ScanMalware MCP
A hosted Model Context Protocol server for scanmalware.com. AI assistants and agents can submit URLs for scanning, read the verdict and the evidence behind it, and pivot from one phishing page to the rest of its campaign across the public scan archive. No API key or sign-in is needed.
Get it
Claude
Add ScanMalware from Claude’s connector directory.
Open in ClaudeChatGPT
Add ScanMalware from ChatGPT’s plugin directory.
Open in ChatGPTClaude Code
The ScanMalware plugin adds the server and a skill for pivoting through phishing infrastructure:
/plugin marketplace add scanmalware/scanmalware-plugin
/plugin install scanmalware@scanmalwareOnly the server:
claude mcp add --transport http scanmalware https://mcp.scanmalware.com/mcpCodex
The same plugin, from its marketplace:
codex plugin marketplace add scanmalware/scanmalware-plugin
codex plugin add scanmalware@scanmalwareGemini CLI
The plugin as a Gemini CLI extension:
gemini extensions install https://github.com/scanmalware/scanmalware-pluginAny MCP client
Add a remote server over Streamable HTTP, with no key or sign-in:
https://mcp.scanmalware.com/mcpWhat it can do
More than 140 tools, all read-only except submitting a scan and voting on one:
- Scanning: submit a URL, wait for it to finish, and read its summary, full result, AI analysis and screenshot.
- Evidence for one scan: indicators of compromise, hunting-rule matches, IDS alerts, TLS and JARM details, technologies, registration data, DNS answers, clipboard and pastejacking events, OCR text and network capture details.
- Search and pivots: advanced search with facets and counts, DNS history and reverse DNS, searches by IP address, network, nameserver, favicon, JARM, screenshot and fuzzy hashes, a scan’s searchable values, a side-by-side comparison of up to 20 scans, and the hosts seen for a domain.
- Certificate Transparency: certificates, subdomains, domains seen on an IP address, lookalike domains and certificate history.
- JavaScript and files: script fingerprints and libraries, what deobfuscating a script revealed and its decoded source, checks for pasted shell commands, and the analysis of files a page delivered.
tools/list returns the current set. Resources serve screenshots (PNG), certificates (PEM), packet captures and RSS feeds.
Scan visibility
Every scan submission must choose its visibility. public publishes the URL and its result in the public feed and search; unlisted keeps it out of listings, but anyone with the link can open it. private needs a server configured with a ScanMalware account token, which this hosted server is not. Use unlisted for anything confidential.
Page titles, OCR text, scripts and other scan content come from the scanned sites and are untrusted.
More from ScanMalware
- Command-line tool: submit scans and search the archive from a terminal.
- n8n community node, verified by n8n, for automated workflows.
- REST API, which this server calls, and the integrations with OpenCTI, MISP, TheHive and other tools.