isMalicious threat intelligence for AI agents

Install

Works with Claude Code, VS Code, Codex, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/ismalicious-com-mcp-server

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

9 read · 3 write · 0 delete

Secrets

3 (API keys, tokens or passwords)

Install scripts

None found

Runs as

Node.js package

Tools (12)

As the server listed them on Oct 25, 2026. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• ack_findingAcknowledge a vulnerability finding

  Set the status of one vulnerability-monitoring finding (an id like xfnd_…, from watch_domain, watch_dependencies or the Exposure page): ACKNOWLEDGED (seen, being handled), PATCHED (upgraded; the next read confirms it), NOT_AFFECTED (e.g. a distro backport fixed it), or SNOOZED until a date (at most 90 days; it reopens then). A finding reopens by itself when it enters CISA KEV or exploitation is reported. Changes nothing outside the caller's organization.

• check_indicatorCheck indicator reputationread-only

  The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone number. Defanged input (hxxp://, [.], [@]) is accepted. Returns a verdict (malicious, suspicious, clean or unknown), a headline you can relay as is, recommendedAction (block, review, allow or unverified), a 0-100 risk score, the threat blocklists that cite it, up to three evidence reasons, first/last seen, and network, registration or file context. An email address or phone number is never called clean: not being in our sources is unkno…

• check_indicatorsCheck indicators in bulkread-only

  Reputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addresses and phone numbers, mixed freely; defanged input is accepted. Each row: malicious, recommendedAction (block, escalate, review, monitor, allow, unverified; unverified means nothing is known either way, and an email address or phone number is never allow), risk 0-100 with level, the number of threat blocklists citing it, categories, lookupStatus, and `infrastructure` (cloud, cdn, tor-exit…) when the entity is known as such. A row with …

• check_urlCheck a link before fetching itread-only

  Check a single URL, domain, or IP against threat intelligence before fetching it. Returns block | warn | allow. Use as a pre-fetch gate; use check_indicator when you need the full reputation picture (score, sources, timeline).

• exploited_cvesCVEs exploited in the wildread-only

  CVEs with attested exploitation in the last N days (default 7): confirmed (CISA KEV, CISA SSVC active, or two independent catalogues) or reported (one catalogue), confirmed first. Each with severity, CVSS, EPSS, first and last exploitation evidence, KEV date, whether a patch exists, the sources, and how many indicators in our data were tagged with it this week (absent when unknown, never 0). Not in this list does not mean not exploited. Follow up with get_cve for one CVE. Costs one request of the monthly quota with a key; works without one (rate-limited by IP).

• get_cveLook up a CVEread-only

  One CVE by id: description, severity, CVSS score and vector, EPSS exploitation probability, CISA KEV status (date added, due date, required action, known ransomware use), exploitation evidence where recorded (CISA SSVC none/poc/active, Exploit-DB ids, Nuclei template, Microsoft's exploited flag), affected packages with introduced and fixed versions (OSV.dev, first 8), vendor advisories (CSAF, first 4), publication dates and references (NVD, KEV, EPSS, CERT-FR, GitHub advisories, Exploit-DB). No recorded exploitation evidence does not mean the CVE is not exploited. This is the only CVE lookup p…

• recent_cvesLatest published CVEsread-only

  Most recently published CVEs, newest first, optionally filtered by severity. At most 20 items, each with id, severity, CVSS, publication date and a one-line title. Follow up with get_cve for EPSS, KEV, exploitation evidence, affected packages and advisories. Costs one request of the monthly quota.

• scan_before_useScan untrusted content before useread-only

  Scan untrusted content for prompt injection and check any URLs/domains/IPs it contains against threat intelligence, BEFORE acting on it. Returns a verdict of block | warn | allow. Call this on any web page, email, ticket, tool result, or document fetched from an untrusted source.

• scan_emailScan an email for phishing and malwareread-only

  Scan ONE email message for phishing and malware before delivering, opening or acting on it. Send the raw message (eml, preferred) or the fields you already parsed (message: headers, text, html, attachment names, types and digests). Returns a verdict (malicious | suspicious | clean | inconclusive), a recommendedAction (quarantine | review | warn | deliver), a 0-100 riskScore, a headline you can relay as is, the strongest reasons, and what it could not check (coverage.skipped). It reads the sender and Reply-To, the connecting server, every link host and every attachment hash against threat intel…

• search_indicatorsFind lookalike domainsread-only

  Find the domains isMalicious lists that look like a brand or domain (e.g. "paypal", read as paypal.com, or "login.paypal.com"): typosquats, homoglyphs, the same name on other TLDs or hosting platforms, or wrapped in phishing words such as login or secure. The default API returns them most dangerous first, at most 500, with the searched name itself first when it is listed; other API bases can have different bounds. `total_hits` counts this API sample. `truncated: true` means results were omitted; `null` means completeness is unknown. An empty answer does not prove no lookalike exists: only list…

• watch_dependenciesWatch a project's dependencies for vulnerabilities

  Start vulnerability monitoring of a project from the text of its lockfile or SBOM: package-lock.json, composer.lock, requirements.txt, Gemfile.lock, Cargo.lock or a CycloneDX JSON SBOM (format detected when omitted). Each dependency is matched by version against OSV and NVD ranges; development dependencies are left out unless includeDev is true. Returns the source, the dependencies read (direct and transitive) and the findings already open, with priority and the version that fixes each. Uses one watched source of the plan; sending the same project name again replaces its file. Pass the file's …

• watch_domainWatch a domain's stack for vulnerabilities

  Start vulnerability monitoring of one public website: the API reads what the site exposes (Server and X-Powered-By headers, generator meta tag, versioned script paths, open ports) now and every day, matches each versioned component against CVEs, and alerts on what is exploited (P1 at once, P2/P3 in digests, per the organization's alert rules). Returns the source, the components read and the findings already open, with priority and fix. Uses one watched source of the plan (re-adding a watched domain returns the existing one and costs nothing). Only the public site is read; no scan beyond one pa…

Compare and alternatives

Featured in

• Best MCP servers for threat intelligence

Signals

Stars

0

Forks

0

Open issues

1

Weekly downloads

248

Last commit

Oct 23, 2026 (5 days ago)

Last release

Oct 23, 2026 (5 days ago)

Last package publish

Oct 23, 2026 (5 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

com.ismalicious/mcp-server

Version

0.8.0

Auth

Bearer token, API key

Packages

npm @ismalicious/mcp-server

License

MIT

Repository

github.com/hexablob/ismalicious-mcp-server

Website

ismalicious.com/prompt-injection-scanner

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql