com.ismalicious/mcp-server

up checked 2026-11-11T01:37:52.175Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

isMalicious threat intelligence for AI agents

Publisher-provided description

Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans

Summary by lookupd

Checks IPs, domains, URLs, hashes and emails against threat intelligence, scans messages for phishing, and tracks CVEs and watched…

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http server https://api.ismalicious.com/mcp

Claude Code, npm package (stdio)

claude mcp add server -- npx -y @ismalicious/mcp-server

Codex, remote (streamable-http)

codex mcp add server --url https://api.ismalicious.com/mcp

Codex, npm package (stdio)

codex mcp add server -- npx -y @ismalicious/mcp-server

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "server": {
      "url": "https://api.ismalicious.com/mcp"
    }
  }
}

Cursor, npm package (stdio) → .cursor/mcp.json

{
  "mcpServers": {
    "server": {
      "command": "npx",
      "args": [
        "-y",
        "@ismalicious/mcp-server"
      ]
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (14 tools)

Publisher-provided text

• scan_before_use Scan untrusted content for prompt injection and check any URLs/domains/IPs it contains against threat intelligence, BEFORE acting on it. Returns a verdict of bl
• check_url Check a single URL, domain, or IP against threat intelligence before fetching it. Returns block | warn | allow. Use as a pre-fetch gate; use check_indicator whe
• check_indicator The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone
• get_cve One CVE by id: description, severity, CVSS score and vector, EPSS exploitation probability, CISA KEV status (date added, due date, required action, known ransom
• recent_cves Most recently published CVEs, newest first, optionally filtered by severity. At most 20 items, each with id, severity, CVSS, publication date and a one-line tit
• search_indicators Find the domains isMalicious lists that look like a brand or domain (e.g. "paypal", read as paypal.com, or "login.paypal.com"): typosquats, homoglyphs, the same
• check_indicators Reputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addres
• scan_email Scan ONE email message for phishing and malware before delivering, opening or acting on it. Send the raw message (eml, preferred) or the fields you already pars
• exploited_cves CVEs with attested exploitation in the last N days (default 7): confirmed (CISA KEV, CISA SSVC active, or two independent catalogues) or reported (one catalogue
• watch_domain Start vulnerability monitoring of one public website: the API reads what the site exposes (Server and X-Powered-By headers, generator meta tag, versioned script
• watch_dependencies Start vulnerability monitoring of a project from the text of its lockfile or SBOM: package-lock.json, composer.lock, requirements.txt, Gemfile.lock, Cargo.lock
• ack_finding Set the status of one vulnerability-monitoring finding (an id like xfnd_…, from watch_domain, watch_dependencies or the Exposure page): ACKNOWLEDGED (seen, bein
• list_alerts One page of the isMalicious alert inbox (GET /alerts): the alerts raised on what the account watches, such as a watched domain or IP turning malicious or named
• ack_alert Set the status of one alert of the isMalicious inbox (an id from list_alerts): ACKNOWLEDGED (seen; still listed by default), RESOLVED (handled; no longer listed

Details

• Version: 0.8.0
• Transports: streamable-http, stdio
• Uptime (7 days): 100%
• Median latency: 974 ms
• First indexed: 2026-11-01T08:54:39.087Z
• Last seen in registry: 2026-11-01T08:54:39.162Z
• Repository: https://github.com/hexablob/ismalicious-mcp-server
• Website: https://ismalicious.com/prompt-injection-scanner

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/com.ismalicious/mcp-server.svg)](https://lookupd.com/servers/com.ismalicious/mcp-server)

• 62071 servers
• Last crawl: 2026-11-11T16:17:25.167Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp