| name | brin-check |
| description | Scan packages, repositories, MCP servers, domains, web pages, and agent skills for security threats using the brin API. Use this skill before installing dependencies, visiting URLs, or integrating external resources. |
brin Security Check
Scan any external resource for security threats using the brin API before installing, visiting, or using it.
Usage
When the user asks to check or scan a resource, when you need to verify the safety of an external dependency, or when you encounter unfamiliar URLs or domains:
- Identify the resource type and name
- Call the appropriate brin API endpoint
- Report the verdict, score, and any detected threats
API Reference
The brin API requires no authentication. Make a GET request to:
https://api.brin.sh/<origin>/<name>
Supported Origins
| Origin | Name | Example |
|---|
npm | package name | https://api.brin.sh/npm/express |
pypi | package name | https://api.brin.sh/pypi/requests |
crate | crate name | https://api.brin.sh/crate/serde |
domain | domain | https://api.brin.sh/domain/example.com |
page | domain/path | https://api.brin.sh/page/example.com/path |
repo | owner/repo | https://api.brin.sh/repo/facebook/react |
mcp | owner/repo | https://api.brin.sh/mcp/modelcontextprotocol/servers |
skill | owner/repo | https://api.brin.sh/skill/owner/skill-name |
Response Format
The API returns JSON with these fields:
| Field | Type | Description |
|---|
origin | string | Source type (e.g. npm, pypi, domain) |
name | string | Resource name |
score | integer | 0–100 safety score (higher is safer) |
confidence | string | low, medium, or high |
verdict | string | safe, caution, suspicious, or malicious |
tolerance | string | Scan tolerance level |
scanned_at | string | ISO 8601 timestamp |
url | string | API endpoint URL for this resource |
Response headers also provide quick access: x-brin-verdict, x-brin-score, and x-brin-confidence.
Step-by-Step
1. Determine the origin and identifier
Parse the user's request to determine what type of resource they want to check. Examples:
- "Check if lodash is safe" →
npm/lodash
- "Scan the requests Python package" →
pypi/requests
- "Is github.com/owner/repo safe?" →
repo/owner/repo
- "Check this MCP server: owner/server" →
mcp/owner/server
- "Is example.com safe?" →
domain/example.com
- "Check this URL: https://example.com/path" →
page/example.com/path
- "Scan the domains from my web search results" →
domain/<each-domain>
2. Query the API
curl -s https://api.brin.sh/npm/lodash
curl -s https://api.brin.sh/domain/example.com
curl -s https://api.brin.sh/page/example.com/some/path
3. Interpret the results
Report the following to the user:
- Verdict: The overall safety assessment
- Score: The numerical score (0–100)
- Confidence: How confident brin is in the result
4. Recommend action
| Verdict | Recommendation |
|---|
safe | Safe to use. Proceed with installation. |
caution | Generally safe but review the flagged concerns before proceeding. |
suspicious | Significant risk detected. Recommend finding an alternative. |
malicious | Do NOT install. This resource contains known threats. |
Example Output
When reporting results, format them clearly:
brin scan: express (npm)
━━━━━━━━━━━━━━━━━━━━━━━━
Score: 84/100
Verdict: safe ✓
Confidence: medium
For a caution result:
brin scan: requests (pypi)
━━━━━━━━━━━━━━━━━━━━━━━━
Score: 65/100
Verdict: caution ⚠
Confidence: medium
For a malicious resource:
brin scan: malicious-pkg (npm)
━━━━━━━━━━━━━━━━━━━━━━━━
Score: 12/100
Verdict: malicious ✗
Confidence: high
⚠ Do NOT install this package.
Batch Scanning
When multiple packages are being installed, scan each one individually and provide a summary table:
brin scan summary
━━━━━━━━━━━━━━━━━━━━━━━━
Package Score Verdict
express 84 safe ✓
lodash 88 safe ✓
requests 65 caution ⚠
Web Search and URL Scanning
When web search results return URLs or the user provides links, scan the domains before visiting:
Scanning domains from web search
curl -s https://api.brin.sh/domain/example.com
Scanning a specific page
curl -s https://api.brin.sh/page/example.com/docs/guide
Example output for a domain scan
brin scan: example.com (domain)
━━━━━━━━━━━━━━━━━━━━━━━━
Score: 90/100
Verdict: safe ✓
Confidence: high
For a dangerous domain:
brin scan: malicious-site.xyz (domain)
━━━━━━━━━━━━━━━━━━━━━━━━
Score: 8/100
Verdict: malicious ✗
Confidence: high
⚠ Do NOT visit this domain.
When to scan URLs
- After a web search returns results with unfamiliar domains
- Before following links from external documentation or READMEs
- When a user asks you to visit or read content from a URL
- Before scraping or extracting data from any web page
- When evaluating third-party API documentation links
Batch URL scanning
For multiple URLs from search results, scan each domain and provide a summary:
brin domain scan summary
━━━━━━━━━━━━━━━━━━━━━━━━
Domain Score Verdict
docs.example.com 95 safe ✓
blog.trusted.io 88 safe ✓
free-tools.xyz 15 suspicious ⚠
