GlyphGuard

Working · 747 ms

dev.workers.mike-tusa.glyphguard/glyphguardv0.1.0 Domain verified

Find hidden Unicode (zero-width, bidi, tag payloads), homoglyphs and lookalike names in text.

Security

Website Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://glyphguard.mike-tusa.workers.dev/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

clean_text Read-only

Return the text with invisible characters, bidi controls, tag characters and control characters removed and unusual spaces turned into normal spaces. By default ZWJ/ZWNJ/VS16 are kept inside emoji sequences, between letters of joining scripts (Arabic, Persian) and after an Indic virama (keep_joiners=true); strict=true removes them everywhere. Optional: map lookalike letters to Latin (lookalikes) and apply NFKC normalisation (nfkc). Read-only. Same engine as GET /api/clean.

textstring, required

Text to inspect (up to 2000 UTF-16 code units).

nfkcboolean

Apply Unicode NFKC first (fullwidth and math letters → plain).

spacesboolean

Turn unusual spaces into a normal space.

strictboolean

Strict mode: remove every joiner and variation selector, even in emoji and Persian/Indic text (overrides keep_joiners).

lookalikesboolean

Map lookalike letters (e.g. Cyrillic а) to Latin. Changes legitimate non-Latin text too.

keep_joinersboolean

Keep ZWJ/ZWNJ/VS16 where they are legitimate: emoji ZWJ sequences and VS16 emoji presentation, between letters of joining scripts (Arabic, Persian), and after an Indic virama. Joiners elsewhere are always removed.

Tools (3)

clean_text

read-only

Argument	Type	Description
nfkc	boolean	Apply Unicode NFKC first (fullwidth and math letters → plain).
text*	string	Text to inspect (up to 2000 UTF-16 code units).
spaces	boolean	Turn unusual spaces into a normal space.
strict	boolean	Strict mode: remove every joiner and variation selector, even in emoji and Persian/Indic text (overrides keep_joiners).
lookalikes	boolean	Map lookalike letters (e.g. Cyrillic а) to Latin. Changes legitimate non-Latin text too.
keep_joiners	boolean	Keep ZWJ/ZWNJ/VS16 where they are legitimate: emoji ZWJ sequences and VS16 emoji presentation, between letters of joining scripts (Arabic, Persian), and after an Indic virama. Joiners elsewhere are always removed.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "text"
  ],
  "properties": {
    "nfkc": {
      "type": "boolean",
      "default": false,
      "description": "Apply Unicode NFKC first (fullwidth and math letters → plain)."
    },
    "text": {
      "type": "string",
      "maxLength": 2000,
      "minLength": 1,
      "description": "Text to inspect (up to 2000 UTF-16 code units)."
    },
    "spaces": {
      "type": "boolean",
      "default": true,
      "description": "Turn unusual spaces into a normal space."
    },
    "strict": {
      "type": "boolean",
      "default": false,
      "description": "Strict mode: remove every joiner and variation selector, even in emoji and Persian/Indic text (overrides keep_joiners)."
    },
    "lookalikes": {
      "type": "boolean",
      "default": false,
      "description": "Map lookalike letters (e.g. Cyrillic а) to Latin. Changes legitimate non-Latin text too."
    },
    "keep_joiners": {
      "type": "boolean",
      "default": true,
      "description": "Keep ZWJ/ZWNJ/VS16 where they are legitimate: emoji ZWJ sequences and VS16 emoji presentation, between letters of joining scripts (Arabic, Persian), and after an Indic virama. Joiners elsewhere are always removed."
    }
  },
  "additionalProperties": false
}

compare_names

Check whether a name, username, domain label or brand looks the same as any of up to 50 protected names (for example "pаypal" with a Cyrillic а vs "paypal"), using a UTS #39-style confusable skeleton (curated subset, case and accents ignored). Read-only. Same engine as GET /api/compare.

read-only

Argument	Type	Description
name*	string	Name, username, domain label or brand to test.
targets*	array	1 to 50 protected names.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "name",
    "targets"
  ],
  "properties": {
    "name": {
      "type": "string",
      "maxLength": 128,
      "minLength": 1,
      "description": "Name, username, domain label or brand to test."
    },
    "targets": {
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 128,
        "minLength": 1
      },
      "maxItems": 50,
      "minItems": 1,
      "description": "1 to 50 protected names."
    }
  },
  "additionalProperties": false
}

scan_text

Find invisible characters, bidi controls (Trojan Source), hidden Unicode tag payloads (decoded), variation-selector runs, control characters, unusual spaces, mixed-script words and lookalike letters. ZWJ/ZWNJ/VS16 in legitimate context (emoji sequences, Persian/Arabic joining, Indic virama) are reported as info joiner_in_context and do not raise risk; elsewhere they stay medium. Lone surrogates are flagged. Returns a risk level (none/low/medium/high), counts, and findings with UTF-16 offsets and code points. Read-only. Same engine as GET /api/scan.

read-only

Argument	Type	Description
text*	string	Text to inspect (up to 2000 UTF-16 code units).

Input schema (JSON)

{
  "type": "object",
  "required": [
    "text"
  ],
  "properties": {
    "text": {
      "type": "string",
      "maxLength": 2000,
      "minLength": 1,
      "description": "Text to inspect (up to 2000 UTF-16 code units)."
    }
  },
  "additionalProperties": false
}