> For clean Markdown of this page, append .md to its URL. For the complete documentation index, see https://www.superagent.sh/llms.txt.


Score Web pages, public text files, and PDFs before agents read or embed them.

# Web pages and files

## Web pages

Score a URL before an agent fetches or summarizes the page. Superagent checks who owns the domain, how the page behaves, and what the visible and hidden text says.

### How scoring works

A page scan checks identity and static content, renders fetchable pages, and then triages them:

1. **Identity** — domain age (RDAP), TLS certificate, registrar reputation, hosting ASN, and optional blocklists (URLhaus, Google Web Risk, PhishTank).
2. **Static analysis** — redirect chains, hidden DOM, deceptive links, password inputs, prompt-injection and exfiltration patterns, and obfuscated JavaScript. A password input, even outside a form, prevents an otherwise trusted page from skipping review; it does not by itself make the page dangerous.
3. **Browser capture** — Kernel headless Chrome renders safely fetched page content offline, with scripts and network access disabled. If Kernel is unavailable, static HTML is retained.
4. **Security-One triage** — Security-One receives identity and page signals, deterministic findings, and bounded visible, hidden, and decoded text from the browser capture (or static HTML when unavailable). It runs even for deterministic hard passes and hard fails; blocked hosts and unsafe fetches are triaged without fetching or rendering page content. For fully captured pages, its benign result skips the deeper LLM review; risky results escalate. Blocklist, private-network blocks, and deterministic hard fails remain authoritative. If content capture is incomplete or triage fails, the conservative fallback applies. Superagent manages the credential; customers do not need a Security-One key.
5. **Deeper review when needed** — GPT-5.6 Luna Pro via OpenRouter assesses the captured visible and hidden text if Security-One escalates or the fallback requires it.

A blocklisted host still scores `0` / `dangerous` without fetching or rendering it. New lookups return a preliminary identity score immediately and finish the deep scan in the background. Pass `mode=full` when you need the completed result in one request.

### Identifier

The identifier is a hostname (`example.com` fetches `https://example.com/`) or a hostname plus path (`example.com/docs`). Hostnames are case-insensitive. Paths may include additional `/` segments.

### Use it

- **Dashboard**: open **Agents → Context**, paste a URL, and open the result for identity, behavior, and content scores.
- **REST API**: `GET /api/v1/context/web_page/{identifier}`. See the [Context Guardrails API](https://www.superagent.sh/docs/api/context-guardrails).
- **MCP**: `get_context_score`.

```bash
curl "https://superagent.sh/api/v1/context/web_page/example.com?details=true" \
  -H "Authorization: Bearer sk_live_..."
```

```bash
curl "https://superagent.sh/api/v1/context/web_page/example.com/docs?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..."
```

## Files

Score a public HTTP or HTTPS file before an agent opens it, embeds it, or treats it as instructions. Superagent checks the source, extracts a bounded text representation, and reviews that text for injection and exfiltration.

### How scoring works

A completed file scan checks the source, extracts text, and triages it before deeper review:

1. **Identity** — source domain age, TLS, hosting, and blocklists.
2. **Secure extraction and static analysis** — DNS pinned download with redirect validation, type consistency checks, bounded extraction for text formats and PDFs, and deterministic prompt-injection, exfiltration, social-engineering, and encoded-payload checks.
3. **Security-One triage** — Security-One receives bounded extracted and decoded text plus file metadata, identity and static-analysis signals, and deterministic findings. A valid low-risk result can skip the chunked LLM review only when the extracted content and triage context are complete and no deterministic findings exist. Risky results, deterministic findings, incomplete capture, or an unavailable or invalid triage fall back to chunked LLM review. Blocklisted sources remain blocked without downloading the file; unscannable files retain their dangerous result. Preliminary scans do not call Security-One. Superagent manages the credential; customers do not need a Security-One key.
4. **Deeper review when needed** — the LLM checks file chunks for additional threats.

File bytes are never stored. The identifier is the lowercase SHA-256 hex digest of the normalized URL.

### Supported files

Supported files include UTF-8 text, HTML, JSON, XML, CSV, CSS, JavaScript, Markdown, YAML, SQL, and PDFs with extractable text. Downloads are limited to 25 MB.

Images, Office documents, archives, encrypted PDFs, and PDFs that require OCR are reported as unscannable instead of safe. Invalid URLs and unsupported types return a dangerous result or `400 invalid_request`, depending on whether validation fails before the scan starts.

### Threats

When `details=true` or the verdict is `suspicious` / `dangerous`, file scans may emit `file_unscannable`, `mime_mismatch`, `encoded_payload`, `redirect_chain`, extraction errors, and prompt-injection or exfiltration types shared with other origins.

### Use it

- **Dashboard**: open **Agents → Context**, paste a public file URL, and open the result for identity, behavior, and content scores.
- **REST API**: `POST /api/v1/context/file` to score a URL and `GET /api/v1/context/file/{identifier}` to look up a previous result by SHA-256. See the [Context Guardrails API](https://www.superagent.sh/docs/api/context-guardrails).
- **MCP**: `scan_file`.

```bash
curl "https://superagent.sh/api/v1/context/file?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"url":"https://example.com/security-guidance.pdf"}'
```

```bash
curl "https://superagent.sh/api/v1/context/file/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."
```

`GET` never starts a new scan.

## Next steps

- [Check email and messages](https://www.superagent.sh/docs/security-workers/agent-guardrails/email-and-messages)
- [Use the Context Guardrails API](https://www.superagent.sh/docs/api/context-guardrails)
- [Return to Context Guardrails](https://www.superagent.sh/docs/security-workers/agent-guardrails/context)

---
Source: https://www.superagent.sh/docs/security-workers/agent-guardrails/web-and-files
Index: https://www.superagent.sh/llms.txt