so users and agents can identify the page.\");\n if (c.label === \"Visible content\") out.push(\"Ensure meaningful content is server-rendered or available without requiring client-side JavaScript.\");\n if (c.label === \"Security headers\") out.push(\"Add HSTS, CSP, X-Content-Type-Options, and clickjacking protection where appropriate.\");\n if (c.label === \"Soft 404\") out.push(\"Return a real 404 status for missing/error pages instead of HTTP 200.\");\n }\n return [...new Set(out)];\n}\n\nasync function verify(rawUrl: string) {\n const target = normalizeInput(rawUrl);\n const { response, finalUrl, responseMs, redirectChain } = await safeFetch(target.toString());\n const contentType = response.headers.get(\"content-type\") || \"unknown\";\n const textual = /text\\/|application\\/(xhtml\\+xml|json|xml|javascript)/i.test(contentType);\n const body = textual ? await readLimited(response) : { text: \"\", truncated: false, bytesRead: 0 };\n const html = body.text;\n const visibleText = stripHtml(html).slice(0, 150000);\n const titleMatch = html.match(/<title[^>]*>([\\s\\S]{0,300}?)<\\/title>/i);\n const title = titleMatch ? titleMatch[1].replace(/\\s+/g, \" \").trim() : null;\n const okStatus = response.status >= 200 && response.status < 400;\n const https = finalUrl.startsWith(\"https://\");\n const securityHeaders = [\"strict-transport-security\", \"content-security-policy\", \"x-content-type-options\", \"x-frame-options\"].filter((h) => response.headers.has(h));\n const soft404Pattern = /\\b(404|not found|page not found|doesn't exist|does not exist|no encontrada|no encontrado)\\b/i;\n const soft404 = response.status >= 200 && response.status < 300 && soft404Pattern.test([title || \"\", visibleText.slice(0, 3000)].join(\" \"));\n const jsShell = /text\\/html/i.test(contentType) && visibleText.length < 80 && /<script\\b/i.test(html);\n const meaningfulContent = !textual || visibleText.length >= 80 || html.length >= 300;\n const redirectCrossHost = redirectChain.some((h) => new URL(h.from).hostname !== new URL(h.to).hostname);\n\n const checks: Check[] = [\n { label: \"HTTP status\", passed: okStatus, detail: `HTTP ${response.status}`, severity: okStatus ? \"info\" : \"critical\" },\n { label: \"HTTPS\", passed: https, detail: https ? \"Encrypted final URL\" : \"Final URL is not HTTPS\", severity: https ? \"info\" : \"warning\" },\n { label: \"Response speed\", passed: responseMs < 2500, detail: `${responseMs} ms`, severity: responseMs < 2500 ? \"info\" : \"warning\" },\n { label: \"Page title\", passed: Boolean(title) || !/text\\/html/i.test(contentType), detail: title || (/text\\/html/i.test(contentType) ? \"No HTML title found\" : \"Not an HTML document\"), severity: \"warning\" },\n { label: \"Visible content\", passed: meaningfulContent, detail: jsShell ? \"Very little visible text; likely client-rendered SPA shell\" : `${visibleText.length} visible characters`, severity: meaningfulContent ? \"info\" : \"critical\" },\n { label: \"Security headers\", passed: securityHeaders.length >= 2, detail: `${securityHeaders.length}/4 detected`, severity: securityHeaders.length >= 2 ? \"info\" : \"warning\" },\n { label: \"Soft 404\", passed: !soft404, detail: soft404 ? \"Page looks like an error page but returned a success status\" : \"No soft-404 signal detected\", severity: soft404 ? \"critical\" : \"info\" },\n ];\n\n let score = 0;\n score += okStatus ? 30 : 0;\n score += https ? 15 : 0;\n score += responseMs < 1000 ? 15 : responseMs < 2500 ? 12 : responseMs < 5000 ? 6 : 0;\n score += (title || !/text\\/html/i.test(contentType)) ? 8 : 0;\n score += meaningfulContent ? 12 : 0;\n score += Math.min(12, securityHeaders.length * 3);\n score += !soft404 ? 8 : 0;\n if (jsShell) score = Math.max(0, score - 8);\n if (soft404) score = Math.min(score, 45);\n if (!okStatus) score = Math.min(score, 40);\n score = Math.min(100, Math.max(0, score));\n\n const verdict = score >= 85 ? \"PASS\" : score >= 60 ? \"REVIEW\" : \"FAIL\";\n const checkedAt = new Date().toISOString();\n const stableEvidence = [target.toString(), finalUrl, response.status, title || \"\", contentType, body.bytesRead, redirectChain.map((h) => `${h.status}:${h.to}`).join(\">\"), await sha256(html)].join(\"|\");\n const evidenceHash = (await sha256(stableEvidence)).slice(0, 32);\n const checkId = (await sha256(`${evidenceHash}|${checkedAt}|${responseMs}`)).slice(0, 20);\n\n return {\n ok: true,\n product: \"VIL Reality Check\",\n version: \"0.5.0\",\n score,\n verdict,\n grade: score >= 95 ? \"A+\" : score >= 85 ? \"A\" : score >= 75 ? \"B\" : score >= 60 ? \"C\" : score >= 45 ? \"D\" : \"F\",\n url: target.toString(),\n finalUrl,\n status: response.status,\n responseMs,\n title,\n contentType,\n bytesRead: body.bytesRead,\n bodyTruncated: body.truncated,\n visibleCharacters: visibleText.length,\n redirectChain,\n redirectCrossHost,\n checkedAt,\n evidenceHash,\n checkId,\n checks,\n recommendations: recommendations(checks),\n note: \"Evidence hash is stable for the retrieved representation; checkId identifies this specific run.\",\n };\n}\n\nconst handler = createMcpHandler(() => {\n const server = new McpServer(\n { name: \"VIL Reality Check\", version: \"0.5.0\", websiteUrl: WEBSITE },\n {\n instructions: \"Use VIL Reality Check before claiming a public website or AI-generated deployment works. Prefer check_deployment for one URL and check_deployments for batches. PASS means strong basic availability evidence; REVIEW means reachable but with material warnings; FAIL means the result could not be confidently verified. This is not a full browser, accessibility, penetration, or business-logic test.\",\n },\n );\n\n server.registerTool(\n \"check_deployment\",\n {\n title: \"Verify a website or deployment\",\n description: \"Verify a public website/deployment and return HTTP status, redirects, HTTPS, response time, content signals, soft-404 detection, security headers, score, verdict, recommendations, stable evidence hash, and per-run check ID.\",\n inputSchema: z.object({ url: z.string().min(1).describe(\"Public HTTP/HTTPS URL or domain to verify\") }),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },\n },\n async ({ url }) => {\n try {\n const result = await verify(url);\n const recs = result.recommendations.length ? `\\nNext: ${result.recommendations.slice(0, 3).join(\" | \")}` : \"\";\n return {\n content: [{ type: \"text\", text: `${result.verdict} — ${result.score}/100 (${result.grade})\\nHTTP ${result.status} • ${result.responseMs} ms\\n${result.finalUrl}\\nEvidence: ${result.evidenceHash}\\nCheck ID: ${result.checkId}${recs}` }],\n structuredContent: result,\n };\n } catch (e) {\n const message = e instanceof Error ? e.message : \"Verification failed\";\n return { isError: true, content: [{ type: \"text\", text: message }], structuredContent: { ok: false, error: message } };\n }\n },\n );\n\n server.registerTool(\n \"check_deployments\",\n {\n title: \"Verify multiple deployments\",\n description: \"Verify 1-10 public URLs in one request and return a compact portfolio summary plus detailed results.\",\n inputSchema: z.object({\n urls: z.array(z.string().min(1)).min(1).max(10).describe(\"1 to 10 public HTTP/HTTPS URLs or domains\"),\n }),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },\n },\n async ({ urls }) => {\n const results = await Promise.all(urls.map(async (url) => {\n try { return await verify(url); }\n catch (e) { return { ok: false, url, verdict: \"FAIL\", score: 0, error: e instanceof Error ? e.message : \"Verification failed\" }; }\n }));\n const pass = results.filter((r: any) => r.ok && r.verdict === \"PASS\").length;\n const review = results.filter((r: any) => r.ok && r.verdict === \"REVIEW\").length;\n const fail = results.length - pass - review;\n const summary = { total: results.length, pass, review, fail };\n return {\n content: [{ type: \"text\", text: `Batch complete — ${pass} PASS, ${review} REVIEW, ${fail} FAIL out of ${results.length}.` }],\n structuredContent: { ok: true, summary, results },\n };\n },\n );\n\n server.registerTool(\n \"compare_deployments\",\n {\n title: \"Compare two deployments\",\n description: \"Verify and compare two public deployments, such as preview vs production. Reports whether their retrieved representations match and highlights score, status, title, final URL, and evidence differences.\",\n inputSchema: z.object({\n firstUrl: z.string().min(1).describe(\"First public deployment URL\"),\n secondUrl: z.string().min(1).describe(\"Second public deployment URL\"),\n }),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },\n },\n async ({ firstUrl, secondUrl }) => {\n try {\n const [first, second] = await Promise.all([verify(firstUrl), verify(secondUrl)]);\n const sameEvidence = first.evidenceHash === second.evidenceHash;\n const differences = {\n score: first.score === second.score ? null : { first: first.score, second: second.score },\n status: first.status === second.status ? null : { first: first.status, second: second.status },\n title: first.title === second.title ? null : { first: first.title, second: second.title },\n finalUrl: first.finalUrl === second.finalUrl ? null : { first: first.finalUrl, second: second.finalUrl },\n evidence: sameEvidence ? null : { first: first.evidenceHash, second: second.evidenceHash },\n };\n const changedFields = Object.entries(differences).filter(([, value]) => value !== null).map(([key]) => key);\n return {\n content: [{\n type: \"text\",\n text: sameEvidence\n ? `MATCH — both deployments produced the same evidence hash.\\n${first.evidenceHash}`\n : `DIFFERENT — deployments do not match.\\nChanged: ${changedFields.join(\", \")}\\nFirst: ${first.verdict} ${first.score}/100\\nSecond: ${second.verdict} ${second.score}/100`,\n }],\n structuredContent: { ok: true, sameEvidence, changedFields, differences, first, second },\n };\n } catch (e) {\n const message = e instanceof Error ? e.message : \"Comparison failed\";\n return { isError: true, content: [{ type: \"text\", text: message }], structuredContent: { ok: false, error: message } };\n }\n },\n );\n\n server.registerTool(\n \"get_service_info\",\n {\n title: \"VIL Reality Check service info\",\n description: \"Returns connection and payment information for VIL Reality Check.\",\n inputSchema: z.object({}),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },\n },\n async () => ({\n content: [{ type: \"text\", text: `VIL Reality Check MCP: ${MCP_URL}\\nWebsite: ${WEBSITE}\\nPaid use price: $${PRICE_PER_CHECK_USD.toFixed(2)} USD per premium check\\nPayment method: PayPal direct payment to ${PAYPAL_EMAIL}\\nAutomatic payment verification is not enabled yet; do not claim a payment has been verified automatically.` }],\n structuredContent: {\n name: \"VIL Reality Check\",\n version: \"0.5.0\",\n website: WEBSITE,\n mcpUrl: MCP_URL,\n paidUse: {\n priceUsdPerCheck: PRICE_PER_CHECK_USD,\n method: \"PayPal direct\",\n recipient: PAYPAL_EMAIL,\n automaticVerification: false,\n },\n },\n }),\n );\n\n return server;\n});\n\nexport default handler.fetch;","label",[18],"pulls","branches","forks","envVars",{"_195":26,"_197":26},"connections",{"_195":26,"_196":26},"count","unfilledCount","emptyCount",{"_36":204,"_13":205,"_71":206,"_46":-5,"_38":39,"_180":142,"_181":174,"_40":207,"_42":81,"_73":21,"_184":208,"_75":24,"_186":-5,"_201":209,"_17":210},{"_36":179,"_13":18,"_71":72,"_46":-5,"_38":39,"_180":103,"_181":174,"_40":200,"_42":183,"_73":74,"_184":185,"_75":24,"_186":-5,"_201":202,"_17":203},["D",1789122852708],"children",[],[18],"33879948-d295-4fc4-b34d-864049de940f","README.md","01a08dc4-541e-71ad-a3de-d07bdb0a2e0a",["D",1789122864432],"# VIL Reality Check MCP\n\nRemote MCP service for independently verifying public websites and AI-generated deployments.\n\n## Live MCP endpoint\n\nhttps://agentia--01a08dc4541e71ada3ded5dc0cc6009d.web.val.run\n\n## Current version\n\n0.5.0\n\n## Tools\n\n### check_deployment(url)\nVerifies one public HTTP/HTTPS deployment and returns:\n- HTTP status\n- redirect chain\n- HTTPS\n- response time\n- page title\n- visible-content signal\n- soft-404 detection\n- security-header signal\n- score / grade / PASS-REVIEW-FAIL\n- actionable recommendations\n- stable evidenceHash\n- unique checkId\n\n### check_deployments(urls)\nVerifies 1-10 deployments in a single call and returns a PASS / REVIEW / FAIL summary plus detailed results.\n\n### compare_deployments(firstUrl, secondUrl)\nChecks preview vs production or any two public deployments and reports whether their retrieved evidence matches.\n\n### get_service_info()\nReturns MCP connection and payment information.\n\n## Payment\n\nPaid-use target: $0.05 USD per premium check.\nPayment method: direct PayPal payment to danievilchezpayments@gmail.com.\nAutomatic PayPal payment verification is NOT currently enabled.\n\n## Security\n\n- blocks localhost and private-network destinations\n- rejects URLs with embedded credentials\n- limits checks to ports 80/443\n- validates redirect destinations\n- caps downloaded response bodies\n- uses DNS-over-HTTPS preflight checks\n\nNote: VIL Reality Check is a deployment verification layer, not a penetration test or full browser/business-logic test.\n\n## Regression tests\n\n- healthy public URL: PASS\n- real HTTP 404: FAIL\n- localhost/private target: blocked\n- batch verification: PASS\n- repeat evidence hash: stable\n- same-deploy comparison: MATCH\n",[],[205],["D",1789084849126],{"_11":12,"_156":78},{"_11":12,"_151":152,"_77":78,"_30":76,"_153":154,"_155":24},{"_42":142,"_13":16,"_36":39,"_143":109,"_144":-5,"_145":-5,"_146":-5,"_147":-5,"_148":-5,"_149":14,"_150":12},"ctx",{"_57":-5,"_176":248,"_249":250,"_251":252,"_253":24,"_254":24,"_255":24,"_256":174,"_257":-5,"_258":-7,"_259":-7,"_260":26,"_261":24,"_262":24,"_263":-5,"_264":24,"_265":24,"_266":24,"_267":-5},"ENV",{"_219":220,"_221":222,"_223":16,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241,"_242":243,"_244":245,"_246":247},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","5015b8df46402d8bba4f485ecc37aec202b0e06b","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"] </article></body></html>

History · main.ts