MCP Inspector

What gridinsoft/mcp-inspector does

gridinsoft/mcp-inspector exposes GridinSoft Inspector's domain and URL analysis through the Model Context Protocol. Domain checks return a reputation score, security verdicts, available categories, hosting information, risk tags, and a report link. URL scans inspect specific pages or links for signals associated with phishing, malware, fraudulent redirects, and other threats; available results can include page metadata, screenshots, and network traffic analysis.

Three domain tools provide different names for the same underlying inspection: inspect_domain offers the comprehensive profile, while check_domain_safety and get_domain_reputation act as semantic aliases for safety and reputation questions. get_balance reports remaining credits and subscription status without consuming scan credits.

How it works

The npm package starts as a local stdio MCP process. It forwards requests to the Inspector REST bridge at https://inspector.gridinsoft.com/mcp/v1 over HTTPS. The /mcp page is documentation rather than a remote MCP transport endpoint, so clients should launch the package command instead of connecting to that URL as Streamable HTTP or SSE.

The server accepts domain names for reputation tools and full URLs for scan_url. Domain inspection costs 3 API credits, URL scanning costs 10 credits, and balance checks are free. New accounts receive 100 free API credits per month. An Unknown verdict means that no assessment is available; it should not be interpreted as a safe result.

Two MCP prompts are included: check-website-safety, which requires a site argument containing a domain or URL, and verify-domain-trust, which requires domain. The gs://guide/threat-categories resource explains the available security and content categories. A content classification by itself does not prove that a target contains malware or fraud.

Setup and configuration

Use Node.js 22 or newer with npm or npx available to the MCP host. Create a GridinSoft Inspector API key from the Inspector profile, then register the package with an MCP client using a stdio entry similar to:

{
  "mcpServers": {
    "gridinsoft": {
      "command": "npx",
      "args": ["-y", "@gridinsoft/mcp-inspector"],
      "env": {
        "GRIDINSOFT_API_KEY": "your_api_key_here"
      }
    }
  }
}

If the host cannot locate npx, configure the absolute path to the executable. The adapter's HTTP timeout defaults to 110,000 milliseconds and can be changed with GRIDINSOFT_TIMEOUT_MS. URL scans may need as much as 90 seconds, so an MCP client timeout of at least 120 seconds is appropriate where configurable.

The package can also be used from a shell. check, inspect, and scan commands print JSON results, while failures produce a nonzero exit status. Starting the command without arguments launches the stdio MCP server for a client.

Tools and capabilities

• inspect_domain: retrieve a full domain reputation profile.
• check_domain_safety: use a safety-focused alias for domain inspection.
• get_domain_reputation: request the domain trust score through an alias.
• scan_url: analyze a particular URL, including login pages and suspicious links.
• get_balance: view remaining API credits and subscription status.
• MCP prompts and a threat-category resource for guided safety and trust checks.

Limitations and notes

The adapter does not retry failed requests because a submitted scan may already have consumed credits. If a scan times out, check the Inspector dashboard before submitting it again. Tool execution failures are returned with isError: true; discovery and prompt or resource failures surface as MCP errors. URL scan depth and additional security analysis depend on the Inspector plan.