# Ismalicious MCP server

Source: https://glimind.com/server/mcp-registry%2Fcom.ismalicious%2Fmcp-server
Registry id: `mcp-registry/com.ismalicious/mcp-server`
Status: live (checked 2026-10-26T19:49:23.432Z)

## Measurements (30 days)

- Uptime: 99.9%
- Checks: 2087
- Outages (90 days): 2

## Install

```json
{
  "mcpServers": {
    "ismalicious-mcp-server": {
      "type": "http",
      "url": "https://api.ismalicious.com/mcp"
    }
  }
}
```

Claude Code:

```sh
claude mcp add --transport http ismalicious-mcp-server https://api.ismalicious.com/mcp
```

## Tools (14)

- `ack_finding`: Set the status of one vulnerability-monitoring finding (an id like xfnd_…, from watch_domain, watch_dependencies or the Exposure page): ACKNOWLEDGED (seen, bein
- `bootstrap_key`: Mint a free API key from an email address.
- `check_indicator`: The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone 
- `check_indicators`: Reputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addres
- `check_password_exposure`: Check if password or hash is in known breach dumps.
- `check_url`: Check a single URL, domain, or IP against threat intelligence before fetching it. Returns block | warn | allow. Use as a pre-fetch gate; use check_indicator whe
- `exploited_cves`: CVEs with attested exploitation in the last N days (default 7): confirmed (CISA KEV, CISA SSVC active, or two independent catalogues) or reported (one catalogue
- `get_cve`: One CVE by id: description, severity, CVSS score and vector, EPSS exploitation probability, CISA KEV status (date added, due date, required action, known ransom
- `recent_cves`: Most recently published CVEs, newest first, optionally filtered by severity. At most 20 items, each with id, severity, CVSS, publication date and a one-line tit
- `scan_before_use`: Scan untrusted content for prompt injection and check any URLs/domains/IPs it contains against threat intelligence, BEFORE acting on it. Returns a verdict of bl
- `scan_email`: Scan ONE email message for phishing and malware before delivering, opening or acting on it. Send the raw message (eml, preferred) or the fields you already pars
- `search_indicators`: Find the domains isMalicious lists that look like a brand or domain (e.g. "paypal", read as paypal.com, or "login.paypal.com"): typosquats, homoglyphs, the same
- `watch_dependencies`: Start vulnerability monitoring of a project from the text of its lockfile or SBOM: package-lock.json, composer.lock, requirements.txt, Gemfile.lock, Cargo.lock 
- `watch_domain`: Start vulnerability monitoring of one public website: the API reads what the site exposes (Server and X-Powered-By headers, generator meta tag, versioned script

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.