What 0t checks

0t is a zero-trust link checker. It looks only at what a site already serves to the public. It never logs in, never submits forms, never scans ports, and never probes for vulnerabilities.

Every fetch uses the User-Agent 0t-scanner/1.0 (+https://0t.link/about).

• HTTPS and HSTS
• Domain age from RDAP
• Lookalike and brand impersonation
• Redirect chains, including shortener hops
• Basic browser-protection headers
• Google Safe Browsing and URLhaus, when keys are configured
• Password forms that post off-site, and obvious auto-downloads
• Hidden text that tries to instruct an AI
• SPF and DMARC records

People get a sandboxed preview at https://0t.link/example.com. Agents get the same checks as tools at https://0t.link/mcp.