context safety score
A score of 79/100 indicates minor risk signals were detected. The entity may be legitimate but has characteristics that warrant attention.
phishing
Page impersonates Google sign-in with credential form
credential harvesting
The URL being scanned is https://inoreader.com/feed/https://cointelegraph.com/rss, but the page served is the Inoreader login page (Sign in | Inoreader) rather than an RSS feed. The login form collects username (email) and password and POSTs to /login. A user or agent expecting RSS feed content is instead presented with a credential collection form. This is consistent with a login-wall redirect that captures credentials under the guise of accessing feed content. (location: page.html:525-650, form#login_form action='/login')
malicious redirect
Navigating to /feed/https://cointelegraph.com/rss redirected (2 redirects per .brin-context.md) to the login page at /login with a sendback parameter encoding the original feed URL (/feed/https:/cointelegraph.com/rss). While this is a standard authentication gate pattern, it can be exploited to redirect agents or users to attacker-controlled pages via an open sendback/redirect parameter that is not validated for off-domain destinations. The sendback value is embedded in hidden form input and multiple href links. (location: page.html:528, input[name=sendback] value='/feed/https:/cointelegraph.com/rss')
hidden content
A commented-out Facebook login button is present in the HTML source (page-hidden.txt lines 41-50). While this appears to be a disabled feature rather than an active threat, it retains a live app_id ('234271153382050') and a hardcoded OAuth state token ('5a6e280b9a12af759a251d2a805a7d6a'). Hardcoded OAuth state values in commented code could be harvested for CSRF or OAuth flow abuse if accidentally re-enabled. (location: page.html:570-581, page-hidden.txt:41-50)
curl https://api.brin.sh/page/inoreader.com%2Ffeed%2Fhttps%253A%2F%2Fcointelegraph.com%2FrssCommon questions teams ask before deciding whether to use this web page in agent workflows.
inoreader.com/feed/https%3A//cointelegraph.com/rss currently scores 79/100 with a caution verdict and medium confidence. The goal is to protect agents from high-risk context before they act on it. Treat this as a decision signal: higher scores suggest lower observed risk, while lower scores mean you should add review or block this web page.
Use the score as a policy threshold: 80–100 is safe, 50–79 is caution, 20–49 is suspicious, and 0–19 is dangerous. Teams often auto-allow safe, require human review for caution/suspicious, and block dangerous.
brin evaluates four dimensions: identity (source trust), behavior (runtime patterns), content (malicious instructions), and graph (relationship risk). Analysis runs in tiers: static signals, deterministic pattern checks, then AI semantic analysis when needed.
Identity checks source trust, behavior checks unusual runtime patterns, content checks for malicious instructions, and graph checks risky relationships to other entities. Looking at sub-scores helps you understand why an entity passed or failed.
brin performs risk assessments on external context before it reaches an AI agent. It scores that context for threats like prompt injection, hijacking, credential harvesting, and supply chain attacks, so teams can decide whether to block, review, or proceed safely.
No. A safe verdict means no significant risk signals were detected in this scan. It is not a formal guarantee; assessments are automated and point-in-time, so combine scores with your own controls and periodic re-checks.
Re-check before high-impact actions such as installs, upgrades, connecting MCP servers, executing remote code, or granting secrets. Use the API in CI or runtime gates so decisions are based on the latest scan.
Learn more in threat detection docs, how scoring works, and the API overview.
Assessments are automated and may contain errors. Findings are risk indicators, not confirmed threats. This is a point-in-time assessment; security posture can change.
integrate brin in minutes — one GET request is all it takes. query the api, browse the registry, or download the full dataset.