MCP servercom.ismalicious/mcp-server

The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone number. Defanged inp

Reputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addresses and phone number

Check a single URL, domain, or IP against threat intelligence before fetching it. Returns block | warn | allow. Use as a pre-fetch gate; use check_indicator when you need the full

One CVE by id: description, CVSS, EPSS probability, CISA KEV status and due date, exploitation evidence (SSVC, weaponized, zero-day, Exploit-DB, Nuclei), publication dates and refe

Most recently published CVEs, newest first, optionally filtered by severity. At most 20 items, each with id, severity, CVSS, publication date and a one-line title. Follow up with g

Scan untrusted content for prompt injection and check any URLs/domains/IPs it contains against threat intelligence, BEFORE acting on it. Returns a verdict of block | warn | allow.

Scan ONE email message for phishing and malware before delivering, opening or acting on it. Send the raw message (eml, preferred) or the fields you already parsed (message: headers

Find the domains isMalicious lists that look like a brand or domain (e.g. "paypal", read as paypal.com, or "login.paypal.com"): typosquats, homoglyphs, the same name on other TLDs