com.scanmalware.mcp/scanmalware-mcp

up checked 2026-11-11T07:40:22.255Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

ScanMalware.com URL Scanner

Publisher-provided description

MCP server for ScanMalware.com URL scanning, malware detection, and analysis.

Summary by lookupd

Submits URLs for sandboxed scanning, then reads verdicts, AI analysis, TLS, IOC and domain history to assess phishing and malware risk.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http scanmalware https://mcp.scanmalware.com/mcp

Codex, remote (streamable-http)

codex mcp add scanmalware --url https://mcp.scanmalware.com/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "scanmalware": {
      "url": "https://mcp.scanmalware.com/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (showing 30 of 128)

Publisher-provided text

get_recent_scans List the most recent public scans, newest first (paginated with page and limit). Each row has the scan ID, URL, status, visibility and submission time. Unlisted
submit_scan Submit a URL to ScanMalware to be rendered and analysed in a sandboxed browser; returns the new scan_id. scan_type is required and sets who can see the result:
get_scan_summary Get a compact summary of one scan: submitted URL, final URL after redirects, status, completion time and the security verdict (verdict text, risk level, confide
wait_for_scan Wait for a submitted scan to finish by polling its status every poll_interval_s seconds, up to timeout_s seconds (default 180). Returns the final compact summar
get_scan_result Get the full result document of one scan: URLs and redirects, page title, load times, links, network requests, IP addresses, JavaScript files, TLS, fuzzy hashes
search_scans Search the archive of public scans by text in the URL, domain or page title (paginated); q needs at least 3 characters and search_type narrows the match (defaul
get_ai_analysis Get the AI analysis of one scan: classification (LEGITIMATE to CONFIRMED_SCAM), scam type, risk score, confidence, impersonated brand and the key evidence behin
get_scan_progress Get the progress of a running scan: current step, total steps, step name, percentage and status. Useful for checking whether a scan has finished before reading
get_scan_ioc Check one scan against threat-intelligence indicator feeds: matching IP addresses and domains the page contacted, the threat types, and a summary of total and u
get_tls_details Get the TLS certificate the scanned site presented: subject, issuer, validity dates, whether it was valid or expired, and related details. scan_id is the UUID o
get_tls_asn1 Get the raw ASN.1 structure of the TLS certificate from one scan, for detailed certificate inspection. scan_id is the UUID of a ScanMalware scan.
get_technologies_by_scan List the web technologies detected on a scanned page (frameworks, CMS, CDN, analytics and so on), with versions where known. scan_id is the UUID of a ScanMalwar
get_bot_protection Get the bot-protection and CAPTCHA services detected on a scanned page (for example Cloudflare Turnstile), with a detected flag. Phishing kits often use these t
get_yara_matches Get the YARA rule matches recorded for one scan, with the matching rules and a summary by severity and category. scan_id is the UUID of a ScanMalware scan.
get_jarm_signatures Get the JARM TLS server fingerprints measured for the hosts in one scan, with whether each matches a known signature. A shared JARM often points to the same ser
get_analyzer_results List which analysis modules ran for one scan (for example JavaScript fingerprinting and AI analysis), with each module's status, success flag and timing. Useful
get_clipboard_events Get the clipboard writes the page attempted while it was scanned, with the event count and whether collection ran. Empty with an explanatory note when the page
get_js_fingerprints List the JavaScript files a scanned page loaded, each with its fingerprint: hashes (SHA-256, SHA-1, MD5, normalized and fuzzy), size metrics, detected library a
get_scan_reports List the user reports and votes filed about one scan (for example marked safe or malicious), with the total count; report_type filters by kind. Empty when nobod
get_domain_scans List the recent scans of a domain and its subdomains, newest first, up to limit; status filters by scan status. Each row has matched_on: 'url' when the scan was
get_domain_history Get the scan history of a domain with the total count and the scans, paginated with page and limit.
get_domain_stats Get scan counts for a domain: total, unique, completed and failed scans, first and latest scan, and scans in the last 24 hours, 7 days and 30 days.
search_by_ip List scans of pages served from an IP address (paginated), each with scan ID, URL and time. On shared hosting and CDNs an IP serves many unrelated sites, so a m
get_ip_stats Get statistics for an IP address across the archive: total scans, unique URLs, first and last seen, geolocation, ASN and organisation, BGP and DNS data; paginat
search_by_asn Get what the archive knows about an autonomous system (ASN number, without 'AS'): organisation, total scans, unique URLs, first and last seen and BGP prefixes;
search_similar_scans Find scans that look like this one by screenshot similarity, favicon or fuzzy page hash (methods, default screenshot), each with URL, final URL, title and what
search_semantic Search scans by meaning, comparing text with screenshot embeddings (for example 'bank login page asking for card details'). threshold defaults to -0.2 on a -1 t
search_by_favicon Search scans by favicon hash (paginated): a mmh3 hash by default, or the favicon's MD5 with hash_type='md5'.
search_ai_high_risk List scans that the AI analysis rated high risk, optionally above min_risk_score and min_confidence, each with URL, title and the analysis. min_risk_score is on
search_ai_scam_type List scans whose AI analysis named a given scam type, such as 'Phishing', each with URL, title, submission time and the analysis (verdict, classification, risk

Details

Version: 0.1.6
Transports: streamable-http
Uptime (7 days): 100%
Median latency: 1445 ms
First indexed: 2026-11-01T08:57:51.836Z
Last seen in registry: 2026-11-01T08:57:52.073Z
Repository: https://github.com/scanmalware/mcp-server
Website: https://mcp.scanmalware.com

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/com.scanmalware.mcp/scanmalware-mcp.svg)](https://lookupd.com/servers/com.scanmalware.mcp/scanmalware-mcp)

62071 servers
Last crawl: 2026-11-11T16:17:25.167Z
API base: https://api.lookupd.com
MCP URL: https://api.lookupd.com/mcp