Server data from the Official MCP Registry
Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.
About
Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.
Remote endpoints: streamable-http: https://mcp.phishunt.io/
Security Report
Valid MCP server (2 strong, 1 medium validity signals). No known CVEs in dependencies. Imported from the Official MCP Registry.
7 tools verified · Open access · No issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
How to Connect
Remote Plugin
No local installation needed. Your AI client connects to the remote endpoint directly.
Add this to your MCP configuration to connect:
{
"mcpServers": {
"io-github-0xdaniellopez-phishunt": {
"url": "https://mcp.phishunt.io/"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
phishunt-mcp
Model Context Protocol (MCP) server for phishunt.io.
Exposes the public phishing-domains feed as MCP tools so AI agents can look up suspicious domains, list phishings by targeted brand, and sync detection deltas.
- Endpoint:
https://mcp.phishunt.io/(HTTP JSON-RPC 2.0, POST) - Protocol version: 2025-11-25
- Auth: none (data is CC0)
- License (data): CC0-1.0 · License (code): MIT
Tools
| Name | Purpose |
|---|---|
check_domain | Is this domain/URL substring in the active phishunt feed? |
list_brand_phishings | List active phishings targeting a brand (e.g. microsoft). |
get_recent_detections | Delta sync: detections since an ISO date. |
get_brand_metadata | Curated brand metadata (display name, category, AI characterisation, active count). |
get_cert_metadata | Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings). |
search_phishings | Free-text search across active phishing URLs/domains/IPs (min 3 chars). |
analyze_url | Passive phishing-signal analysis of any URL/domain - returns a single adjudicated verdict (phishing / likely_phishing / suspicious / no_evidence / not_assessed) plus the supporting evidence (URL-shape heuristics, stored score/verdict if known, external-feed cross-reference, historical detections). Unknown suspicious domains are auto-queued for full analysis. |
analyze_url_deep | ACTIVE deep analysis of a URL (contacts the target: HTTP + TLS cert + RDAP + NS + GeoIP, SOCKS5-isolated) and re-scores it with the full 5-layer engine. Slow (5-15s), token-gated, and rate-limited (shared 50/day budget, single-flight) — requires DEEP_TOKEN configured on this Worker; use only when analyze_url is inconclusive. |
get_related_infrastructure | Find infrastructure/content overlap for a known indicator (shared IP, cert, nameservers, favicon, etc.); surfaces the possible campaign / suspected cluster it belongs to. |
get_campaigns | List possible campaigns / suspected clusters (shared-infrastructure groupings), optionally filtered by brand or active-only. |
get_campaign | Full detail for one possible campaign / suspected cluster: evidence breakdown, every member indicator, export links. |
Use with Claude Desktop / Claude.ai / other MCP clients
Add to your MCP client config:
{
"mcpServers": {
"phishunt": {
"url": "https://mcp.phishunt.io/"
}
}
}
Quick test
curl -sX POST https://mcp.phishunt.io/ \
-H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | jq .
Secrets
analyze_url_deep needs a DEEP_TOKEN Worker secret (the backend's
X-Phishunt-Deep-Token). Without it configured, the tool still appears in
tools/list but fails clean on tools/call — it never reaches the backend.
wrangler secret put DEEP_TOKEN
Develop
npm install
npm run dev # wrangler dev on http://localhost:8787
MCP_URL=http://localhost:8787 npm test
Deploy
npm run deploy # wrangler deploy
MCP_URL=https://mcp.phishunt.io npm test
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption