# AgentBit URL Threat Screener

> AgentBit URL Threat Screener is a paid API for AI agents from agentbit.app, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-13).

Screens a URL for phishing, malware, and redirect risks using heuristics, a live redirect trace, and optional URLhaus lookup, returning a 0-100 risk score with named flags.

## Facts

- Endpoint: POST https://agentbit.app/v1/security/url-threat
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentbit-url-threat-screener-1211c2be
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_s_qgTFvJND0CuhsD2J2JM

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentbit-url-threat-screener-1211c2be -d '<json body>'
```

Example prompt: Before you follow this link, can you screen it for phishing or malware — check if https://bit.ly/3xYzAbc is safe, trace where it redirects, and give me a risk score?

## When to prefer this

Choose this endpoint when your agent needs to pre-screen a URL before following it, especially for links from untrusted sources like user input, emails, or web scrapes. It is ideal when you need fast heuristic analysis combined with live redirect tracing and optional malware database lookup in a single call. Prefer it over full sandbox detonation when latency matters and the risk profile doesn't require full execution analysis.

## Known failure modes

- Invalid or non-absolute URL returns validation error
- Unreachable target URL causes redirect trace to mark reachable: false
- URLhaus lookup disabled unless an abuse.ch Auth-Key is configured
- Network timeout during redirect trace may produce incomplete hop chain
- URLs using non-HTTP schemes (ftp://, mailto:) may not be supported

## How this service works

Screen a URL before your agent follows it: phishing-pattern heuristics (IP-literal hosts, punycode, credentials in the URL, shorteners, deep subdomain nesting), a safe server-side redirect trace with cross-host detection, and an optional URLhaus malware-database lookup. Returns a 0-100 risk score with named flags. Honest scope: heuristics + public threat data, not a sandbox.

## Output

A JSON object containing the original URL, extracted host, a named risk level (e.g. 'clear', 'suspicious', 'high'), a 0-100 numeric risk_score, an array of named flags (e.g. URL_SHORTENER, IP_LITERAL_HOST, PUNYCODE, CREDENTIALS_IN_URL, DEEP_SUBDOMAIN), a full redirect_trace with each hop's URL and HTTP status, the final resolved URL, reachability status, whether a cross-host redirect occurred, and an optional URLhaus malware database result. A disclaimer notes this is heuristic + public threat data screening, not sandbox detonation.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "Absolute http(s) URL to screen"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://bit.ly/3example",
  "host": "bit.ly",
  "risk": "clear",
  "flags": [
   "URL_SHORTENER"
  ],
  "urlhaus": {
   "note": "Set a free abuse.ch Auth-Key in Settings to enable the URLhaus lookup.",
   "checked": false
  },
  "disclaimer": "Heuristic and public-threat-data screening, not a sandbox detonation.",
  "risk_score": 15,
  "redirect_trace": {
   "hops": [
    {
     "url": "https://bit.ly/3example",
     "status": 301
    },
    {
     "url": "https://example.com/",
     "status": 200
    }
   ],
   "final_url": "https://example.com/",
   "reachable": true,
   "final_status": 200,
   "cross_host_redirect": true
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentbit-url-threat-screener-1211c2be/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentbit.app](https://www.zero.xyz/host/agentbit.app/llms.txt)