AVAILABLE

Security

Unicode Confusable & Invisible Guard

Inspect, normalize, compare, and policy-check Unicode text with checksum-verified Unicode 17 data, exact code-point evidence, and no model call or payload storage.

Get an API key on RapidAPIOpenAPI →

CONTRACT

Predictable for agents. Legible for reviewers.

REST
POST /v1/unicode/inspect
MCP tool
inspect_unicode_text
Inputs
Up to 256 KiB of supplied text for inspection or normalization, two identifiers up to 8 KiB each for comparison, or one candidate plus up to 100 protected identifiers and a caller-supplied script policy.
Returns
CLEAR, REVIEW_REQUIRED, or BLOCKED with code-point and UTF-8 offsets, safe code-point evidence, normalization change maps, Unicode 17 UTS #39 skeleton results, XID and identifier-status checks, and an agent-readable next action.
Latency
Synchronous
Usage unit
Unicode security operation

The focused suite also exposes /v1/unicode/normalize, /v1/unicode/confusables/compare, and /v1/unicode/identifiers/check plus the separate /mcp/unicode server. It pins and checksum-verifies official Unicode 17.0.0 security, script, identifier-status, and derived-property files under the Unicode-3.0 data license. It never silently strips characters. Mixed scripts can be legitimate, normalization can be application-sensitive, and UTS #39 skeleton equality does not guarantee identical appearance in every font or prove malicious intent.

AGENT-READABLE EXCEPTIONS

UNICODE_INPUT_TOO_LARGEUNICODE_FINDING_LIMIT_EXCEEDEDUNICODE_CHANGE_LIMIT_EXCEEDEDUNICODE_SCRIPT_UNKNOWNCONFUSABLE_COLLISIONIDENTIFIER_XID_INVALIDIDENTIFIER_STATUS_RESTRICTEDPROTECTED_IDENTIFIER_CONFUSABLE
HTTP request
POST /v1/unicode/confusables/compare
Authorization: Bearer apc_...
Content-Type: application/json

{
  "left": "paypal",
  "right": "paypаl"
}
cURL (bash)
curl --request POST \
  --url 'https://api-production-9502.up.railway.app/v1/unicode/confusables/compare' \
  --header 'Authorization: Bearer ${AP_CONTROL_API_KEY}' \
  --header 'Content-Type: application/json' \
  --data '{
  "left": "paypal",
  "right": "paypаl"
}'
Representative response
{
  "status": "COMPLETED",
  "decision": "BLOCKED",
  "exact_equal": false,
  "canonical_equal": false,
  "confusable": true,
  "skeleton_equal": true,
  "left_skeleton": "paypal",
  "right_skeleton": "paypal",
  "left_scripts": [
    "Latin"
  ],
  "right_scripts": [
    "Cyrillic",
    "Latin"
  ],
  "left_mapped_codepoints": 0,
  "right_mapped_codepoints": 1,
  "issues": [
    {
      "code": "CONFUSABLE_COLLISION",
      "severity": "HIGH",
      "message": "The distinct inputs have the same Unicode 17 UTS #39 skeleton.",
      "evidence": {
        "canonical_equal": false,
        "skeleton_equal": true
      },
      "next_action": "Do not treat the identifiers as independent identities without an authorized manual or registry-level check."
    }
  ],
  "unicode_version": "17.0.0",
  "ruleset_version": "2026-08-10",
  "visual_guarantee": false,
  "next_action": "Reject or review the collision against the authoritative identifier owner; font-dependent appearance is not guaranteed."
}
Pinned Unicode 17 dataOfficial confusables, script, identifier-status, and derived-property files are versioned and checksum-verified.
Exact, non-text evidenceFindings expose code-point and UTF-8 offsets plus U+ values without repeating the suspicious token.
No visual verdictMixed scripts can be legitimate and rendering is font-dependent; skeleton equality is evidence, not proof of malicious intent.

Use Unicode Confusable & Invisible Guard through RapidAPI.

Choose a capped marketplace plan, copy the generated request, and route the structured result through your own authorized workflow.

Get an API key on RapidAPICompare marketplace controls →