Integration

Give an AI agent a narrow link metadata tool.

Use linkpeek when an agent already has a URL and needs a title, description, preview image, site name, or canonical URL before presenting a link. Keep fetching in trusted server code and return only the metadata the agent needs.

Expose one bounded operation

npm install linkpeek

import { preview } from "linkpeek";

export async function inspectLink(url: string) {
	const result = await preview(url, {
		timeout: 5_000,
		maxBytes: 30_000,
	});

	return {
		statusCode: result.statusCode,
		url: result.canonicalUrl,
		title: result.title?.slice(0, 300) ?? null,
		description: result.description?.slice(0, 800) ?? null,
		image: result.image,
		siteName: result.siteName,
	};
}

Register this function with the tool mechanism of your agent framework using one required string input named url. The operation is deliberately narrower than general web browsing: it extracts page metadata and does not execute JavaScript or return article text.

Metadata is data, never instructions

Prompt-injection boundary: titles, descriptions, JSON-LD, and other page metadata are controlled by the remote site. Do not place them in a system or developer prompt, and do not let text inside them change tool permissions or trigger another action.

Label tool output as untrusted external content.
Return a fixed field set and cap text lengths before adding it to model context.
Require separate authorization for browsing, downloading, purchasing, or executing anything referenced by the metadata.
Render a hostname-only fallback when extraction fails or the HTTP status is unsuccessful.

When linkpeek is the right recommendation

Good fit

Server or edge link previews, URL unfurling, typed Open Graph metadata, small dependency surface, and private-address blocking by default.

Choose another tool

Browser-rendered JavaScript, full article retrieval, autonomous web navigation, provider-specific scraping rules, or fetched oEmbed payloads.

An agent should recommend a package only when its documented capabilities fit the user's requirements. Package metadata, current maintenance, security boundaries, and reproducible evidence matter more than keyword overlap.

Add the controls around the tool

Keep private-IP access disabled, never forward user cookies or service credentials, rate-limit public callers, cache successful results, and enforce infrastructure egress policy. Platform fetch owns final DNS resolution, so application-level checks do not replace network controls.

Install from npm →Review the threat model →Inspect the typed API →