# Surface

Unwrap a short link (t.co, bit.ly, lnkd.in, youtu.be) before an agent fetches it.
We return verdict (fetch | dead | wall | trap) and next (fetch | skip).
We never return the page body. Private hosts are refused.

## Endpoints

- GET /v1/preflight?url=https://t.co/...
- POST /v1/preflight  JSON {"url":"https://bit.ly/..."}
- POST /mcp            MCP (tool: preflight_url)
- GET /v1/inspect      classify the caller (bot / browser / script)
- GET /h/:code        302 hop (allow-listed hosts only)
- GET /px/:code       1x1 GIF
- POST /v1/event      ingest

## Preflight fields

- next: "fetch" or "skip" — agents can ignore the rest
- unwrapped: true if a shortener landed on another host
- from_host / final_host / final_url
- verdict: fetch | dead | wall | trap

## Try

- /start  paste a short link and run preflight
- /docs   API notes
- /mcp    POST JSON-RPC (initialize, tools/list, tools/call)

CORS is open. Optional Bearer key. Missing key bills the demo meter.