ShopSafe for agents

Check the URL.
Keep the evidence.

Give your agent a quick, structured view of a website before its next step. Dated observations, visible gaps and a cost you control.

Create your API key Explore the API

REST and MCP · No browser or language model in quick checks

Example response · Partial coverage

{
  "risk_level": "unknown",
  "risk_score": 0,
  "coverage": "partial",
  "score_is_probability": false,
  "checks": [
    { "code": "public_dns",
      "status": "observed" },
    { "code": "https_transport",
      "status": "observed" },
    { "code": "url_reputation",
      "status": "unavailable" }
  ]
}

A zero score with missing evidence stays unknown.

Deterministic checks

Signals your agent can inspect.

Each result includes the exact URL, observation time, expiry, rule version and coverage. The same observations produce the same result.

Connection and redirects: Public DNS, observed HTTP response, verified HTTPS and any redirect from HTTPS to HTTP. Private network destinations are refused.
Sensitive forms: Static HTML checks for password or card fields submitted over HTTP. JavaScript is not executed, and external payment providers do not add risk on their own.
URL reputation: Google Web Risk Lookup evidence for the submitted URL and each responding destination, up to three HTTP redirects. Every result retains its exact URL. A provider outage, expired result or exhausted allowance is explicit.
What it does not verify: Business ownership, product authenticity, order fulfilment or the safety of a transaction. Ordinary hosting, missing email records and certificate age do not add quick-check risk points.

Usage pricing

Start free. Set your limit.

20 free quick-check attempts per account each UTC day. Fresh cached results and polling are free.

Prepaid access is available. Complete fresh checks use credit after the free allowance. Incomplete checks release their reservation.

2 AUD cents / quick check

Add A$10 at a time through Stripe.
No subscription or automatic top-ups.

Manage agent access

The account starts with an A$1 daily spending cap. You can lower it to zero.

One contract, two interfaces

Make the next call predictable.

Use an expiring API key with the verify scope. Begin with get_account to read pricing, credit and the spending cap. Reuse the exact request and idempotency key if a connection drops.

Read the public service capabilities for current pricing, connection details and suite limits before issuing a key.

Keys stay in your client's secret store and travel in an Authorization header. Interactive OAuth onboarding is not available yet.

Start with the Python or JavaScript example.

MCP · Streamable HTTP

https://shopsafe.com.au/mcp

Quick verification · REST

POST /api/v1/verifications
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "url": "https://example.com/",
  "idempotency_key": "order-123-check-1",
  "max_age_seconds": 300,
  "max_cost_aud_cents": 0
}

The example allows free checks only. Increase the maximum only within the account owner's authorised budget.

verify_site

Returns a quick verification. A repeated in-progress request returns its existing ID. Charges never exceed the submitted maximum.

get_verification

Reads the existing result and actual cost. Check freshness and coverage before applying your own transaction policy.

get_account

Reads the unit price, available credit, spending cap and link to fund the account. It cannot buy credit or change limits.

Runnable examples

Start with a working client.

Keep your key in the SHOPSAFE_API_KEY environment variable or your server's secret store. Both examples start with a zero-cent maximum and use the same REST contract as MCP.

Download Python example Download JavaScript example

Python 3.11+ with httpx · Server-side Node.js 20+ with no package dependencies

Save the request ID and all its parameters with your job before making the first call. A failed connection may have completed on the server, so retries must use that same request.

Python · Free allowance and cache only

python -m pip install httpx
python shopsafe_verify.py https://example.com --request-id order-123-url-check-1

JavaScript · Import into your server

import {createShopSafe} from './shopsafe_verify.mjs';
const api = createShopSafe(process.env.SHOPSAFE_API_KEY);
const account = await api.account();
const result = await api.verify({
  url: 'https://example.com',
  requestId: 'order-123-url-check-1'
});

Inspect status, freshness, coverage and risk evidence before applying your own policy. The examples do not make purchases, add credit or raise spending limits.

Before you connect

What does complete coverage mean?

All checks in this small, defined suite returned a usable observation. It does not mean the whole website was audited. Reputation covers the submitted URL and responding destinations within the three-redirect limit. A missed destination lookup makes coverage partial and releases prepaid credit. Unvisited redirects, dynamic pages and business legitimacy remain outside this suite.

What happens when a source is unavailable?

The result reports partial or incomplete coverage. A zero score stays unknown when evidence is missing. Any prepaid reservation is released, and the request still counts towards service and free-attempt limits.

How do retries and cached results work?

Use the same idempotency key and identical parameters to retrieve the same verification without another charge. Change the key for a new request. Complete results within your requested maximum age, up to five minutes, can be reused free within your account.

How should an agent handle payment or limit errors?

REST and MCP errors include a stable error code, next action and retry guidance. insufficient_credit links to the owner's funding page. max_cost_too_low requires owner authority before changing the request's maximum. A daily spending-cap refusal includes the UTC reset wait. No error automatically raises a cap or charges a card.

After a connection failure, retry the same request and idempotency key. A recorded failed verification is terminal: repeating that key retrieves the same result. Start another attempt with a new key only within the owner's authorised budget.

Can any MCP client connect?

Clients need Streamable HTTP support and a custom Authorization header. REST is available for other integrations. A discovery manifest is available at the server descriptor. ShopSafe is also listed as au.com.shopsafe/verify in the official MCP Registry. A listing does not install the server in your client.

What about the earlier browser-check tools?

lookup_site, check_site and get_check remain a separate private beta. They do not spend quick-check credits. New self-service keys grant cached lookup and optionally quick verification.

Google Web Risk provides URL reputation evidence. Some unsafe sites may be missed and some safe sites may be flagged in error. Neither this evidence nor ShopSafe guarantees the safety of a site or transaction. Read our methodology.

Check the URL.Keep the evidence.