's HTTP timeout defaults to 110 seconds and can be configured with GRIDINSOFT_TIMEOUT_MS (a positive integer in milliseconds). The adapter does not automatically retry requests, because a submitted scan may have already consumed credits. After a timeout, check the Inspector dashboard before submitting it again.

Tools

ToolInputPurposeCredits
inspect_domain{"domain":"example.com"}Available reputation score, verdict, categories, and report link3
check_domain_safety{"domain":"example.com"}Alias for inspect_domain3
get_domain_reputation{"domain":"example.com"}Alias for inspect_domain3
scan_url{"url":"https://example.com/login"}Page metadata and available security signals; additional analysis depends on the plan10
get_balance{}Remaining credits and subscription statusFree

An Unknown verdict means no assessment is available; it does not mean the target is safe. Tool execution errors return isError: true, with an explanation in content. Discovery or prompt/resource failures surface as MCP errors.

Prompts and resources

  • check-website-safety requires the site argument (a URL or domain).
  • verify-domain-trust requires the domain argument.
  • gs://guide/threat-categories describes the security and content categories. A content category alone does not establish malware or fraud.

Example prompt arguments:

json
{  "name": "check-website-safety",  "arguments": { "site": "https://example.com" }}

Command-line use

With GRIDINSOFT_API_KEY set in your environment:

sh
npx -y @gridinsoft/mcp-inspector check example.comnpx -y @gridinsoft/mcp-inspector inspect example.comnpx -y @gridinsoft/mcp-inspector scan https://example.com/loginnpx -y @gridinsoft/mcp-inspector --help

Commands print the JSON tool result and exit with a nonzero status on failure. Running without arguments starts the stdio MCP server when launched by a client.

Plans

New accounts receive 100 free API credits per month. See the Inspector dashboard for current plans and pricing.

Development

sh
npm cinpm testnpm run buildnpm pack --dry-run

The tests cover MCP initialization, discovery, prompt argument forwarding, resources, tool aliases, authentication errors, HTTP failures, cancellation, timeouts, stdio framing, and CLI exit codes. An additional backend integration fixture can be run against an Inspector checkout with Composer dependencies installed:

sh
INSPECTOR_TEST_ROOT=/absolute/path/to/inspector node --test test/php-integration.cjs

This fixture starts a temporary localhost PHP server, uses the real MCP routes/controller, and makes only public or unauthenticated requests. It does not load the application's environment file or perform paid scans.

License

MIT

Source: README.md at commit 31993fc

Tools

5

inspect_domain

Domain reputation assessment. Returns the available reputation score (0-100), security verdict, categories, and report link. Unknown means no assessment is available, not that the domain is safe. Use this tool when users ask about site reliability, trust, or safety.

Parametersdomainrequired

check_domain_safety

Semantic alias for inspect_domain. Quick check if a website is safe, malicious, or a scam. Returns reputation score and security verdict.

Parametersdomainrequired

get_domain_reputation

Semantic alias for inspect_domain. Get the trust and reputation score (0-100) for a domain.

Parametersdomainrequired

scan_url

Deep forensic URL analysis. Detects phishing, malware, and fraudulent redirects. Use this to verify specific links, login pages, or suspicious URLs. Returns page metadata and available security signals; additional analysis depends on the subscription plan.

Parametersurlrequired

get_balance

Check remaining API credits and subscription plan status

Takes no parameters.

Version history

2
  1. v1.0.7LatestOct 22, 2026
  2. v1.0.6Sep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts