so users and agents can identify the page.\");\n if (c.label === \"Visible content\") out.push(\"Ensure meaningful content is server-rendered or available without requiring client-side JavaScript.\");\n if (c.label === \"Security headers\") out.push(\"Add HSTS, CSP, X-Content-Type-Options, and clickjacking protection where appropriate.\");\n if (c.label === \"Soft 404\") out.push(\"Return a real 404 status for missing/error pages instead of HTTP 200.\");\n }\n return [...new Set(out)];\n}\n\nasync function verify(rawUrl: string) {\n const target = normalizeInput(rawUrl);\n const { response, finalUrl, responseMs, redirectChain } = await safeFetch(target.toString());\n const contentType = response.headers.get(\"content-type\") || \"unknown\";\n const textual = /text\\/|application\\/(xhtml\\+xml|json|xml|javascript)/i.test(contentType);\n const body = textual ? await readLimited(response) : { text: \"\", truncated: false, bytesRead: 0 };\n const html = body.text;\n const visibleText = stripHtml(html).slice(0, 150000);\n const titleMatch = html.match(/<title[^>]*>([\\s\\S]{0,300}?)<\\/title>/i);\n const title = titleMatch ? titleMatch[1].replace(/\\s+/g, \" \").trim() : null;\n const okStatus = response.status >= 200 && response.status < 400;\n const https = finalUrl.startsWith(\"https://\");\n const securityHeaders = [\"strict-transport-security\", \"content-security-policy\", \"x-content-type-options\", \"x-frame-options\"].filter((h) => response.headers.has(h));\n const soft404Pattern = /\\b(404|not found|page not found|doesn't exist|does not exist|no encontrada|no encontrado)\\b/i;\n const soft404 = response.status >= 200 && response.status < 300 && soft404Pattern.test([title || \"\", visibleText.slice(0, 3000)].join(\" \"));\n const jsShell = /text\\/html/i.test(contentType) && visibleText.length < 80 && /<script\\b/i.test(html);\n const meaningfulContent = !textual || visibleText.length >= 80 || html.length >= 300;\n const redirectCrossHost = redirectChain.some((h) => new URL(h.from).hostname !== new URL(h.to).hostname);\n\n const checks: Check[] = [\n { label: \"HTTP status\", passed: okStatus, detail: `HTTP ${response.status}`, severity: okStatus ? \"info\" : \"critical\" },\n { label: \"HTTPS\", passed: https, detail: https ? \"Encrypted final URL\" : \"Final URL is not HTTPS\", severity: https ? \"info\" : \"warning\" },\n { label: \"Response speed\", passed: responseMs < 2500, detail: `${responseMs} ms`, severity: responseMs < 2500 ? \"info\" : \"warning\" },\n { label: \"Page title\", passed: Boolean(title) || !/text\\/html/i.test(contentType), detail: title || (/text\\/html/i.test(contentType) ? \"No HTML title found\" : \"Not an HTML document\"), severity: \"warning\" },\n { label: \"Visible content\", passed: meaningfulContent, detail: jsShell ? \"Very little visible text; likely client-rendered SPA shell\" : `${visibleText.length} visible characters`, severity: meaningfulContent ? \"info\" : \"critical\" },\n { label: \"Security headers\", passed: securityHeaders.length >= 2, detail: `${securityHeaders.length}/4 detected`, severity: securityHeaders.length >= 2 ? \"info\" : \"warning\" },\n { label: \"Soft 404\", passed: !soft404, detail: soft404 ? \"Page looks like an error page but returned a success status\" : \"No soft-404 signal detected\", severity: soft404 ? \"critical\" : \"info\" },\n ];\n\n let score = 0;\n score += okStatus ? 30 : 0;\n score += https ? 15 : 0;\n score += responseMs < 1000 ? 15 : responseMs < 2500 ? 12 : responseMs < 5000 ? 6 : 0;\n score += (title || !/text\\/html/i.test(contentType)) ? 8 : 0;\n score += meaningfulContent ? 12 : 0;\n score += Math.min(12, securityHeaders.length * 3);\n score += !soft404 ? 8 : 0;\n if (jsShell) score = Math.max(0, score - 8);\n if (soft404) score = Math.min(score, 45);\n if (!okStatus) score = Math.min(score, 40);\n score = Math.min(100, Math.max(0, score));\n\n const verdict = score >= 85 ? \"PASS\" : score >= 60 ? \"REVIEW\" : \"FAIL\";\n const checkedAt = new Date().toISOString();\n const stableEvidence = [target.toString(), finalUrl, response.status, title || \"\", contentType, body.bytesRead, redirectChain.map((h) => `${h.status}:${h.to}`).join(\">\"), await sha256(html)].join(\"|\");\n const evidenceHash = (await sha256(stableEvidence)).slice(0, 32);\n const checkId = (await sha256(`${evidenceHash}|${checkedAt}|${responseMs}`)).slice(0, 20);\n\n return {\n ok: true,\n product: \"VIL Reality Check\",\n version: \"0.5.0\",\n score,\n verdict,\n grade: score >= 95 ? \"A+\" : score >= 85 ? \"A\" : score >= 75 ? \"B\" : score >= 60 ? \"C\" : score >= 45 ? \"D\" : \"F\",\n url: target.toString(),\n finalUrl,\n status: response.status,\n responseMs,\n title,\n contentType,\n bytesRead: body.bytesRead,\n bodyTruncated: body.truncated,\n visibleCharacters: visibleText.length,\n redirectChain,\n redirectCrossHost,\n checkedAt,\n evidenceHash,\n checkId,\n checks,\n recommendations: recommendations(checks),\n note: \"Evidence hash is stable for the retrieved representation; checkId identifies this specific run.\",\n };\n}\n\nconst handler = createMcpHandler(() => {\n const server = new McpServer(\n { name: \"VIL Reality Check\", version: \"0.5.0\", websiteUrl: WEBSITE },\n {\n instructions: \"Use VIL Reality Check before claiming a public website or AI-generated deployment works. Prefer check_deployment for one URL and check_deployments for batches. PASS means strong basic availability evidence; REVIEW means reachable but with material warnings; FAIL means the result could not be confidently verified. This is not a full browser, accessibility, penetration, or business-logic test.\",\n },\n );\n\n server.registerTool(\n \"check_deployment\",\n {\n title: \"Verify a website or deployment\",\n description: \"Verify a public website/deployment and return HTTP status, redirects, HTTPS, response time, content signals, soft-404 detection, security headers, score, verdict, recommendations, stable evidence hash, and per-run check ID.\",\n inputSchema: z.object({ url: z.string().min(1).describe(\"Public HTTP/HTTPS URL or domain to verify\") }),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },\n },\n async ({ url }) => {\n try {\n const result = await verify(url);\n const recs = result.recommendations.length ? `\\nNext: ${result.recommendations.slice(0, 3).join(\" | \")}` : \"\";\n return {\n content: [{ type: \"text\", text: `${result.verdict} — ${result.score}/100 (${result.grade})\\nHTTP ${result.status} • ${result.responseMs} ms\\n${result.finalUrl}\\nEvidence: ${result.evidenceHash}\\nCheck ID: ${result.checkId}${recs}` }],\n structuredContent: result,\n };\n } catch (e) {\n const message = e instanceof Error ? e.message : \"Verification failed\";\n return { isError: true, content: [{ type: \"text\", text: message }], structuredContent: { ok: false, error: message } };\n }\n },\n );\n\n server.registerTool(\n \"check_deployments\",\n {\n title: \"Verify multiple deployments\",\n description: \"Verify 1-10 public URLs in one request and return a compact portfolio summary plus detailed results.\",\n inputSchema: z.object({\n urls: z.array(z.string().min(1)).min(1).max(10).describe(\"1 to 10 public HTTP/HTTPS URLs or domains\"),\n }),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },\n },\n async ({ urls }) => {\n const results = await Promise.all(urls.map(async (url) => {\n try { return await verify(url); }\n catch (e) { return { ok: false, url, verdict: \"FAIL\", score: 0, error: e instanceof Error ? e.message : \"Verification failed\" }; }\n }));\n const pass = results.filter((r: any) => r.ok && r.verdict === \"PASS\").length;\n const review = results.filter((r: any) => r.ok && r.verdict === \"REVIEW\").length;\n const fail = results.length - pass - review;\n const summary = { total: results.length, pass, review, fail };\n return {\n content: [{ type: \"text\", text: `Batch complete — ${pass} PASS, ${review} REVIEW, ${fail} FAIL out of ${results.length}.` }],\n structuredContent: { ok: true, summary, results },\n };\n },\n );\n\n server.registerTool(\n \"compare_deployments\",\n {\n title: \"Compare two deployments\",\n description: \"Verify and compare two public deployments, such as preview vs production. Reports whether their retrieved representations match and highlights score, status, title, final URL, and evidence differences.\",\n inputSchema: z.object({\n firstUrl: z.string().min(1).describe(\"First public deployment URL\"),\n secondUrl: z.string().min(1).describe(\"Second public deployment URL\"),\n }),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },\n },\n async ({ firstUrl, secondUrl }) => {\n try {\n const [first, second] = await Promise.all([verify(firstUrl), verify(secondUrl)]);\n const sameEvidence = first.evidenceHash === second.evidenceHash;\n const differences = {\n score: first.score === second.score ? null : { first: first.score, second: second.score },\n status: first.status === second.status ? null : { first: first.status, second: second.status },\n title: first.title === second.title ? null : { first: first.title, second: second.title },\n finalUrl: first.finalUrl === second.finalUrl ? null : { first: first.finalUrl, second: second.finalUrl },\n evidence: sameEvidence ? null : { first: first.evidenceHash, second: second.evidenceHash },\n };\n const changedFields = Object.entries(differences).filter(([, value]) => value !== null).map(([key]) => key);\n return {\n content: [{\n type: \"text\",\n text: sameEvidence\n ? `MATCH — both deployments produced the same evidence hash.\\n${first.evidenceHash}`\n : `DIFFERENT — deployments do not match.\\nChanged: ${changedFields.join(\", \")}\\nFirst: ${first.verdict} ${first.score}/100\\nSecond: ${second.verdict} ${second.score}/100`,\n }],\n structuredContent: { ok: true, sameEvidence, changedFields, differences, first, second },\n };\n } catch (e) {\n const message = e instanceof Error ? e.message : \"Comparison failed\";\n return { isError: true, content: [{ type: \"text\", text: message }], structuredContent: { ok: false, error: message } };\n }\n },\n );\n\n server.registerTool(\n \"get_service_info\",\n {\n title: \"VIL Reality Check service info\",\n description: \"Returns connection and payment information for VIL Reality Check.\",\n inputSchema: z.object({}),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },\n },\n async () => ({\n content: [{ type: \"text\", text: `VIL Reality Check MCP: ${MCP_URL}\\nWebsite: ${WEBSITE}\\nPaid use price: $${PRICE_PER_CHECK_USD.toFixed(2)} USD per premium check\\nPayment method: PayPal direct payment to ${PAYPAL_EMAIL}\\nAutomatic payment verification is not enabled yet; do not claim a payment has been verified automatically.` }],\n structuredContent: {\n name: \"VIL Reality Check\",\n version: \"0.5.0\",\n website: WEBSITE,\n mcpUrl: MCP_URL,\n paidUse: {\n priceUsdPerCheck: PRICE_PER_CHECK_USD,\n method: \"PayPal direct\",\n recipient: PAYPAL_EMAIL,\n automaticVerification: false,\n },\n },\n }),\n );\n\n return server;\n});\n\nexport default handler.fetch;","deleted",false,"label",[19],{"_33":61,"_13":62,"_35":63,"_37":-5,"_38":39,"_40":64,"_42":43,"_44":65,"_17":66,"_47":24,"_49":67,"_51":52,"_53":-5,"_58":68,"_18":69},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":57,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_58":59,"_18":60},["D",1789122852708],"children",[],[19],"33879948-d295-4fc4-b34d-864049de940f","README.md","01a08dc4-541e-71ad-a3de-d07bdb0a2e0a",7,["D",1789122864432],2,"# VIL Reality Check MCP\n\nRemote MCP service for independently verifying public websites and AI-generated deployments.\n\n## Live MCP endpoint\n\nhttps://agentia--01a08dc4541e71ada3ded5dc0cc6009d.web.val.run\n\n## Current version\n\n0.5.0\n\n## Tools\n\n### check_deployment(url)\nVerifies one public HTTP/HTTPS deployment and returns:\n- HTTP status\n- redirect chain\n- HTTPS\n- response time\n- page title\n- visible-content signal\n- soft-404 detection\n- security-header signal\n- score / grade / PASS-REVIEW-FAIL\n- actionable recommendations\n- stable evidenceHash\n- unique checkId\n\n### check_deployments(urls)\nVerifies 1-10 deployments in a single call and returns a PASS / REVIEW / FAIL summary plus detailed results.\n\n### compare_deployments(firstUrl, secondUrl)\nChecks preview vs production or any two public deployments and reports whether their retrieved evidence matches.\n\n### get_service_info()\nReturns MCP connection and payment information.\n\n## Payment\n\nPaid-use target: $0.05 USD per premium check.\nPayment method: direct PayPal payment to danievilchezpayments@gmail.com.\nAutomatic PayPal payment verification is NOT currently enabled.\n\n## Security\n\n- blocks localhost and private-network destinations\n- rejects URLs with embedded credentials\n- limits checks to ports 80/443\n- validates redirect destinations\n- caps downloaded response bodies\n- uses DNS-over-HTTPS preflight checks\n\nNote: VIL Reality Check is a deployment verification layer, not a penetration test or full browser/business-logic test.\n\n## Regression tests\n\n- healthy public URL: PASS\n- real HTTP 404: FAIL\n- localhost/private target: blocked\n- batch verification: PASS\n- repeat evidence hash: stable\n- same-deploy comparison: MATCH\n",[],[62],"23e033e1-d86a-46c2-a6d0-a247bc6e1c2a",["D",1789084849126],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Remote MCP for VIL Reality Check","imageUrl","userId","b162e777-26d5-4b57-b5d4-824de1b425e2","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a087a7-039d-766a-a2cb-d9a1a861d44b","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_125":121},"org",{"_11":12,"_118":119,"_120":121,"_80":81,"_122":123,"_124":52},"branch",{"_17":64,"_13":16,"_33":39,"_110":70,"_111":-5,"_112":-5,"_113":-5,"_114":-5,"_115":-5,"_116":14,"_117":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Agent Ia","avatar","https://lh3.googleusercontent.com/a/ACg8ocJFdiW2REahwLO-JAErcTTOgHyYDVN6VBKDk9RmathkK-sumQ=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":70,"_13":14,"_44":162,"_72":-5,"_73":52,"_74":75,"_76":75,"_77":78,"_79":-5,"_80":81,"_82":36,"_83":52,"_84":-5,"_85":-5,"_86":87,"_88":89,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":95,"_96":95,"_97":98,"_99":98,"_100":98,"_101":95,"_102":95,"_103":163,"_105":164,"_107":165,"_109":52},[156,157],"files",[156,157],"counts",{"_146":87,"_147":148,"_149":87,"_32":150,"_151":152},[],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":145},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],"pulls","branches",1,"forks",{"_153":87,"_155":87},"connections",{"_153":87,"_154":87},"count","unfilledCount","emptyCount",{"_33":61,"_13":62,"_35":63,"_37":-5,"_38":39,"_40":64,"_42":43,"_44":65,"_17":66,"_47":24,"_49":67,"_51":52,"_53":-5,"_58":160,"_18":161},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":57,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_58":158,"_18":159},[],[19],[],[62],["D",1789084849126],{"_11":12,"_125":121},{"_11":12,"_118":119,"_120":121,"_80":81,"_122":123,"_124":52},{"_17":64,"_13":16,"_33":39,"_110":70,"_111":-5,"_112":-5,"_113":-5,"_114":-5,"_115":-5,"_116":14,"_117":12},"ctx",{"_103":-5,"_142":199,"_200":201,"_202":203,"_204":52,"_205":52,"_206":52,"_207":43,"_208":-5,"_209":-7,"_210":-7,"_211":87,"_212":52,"_213":52,"_214":-5,"_215":52,"_216":52,"_217":52,"_218":-5},"ENV",{"_170":171,"_172":173,"_174":16,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"] </article></body></html>

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_166":167,"_168":169},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_126":-5,"_20":127,"_22":128,"_129":130,"_131":132,"_26":133,"_24":134,"_135":-5,"_136":-5,"_137":52,"_138":139,"_140":43,"_141":-5,"_142":-5,"_143":144},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","agentia","name","vil-reality-check-mcp","branchName","main","version","path","main.ts","project",{"_33":70,"_13":14,"_44":71,"_72":-5,"_73":52,"_74":75,"_76":75,"_77":78,"_79":-5,"_80":81,"_82":36,"_83":52,"_84":-5,"_85":-5,"_86":87,"_88":89,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":95,"_96":95,"_97":98,"_99":98,"_100":98,"_101":95,"_102":95,"_103":104,"_105":106,"_107":108,"_109":52},"tree",[55,56],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":54},"contents",[],"upstream","pull","ahead","behind","envVars","id","ec69da1f-6319-470b-b923-293453371f7f","fileId","01a08dc4-541e-71ad-a3de-d5dc0cc6009d","parentId","branchId","9417b8c9-6c32-44e9-8e58-7b83f1b0d9f4","branchVersion",6,"latest",true,"createdAt",["D",1789122852708],4,"fileType","http","content","import { createMcpHandler, McpServer } from \"npm:@modelcontextprotocol/server@2\";\nimport * as z from \"npm:zod@4/v4\";\n\nconst WEBSITE = \"https://sharded-cloud-e69hudu.shipstatic.com\";\nconst MCP_URL = \"https://agentia--01a08dc4541e71ada3ded5dc0cc6009d.web.val.run\";\nconst PAYPAL_EMAIL = \"danievilchezpayments@gmail.com\";\nconst PRICE_PER_CHECK_USD = 0.05;\n\ntype Check = { label: string; passed: boolean; detail: string; severity?: \"info\" | \"warning\" | \"critical\" };\ntype RedirectHop = { from: string; status: number; to: string };\n\nfunction isPrivateIp(ip: string) {\n const v = ip.toLowerCase();\n if (v === \"::1\" || v === \"::\" || v.startsWith(\"fc\") || v.startsWith(\"fd\") || v.startsWith(\"fe80:\")) return true;\n if (v.startsWith(\"::ffff:\")) return isPrivateIp(v.slice(7));\n const m = v.match(/^(\\d+)\\.(\\d+)\\.(\\d+)\\.(\\d+)$/);\n if (!m) return false;\n const a = Number(m[1]), b = Number(m[2]);\n return a === 0 || a === 10 || a === 127 || (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168);\n}\n\nasync function resolveDnsJson(host: string, type: \"A\" | \"AAAA\") {\n const r = await fetch(`https://dns.google/resolve?name=${encodeURIComponent(host)}&type=${type}`, { headers: { accept: \"application/dns-json\" } });\n if (!r.ok) throw new Error(\"DNS resolver unavailable.\");\n const data = await r.json() as { Answer?: Array<{ data?: string }> };\n return (data.Answer || []).map((a) => a.data || \"\").filter((v) => v && !v.endsWith(\".\"));\n}\n\nfunction normalizeInput(raw: string) {\n const value = raw.trim();\n if (!value) throw new Error(\"URL is required.\");\n const url = new URL(/^https?:\\/\\//i.test(value) ? value : `https://${value}`);\n if (![\"http:\", \"https:\"].includes(url.protocol)) throw new Error(\"Only HTTP/HTTPS URLs are supported.\");\n if (url.username || url.password) throw new Error(\"URLs containing credentials are not allowed.\");\n if (url.port && ![\"80\", \"443\"].includes(url.port)) throw new Error(\"Only standard web ports 80 and 443 are allowed.\");\n return url;\n}\n\nasync function assertPublic(url: URL) {\n const host = url.hostname.toLowerCase();\n if (host === \"localhost\" || host.endsWith(\".local\") || host.endsWith(\".internal\")) throw new Error(\"Private or local destinations are not allowed.\");\n if (/^\\d+\\.\\d+\\.\\d+\\.\\d+$/.test(host) && isPrivateIp(host)) throw new Error(\"Private or local destinations are not allowed.\");\n const [v4, v6] = await Promise.all([resolveDnsJson(host, \"A\"), resolveDnsJson(host, \"AAAA\")]);\n const ips = [...v4, ...v6];\n if (!ips.length) throw new Error(\"Domain did not resolve.\");\n if (ips.some(isPrivateIp)) throw new Error(\"Domain resolves to a private network.\");\n}\n\nasync function safeFetch(raw: string) {\n let current = normalizeInput(raw);\n const started = Date.now();\n const redirectChain: RedirectHop[] = [];\n\n for (let i = 0; i < 6; i++) {\n await assertPublic(current);\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), 12000);\n try {\n const response = await fetch(current.toString(), {\n redirect: \"manual\",\n signal: controller.signal,\n headers: {\n \"user-agent\": \"VIL-Reality-Check-MCP/0.5\",\n \"accept\": \"text/html,application/xhtml+xml,text/plain;q=0.9,*/*;q=0.5\",\n },\n });\n if ([301, 302, 303, 307, 308].includes(response.status)) {\n const location = response.headers.get(\"location\");\n if (!location) return { response, finalUrl: current.toString(), responseMs: Date.now() - started, redirectChain };\n const next = new URL(location, current);\n normalizeInput(next.toString());\n redirectChain.push({ from: current.toString(), status: response.status, to: next.toString() });\n current = next;\n continue;\n }\n return { response, finalUrl: current.toString(), responseMs: Date.now() - started, redirectChain };\n } finally {\n clearTimeout(timer);\n }\n }\n throw new Error(\"Too many redirects.\");\n}\n\nasync function readLimited(response: Response, limit = 750000) {\n if (!response.body) return { text: \"\", truncated: false, bytesRead: 0 };\n const reader = response.body.getReader();\n const decoder = new TextDecoder();\n let total = 0, out = \"\", truncated = false;\n while (total < limit) {\n const { done, value } = await reader.read();\n if (done) break;\n total += value.byteLength;\n out += decoder.decode(value, { stream: true });\n if (total >= limit) { truncated = true; break; }\n }\n try { await reader.cancel(); } catch {}\n return { text: out + decoder.decode(), truncated, bytesRead: total };\n}\n\nasync function sha256(text: string) {\n const bytes = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n return [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\").toUpperCase();\n}\n\nfunction stripHtml(html: string) {\n return html\n .replace(/]*>[\\s\\S]*?<\\/script>/gi, \" \")\n .replace(/]*>[\\s\\S]*?<\\/style>/gi, \" \")\n .replace(/<[^>]+>/g, \" \")\n .replace(/ /gi, \" \")\n .replace(/\\s+/g, \" \")\n .trim();\n}\n\nfunction recommendations(checks: Check[]) {\n const out: string[] = [];\n for (const c of checks) {\n if (c.passed) continue;\n if (c.label === \"HTTP status\") out.push(\"Fix the deployment or routing so the public URL returns HTTP 2xx/3xx.\");\n if (c.label === \"HTTPS\") out.push(\"Force HTTPS and redirect HTTP traffic to HTTPS.\");\n if (c.label === \"Response speed\") out.push(\"Reduce server response time, cold starts, or blocking upstream calls.\");\n if (c.label === \"Page title\") out.push(\"Add a meaningful so users and agents can identify the page.\");\n if (c.label === \"Visible content\") out.push(\"Ensure meaningful content is server-rendered or available without requiring client-side JavaScript.\");\n if (c.label === \"Security headers\") out.push(\"Add HSTS, CSP, X-Content-Type-Options, and clickjacking protection where appropriate.\");\n if (c.label === \"Soft 404\") out.push(\"Return a real 404 status for missing/error pages instead of HTTP 200.\");\n }\n return [...new Set(out)];\n}\n\nasync function verify(rawUrl: string) {\n const target = normalizeInput(rawUrl);\n const { response, finalUrl, responseMs, redirectChain } = await safeFetch(target.toString());\n const contentType = response.headers.get(\"content-type\") || \"unknown\";\n const textual = /text\\/|application\\/(xhtml\\+xml|json|xml|javascript)/i.test(contentType);\n const body = textual ? await readLimited(response) : { text: \"\", truncated: false, bytesRead: 0 };\n const html = body.text;\n const visibleText = stripHtml(html).slice(0, 150000);\n const titleMatch = html.match(/<title[^>]*>([\\s\\S]{0,300}?)<\\/title>/i);\n const title = titleMatch ? titleMatch[1].replace(/\\s+/g, \" \").trim() : null;\n const okStatus = response.status >= 200 && response.status < 400;\n const https = finalUrl.startsWith(\"https://\");\n const securityHeaders = [\"strict-transport-security\", \"content-security-policy\", \"x-content-type-options\", \"x-frame-options\"].filter((h) => response.headers.has(h));\n const soft404Pattern = /\\b(404|not found|page not found|doesn't exist|does not exist|no encontrada|no encontrado)\\b/i;\n const soft404 = response.status >= 200 && response.status < 300 && soft404Pattern.test([title || \"\", visibleText.slice(0, 3000)].join(\" \"));\n const jsShell = /text\\/html/i.test(contentType) && visibleText.length < 80 && /<script\\b/i.test(html);\n const meaningfulContent = !textual || visibleText.length >= 80 || html.length >= 300;\n const redirectCrossHost = redirectChain.some((h) => new URL(h.from).hostname !== new URL(h.to).hostname);\n\n const checks: Check[] = [\n { label: \"HTTP status\", passed: okStatus, detail: `HTTP ${response.status}`, severity: okStatus ? \"info\" : \"critical\" },\n { label: \"HTTPS\", passed: https, detail: https ? \"Encrypted final URL\" : \"Final URL is not HTTPS\", severity: https ? \"info\" : \"warning\" },\n { label: \"Response speed\", passed: responseMs < 2500, detail: `${responseMs} ms`, severity: responseMs < 2500 ? \"info\" : \"warning\" },\n { label: \"Page title\", passed: Boolean(title) || !/text\\/html/i.test(contentType), detail: title || (/text\\/html/i.test(contentType) ? \"No HTML title found\" : \"Not an HTML document\"), severity: \"warning\" },\n { label: \"Visible content\", passed: meaningfulContent, detail: jsShell ? \"Very little visible text; likely client-rendered SPA shell\" : `${visibleText.length} visible characters`, severity: meaningfulContent ? \"info\" : \"critical\" },\n { label: \"Security headers\", passed: securityHeaders.length >= 2, detail: `${securityHeaders.length}/4 detected`, severity: securityHeaders.length >= 2 ? \"info\" : \"warning\" },\n { label: \"Soft 404\", passed: !soft404, detail: soft404 ? \"Page looks like an error page but returned a success status\" : \"No soft-404 signal detected\", severity: soft404 ? \"critical\" : \"info\" },\n ];\n\n let score = 0;\n score += okStatus ? 30 : 0;\n score += https ? 15 : 0;\n score += responseMs < 1000 ? 15 : responseMs < 2500 ? 12 : responseMs < 5000 ? 6 : 0;\n score += (title || !/text\\/html/i.test(contentType)) ? 8 : 0;\n score += meaningfulContent ? 12 : 0;\n score += Math.min(12, securityHeaders.length * 3);\n score += !soft404 ? 8 : 0;\n if (jsShell) score = Math.max(0, score - 8);\n if (soft404) score = Math.min(score, 45);\n if (!okStatus) score = Math.min(score, 40);\n score = Math.min(100, Math.max(0, score));\n\n const verdict = score >= 85 ? \"PASS\" : score >= 60 ? \"REVIEW\" : \"FAIL\";\n const checkedAt = new Date().toISOString();\n const stableEvidence = [target.toString(), finalUrl, response.status, title || \"\", contentType, body.bytesRead, redirectChain.map((h) => `${h.status}:${h.to}`).join(\">\"), await sha256(html)].join(\"|\");\n const evidenceHash = (await sha256(stableEvidence)).slice(0, 32);\n const checkId = (await sha256(`${evidenceHash}|${checkedAt}|${responseMs}`)).slice(0, 20);\n\n return {\n ok: true,\n product: \"VIL Reality Check\",\n version: \"0.5.0\",\n score,\n verdict,\n grade: score >= 95 ? \"A+\" : score >= 85 ? \"A\" : score >= 75 ? \"B\" : score >= 60 ? \"C\" : score >= 45 ? \"D\" : \"F\",\n url: target.toString(),\n finalUrl,\n status: response.status,\n responseMs,\n title,\n contentType,\n bytesRead: body.bytesRead,\n bodyTruncated: body.truncated,\n visibleCharacters: visibleText.length,\n redirectChain,\n redirectCrossHost,\n checkedAt,\n evidenceHash,\n checkId,\n checks,\n recommendations: recommendations(checks),\n note: \"Evidence hash is stable for the retrieved representation; checkId identifies this specific run.\",\n };\n}\n\nconst handler = createMcpHandler(() => {\n const server = new McpServer(\n { name: \"VIL Reality Check\", version: \"0.5.0\", websiteUrl: WEBSITE },\n {\n instructions: \"Use VIL Reality Check before claiming a public website or AI-generated deployment works. Prefer check_deployment for one URL and check_deployments for batches. PASS means strong basic availability evidence; REVIEW means reachable but with material warnings; FAIL means the result could not be confidently verified. This is not a full browser, accessibility, penetration, or business-logic test.\",\n },\n );\n\n server.registerTool(\n \"check_deployment\",\n {\n title: \"Verify a website or deployment\",\n description: \"Verify a public website/deployment and return HTTP status, redirects, HTTPS, response time, content signals, soft-404 detection, security headers, score, verdict, recommendations, stable evidence hash, and per-run check ID.\",\n inputSchema: z.object({ url: z.string().min(1).describe(\"Public HTTP/HTTPS URL or domain to verify\") }),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },\n },\n async ({ url }) => {\n try {\n const result = await verify(url);\n const recs = result.recommendations.length ? `\\nNext: ${result.recommendations.slice(0, 3).join(\" | \")}` : \"\";\n return {\n content: [{ type: \"text\", text: `${result.verdict} — ${result.score}/100 (${result.grade})\\nHTTP ${result.status} • ${result.responseMs} ms\\n${result.finalUrl}\\nEvidence: ${result.evidenceHash}\\nCheck ID: ${result.checkId}${recs}` }],\n structuredContent: result,\n };\n } catch (e) {\n const message = e instanceof Error ? e.message : \"Verification failed\";\n return { isError: true, content: [{ type: \"text\", text: message }], structuredContent: { ok: false, error: message } };\n }\n },\n );\n\n server.registerTool(\n \"check_deployments\",\n {\n title: \"Verify multiple deployments\",\n description: \"Verify 1-10 public URLs in one request and return a compact portfolio summary plus detailed results.\",\n inputSchema: z.object({\n urls: z.array(z.string().min(1)).min(1).max(10).describe(\"1 to 10 public HTTP/HTTPS URLs or domains\"),\n }),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },\n },\n async ({ urls }) => {\n const results = await Promise.all(urls.map(async (url) => {\n try { return await verify(url); }\n catch (e) { return { ok: false, url, verdict: \"FAIL\", score: 0, error: e instanceof Error ? e.message : \"Verification failed\" }; }\n }));\n const pass = results.filter((r: any) => r.ok && r.verdict === \"PASS\").length;\n const review = results.filter((r: any) => r.ok && r.verdict === \"REVIEW\").length;\n const fail = results.length - pass - review;\n const summary = { total: results.length, pass, review, fail };\n return {\n content: [{ type: \"text\", text: `Batch complete — ${pass} PASS, ${review} REVIEW, ${fail} FAIL out of ${results.length}.` }],\n structuredContent: { ok: true, summary, results },\n };\n },\n );\n\n server.registerTool(\n \"compare_deployments\",\n {\n title: \"Compare two deployments\",\n description: \"Verify and compare two public deployments, such as preview vs production. Reports whether their retrieved representations match and highlights score, status, title, final URL, and evidence differences.\",\n inputSchema: z.object({\n firstUrl: z.string().min(1).describe(\"First public deployment URL\"),\n secondUrl: z.string().min(1).describe(\"Second public deployment URL\"),\n }),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },\n },\n async ({ firstUrl, secondUrl }) => {\n try {\n const [first, second] = await Promise.all([verify(firstUrl), verify(secondUrl)]);\n const sameEvidence = first.evidenceHash === second.evidenceHash;\n const differences = {\n score: first.score === second.score ? null : { first: first.score, second: second.score },\n status: first.status === second.status ? null : { first: first.status, second: second.status },\n title: first.title === second.title ? null : { first: first.title, second: second.title },\n finalUrl: first.finalUrl === second.finalUrl ? null : { first: first.finalUrl, second: second.finalUrl },\n evidence: sameEvidence ? null : { first: first.evidenceHash, second: second.evidenceHash },\n };\n const changedFields = Object.entries(differences).filter(([, value]) => value !== null).map(([key]) => key);\n return {\n content: [{\n type: \"text\",\n text: sameEvidence\n ? `MATCH — both deployments produced the same evidence hash.\\n${first.evidenceHash}`\n : `DIFFERENT — deployments do not match.\\nChanged: ${changedFields.join(\", \")}\\nFirst: ${first.verdict} ${first.score}/100\\nSecond: ${second.verdict} ${second.score}/100`,\n }],\n structuredContent: { ok: true, sameEvidence, changedFields, differences, first, second },\n };\n } catch (e) {\n const message = e instanceof Error ? e.message : \"Comparison failed\";\n return { isError: true, content: [{ type: \"text\", text: message }], structuredContent: { ok: false, error: message } };\n }\n },\n );\n\n server.registerTool(\n \"get_service_info\",\n {\n title: \"VIL Reality Check service info\",\n description: \"Returns connection and payment information for VIL Reality Check.\",\n inputSchema: z.object({}),\n annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },\n },\n async () => ({\n content: [{ type: \"text\", text: `VIL Reality Check MCP: ${MCP_URL}\\nWebsite: ${WEBSITE}\\nPaid use price: $${PRICE_PER_CHECK_USD.toFixed(2)} USD per premium check\\nPayment method: PayPal direct payment to ${PAYPAL_EMAIL}\\nAutomatic payment verification is not enabled yet; do not claim a payment has been verified automatically.` }],\n structuredContent: {\n name: \"VIL Reality Check\",\n version: \"0.5.0\",\n website: WEBSITE,\n mcpUrl: MCP_URL,\n paidUse: {\n priceUsdPerCheck: PRICE_PER_CHECK_USD,\n method: \"PayPal direct\",\n recipient: PAYPAL_EMAIL,\n automaticVerification: false,\n },\n },\n }),\n );\n\n return server;\n});\n\nexport default handler.fetch;","deleted",false,"label",[19],{"_33":61,"_13":62,"_35":63,"_37":-5,"_38":39,"_40":64,"_42":43,"_44":65,"_17":66,"_47":24,"_49":67,"_51":52,"_53":-5,"_58":68,"_18":69},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":57,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_58":59,"_18":60},["D",1789122852708],"children",[],[19],"33879948-d295-4fc4-b34d-864049de940f","README.md","01a08dc4-541e-71ad-a3de-d07bdb0a2e0a",7,["D",1789122864432],2,"# VIL Reality Check MCP\n\nRemote MCP service for independently verifying public websites and AI-generated deployments.\n\n## Live MCP endpoint\n\nhttps://agentia--01a08dc4541e71ada3ded5dc0cc6009d.web.val.run\n\n## Current version\n\n0.5.0\n\n## Tools\n\n### check_deployment(url)\nVerifies one public HTTP/HTTPS deployment and returns:\n- HTTP status\n- redirect chain\n- HTTPS\n- response time\n- page title\n- visible-content signal\n- soft-404 detection\n- security-header signal\n- score / grade / PASS-REVIEW-FAIL\n- actionable recommendations\n- stable evidenceHash\n- unique checkId\n\n### check_deployments(urls)\nVerifies 1-10 deployments in a single call and returns a PASS / REVIEW / FAIL summary plus detailed results.\n\n### compare_deployments(firstUrl, secondUrl)\nChecks preview vs production or any two public deployments and reports whether their retrieved evidence matches.\n\n### get_service_info()\nReturns MCP connection and payment information.\n\n## Payment\n\nPaid-use target: $0.05 USD per premium check.\nPayment method: direct PayPal payment to danievilchezpayments@gmail.com.\nAutomatic PayPal payment verification is NOT currently enabled.\n\n## Security\n\n- blocks localhost and private-network destinations\n- rejects URLs with embedded credentials\n- limits checks to ports 80/443\n- validates redirect destinations\n- caps downloaded response bodies\n- uses DNS-over-HTTPS preflight checks\n\nNote: VIL Reality Check is a deployment verification layer, not a penetration test or full browser/business-logic test.\n\n## Regression tests\n\n- healthy public URL: PASS\n- real HTTP 404: FAIL\n- localhost/private target: blocked\n- batch verification: PASS\n- repeat evidence hash: stable\n- same-deploy comparison: MATCH\n",[],[62],"23e033e1-d86a-46c2-a6d0-a247bc6e1c2a",["D",1789084849126],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Remote MCP for VIL Reality Check","imageUrl","userId","b162e777-26d5-4b57-b5d4-824de1b425e2","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a087a7-039d-766a-a2cb-d9a1a861d44b","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_125":121},"org",{"_11":12,"_118":119,"_120":121,"_80":81,"_122":123,"_124":52},"branch",{"_17":64,"_13":16,"_33":39,"_110":70,"_111":-5,"_112":-5,"_113":-5,"_114":-5,"_115":-5,"_116":14,"_117":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Agent Ia","avatar","https://lh3.googleusercontent.com/a/ACg8ocJFdiW2REahwLO-JAErcTTOgHyYDVN6VBKDk9RmathkK-sumQ=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":70,"_13":14,"_44":162,"_72":-5,"_73":52,"_74":75,"_76":75,"_77":78,"_79":-5,"_80":81,"_82":36,"_83":52,"_84":-5,"_85":-5,"_86":87,"_88":89,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":95,"_96":95,"_97":98,"_99":98,"_100":98,"_101":95,"_102":95,"_103":163,"_105":164,"_107":165,"_109":52},[156,157],"files",[156,157],"counts",{"_146":87,"_147":148,"_149":87,"_32":150,"_151":152},[],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":145},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],"pulls","branches",1,"forks",{"_153":87,"_155":87},"connections",{"_153":87,"_154":87},"count","unfilledCount","emptyCount",{"_33":61,"_13":62,"_35":63,"_37":-5,"_38":39,"_40":64,"_42":43,"_44":65,"_17":66,"_47":24,"_49":67,"_51":52,"_53":-5,"_58":160,"_18":161},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":57,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_58":158,"_18":159},[],[19],[],[62],["D",1789084849126],{"_11":12,"_125":121},{"_11":12,"_118":119,"_120":121,"_80":81,"_122":123,"_124":52},{"_17":64,"_13":16,"_33":39,"_110":70,"_111":-5,"_112":-5,"_113":-5,"_114":-5,"_115":-5,"_116":14,"_117":12},"ctx",{"_103":-5,"_142":199,"_200":201,"_202":203,"_204":52,"_205":52,"_206":52,"_207":43,"_208":-5,"_209":-7,"_210":-7,"_211":87,"_212":52,"_213":52,"_214":-5,"_215":52,"_216":52,"_217":52,"_218":-5},"ENV",{"_170":171,"_172":173,"_174":16,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"] </article></body></html>