# gridinsoft/mcp-inspector [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/gridinsoft/mcp-inspector  
**GitHub Stars:** 1  
**npm Downloads (last month):** 512  
**Views:** 6  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/gridinsoft-mcp-inspector

## Description
MCP server for domain and URL security analysis powered by GridinSoft Inspector, enabling AI agents to verify website and link safety.

## Tools
Capabilities this server exposes over MCP:

- **inspect_domain** — Comprehensive domain security profile. Essential for checking if a site is safe, trustworthy, or a scam. Returns reputation (0-100), security verdicts, hosting info, and risk tags. Use this tool when users ask about site reliability, trust, or safety.
- **check_domain_safety** — Semantic alias for inspect_domain. Quick check if a website is safe, malicious, or a scam. Returns reputation score and security verdict.
- **get_domain_reputation** — Semantic alias for inspect_domain. Get the trust and reputation score (0-100) for a domain.
- **scan_url** — Deep forensic URL analysis. Detects phishing, malware, and fraudulent redirects. Use this to verify specific links, login pages, or suspicious URLs. Provides forensic data including screenshots and network traffic analysis.
- **get_balance** — Check remaining API credits and subscription plan status

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-inspector": {
    "command": "npx",
    "args": ["-y","@gridinsoft/mcp-inspector"],
    "env": {
      "GRIDINSOFT_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `GRIDINSOFT_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What gridinsoft/mcp-inspector does

gridinsoft/mcp-inspector exposes GridinSoft Inspector's domain and URL analysis through the Model Context Protocol. Domain checks return a reputation score, security verdicts, available categories, hosting information, risk tags, and a report link. URL scans inspect specific pages or links for signals associated with phishing, malware, fraudulent redirects, and other threats; available results can include page metadata, screenshots, and network traffic analysis.

Three domain tools provide different names for the same underlying inspection: `inspect_domain` offers the comprehensive profile, while `check_domain_safety` and `get_domain_reputation` act as semantic aliases for safety and reputation questions. `get_balance` reports remaining credits and subscription status without consuming scan credits.

## How it works

The npm package starts as a local stdio MCP process. It forwards requests to the Inspector REST bridge at `https://inspector.gridinsoft.com/mcp/v1` over HTTPS. The `/mcp` page is documentation rather than a remote MCP transport endpoint, so clients should launch the package command instead of connecting to that URL as Streamable HTTP or SSE.

The server accepts domain names for reputation tools and full URLs for `scan_url`. Domain inspection costs 3 API credits, URL scanning costs 10 credits, and balance checks are free. New accounts receive 100 free API credits per month. An `Unknown` verdict means that no assessment is available; it should not be interpreted as a safe result.

Two MCP prompts are included: `check-website-safety`, which requires a `site` argument containing a domain or URL, and `verify-domain-trust`, which requires `domain`. The `gs://guide/threat-categories` resource explains the available security and content categories. A content classification by itself does not prove that a target contains malware or fraud.

## Setup and configuration

Use Node.js 22 or newer with npm or npx available to the MCP host. Create a GridinSoft Inspector API key from the Inspector profile, then register the package with an MCP client using a stdio entry similar to:

```json
{
  "mcpServers": {
    "gridinsoft": {
      "command": "npx",
      "args": ["-y", "@gridinsoft/mcp-inspector"],
      "env": {
        "GRIDINSOFT_API_KEY": "your_api_key_here"
      }
    }
  }
}
```

If the host cannot locate `npx`, configure the absolute path to the executable. The adapter's HTTP timeout defaults to 110,000 milliseconds and can be changed with `GRIDINSOFT_TIMEOUT_MS`. URL scans may need as much as 90 seconds, so an MCP client timeout of at least 120 seconds is appropriate where configurable.

The package can also be used from a shell. `check`, `inspect`, and `scan` commands print JSON results, while failures produce a nonzero exit status. Starting the command without arguments launches the stdio MCP server for a client.

## Tools and capabilities

- `inspect_domain`: retrieve a full domain reputation profile.
- `check_domain_safety`: use a safety-focused alias for domain inspection.
- `get_domain_reputation`: request the domain trust score through an alias.
- `scan_url`: analyze a particular URL, including login pages and suspicious links.
- `get_balance`: view remaining API credits and subscription status.
- MCP prompts and a threat-category resource for guided safety and trust checks.

## Limitations and notes

The adapter does not retry failed requests because a submitted scan may already have consumed credits. If a scan times out, check the Inspector dashboard before submitting it again. Tool execution failures are returned with `isError: true`; discovery and prompt or resource failures surface as MCP errors. URL scan depth and additional security analysis depend on the Inspector plan.

_Full upstream README: https://allmcps.com/mcp/gridinsoft-mcp-inspector/readme_