mcp-registry/io.github.0xdaniellopez/phishunt · v0.1.0
Also listed as glama/0xdaniellopez/phishunt-mcp
As of 2026-10-25 14:19 UTC, the 0xdaniellopez Phishunt MCP server is up with a Glimind reliability score of 100/100 (grade A). Over the last 30 days it answered 100% of Glimind's liveness checks.
Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.
Claude Code
claude mcp add --transport http 0xdaniellopez-phishunt-mcp-server https://mcp.phishunt.io/
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"0xdaniellopez-phishunt-mcp-server": {
"type": "http",
"url": "https://mcp.phishunt.io/"
}
}
}
Third-party server, listed as discovered. Review its source before installing.
11 of 11 tool(s) carry no readOnlyHint/destructiveHint annotations.
Annotate read-only tools with {"readOnlyHint": true}. Agents and gateways can then run them without a confirmation prompt, and route around destructive ones. How to fix →
Paste-ready definitions with the problems above fixed. Changes marked verify need a human look. All of them as JSON: /v1/readiness/mcp-registry%2Fio.github.0xdaniellopez%2Fphishunt/fixes
{
"name": "analyze_url",
"description": "Analyze any URL for phishing signals WITHOUT contacting it (passive). Read `verdict` first: it is the single adjudicated call (phishing / likely_phishing / suspicious / no_evidence / not_assessed), with `verdict_confidence` and `verdict_basis` (short phrases) explaining why - it reconciles phishunt's stored score/verdict (ground truth, if the domain is already known) against everything else so you don't have to guess which field outranks which. Beside the verdict sits `probability` (it does not ",
"inputSchema": {
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Full URL or bare domain to analyze; prefer the bare domain if the URL carries tokens"
}
}
},
"annotations": {
"readOnlyHint": true
}
}{
"name": "analyze_url_deep",
"description": "ACTIVE deep analysis of a URL: unlike analyze_url (which NEVER contacts the target), this tool actively fetches it - HTTP response, TLS certificate, RDAP registration, nameservers, and GeoIP, all through a SOCKS5 proxy - and re-scores it with phishunt's full 5-layer detection engine. Use it only when analyze_url's passive signals are inconclusive and you need active evidence (live HTTP/redirect behavior, certificate freshness, registrant data); it is NOT a default first call. SLOW: typically 15-",
"inputSchema": {
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Full URL or bare domain to actively analyze. This URL WILL be contacted, unlike analyze_url; prefer the bare domain if the URL carries tokens."
}
}
},
"annotations": {
"readOnlyHint": true
}
}{
"name": "check_domain",
"description": "Check whether a host (or a list of up to 20) is in the phishunt active phishing feed, by exact host membership (a listed subdomain under an apex is reported separately and does not count as the apex being listed). Misses are also checked against phishunt's archive via /api/v1/analyze (max 3 per call) and report 'previously detected on <date>' only when the archived row's verdict is medium, high or critical (a low/noise archive row is reported as a low-signal candidate, not a detection); that loo",
"inputSchema": {
"type": "object",
"required": [
"domain"
],
"properties": {
"fuzzy": {
"type": "boolean",
"description": "Legacy mode: case-insensitive substring match against the full URL instead of exact host match. Default false."
},
"domain": {
"type": [
"string",
"array"
],
"items": {
"type": "string"
},
"maxItems": 20,
"description": "A hostname (e.g. 'fake-bank.com') or full URL (the host is extracted), or a list of up to 20. Exact host match plus the 'www.' variant."
}
}
},
"annotations": {
"readOnlyHint": true
}
}Get an email or webhook when this server's readiness drops by 10+ points, tool-poisoning text appears, or a tool breaks:
curl -X POST https://glimind.com/v1/subscriptions -H 'content-type: application/json' -d '{"tools":["mcp-registry/io.github.0xdaniellopez/phishunt"],"email":"[email protected]"}'Agents: watch_tool({"toolId": "mcp-registry/io.github.0xdaniellopez/phishunt"}) over MCP.
list_brand_phishings ~473 tokensget_recent_detections ~472 tokenscheck_domain ~276 tokensget_campaigns ~271 tokensget_related_infrastructure ~255 tokensStatic checks of the advertised tools/list (schema, descriptions, annotations, tool-poisoning patterns, names, size) plus observed protocol, uptime, latency and contract changes. Read-only: no tool is ever called. Weights: schema 15, docs 20, safety 15, efficiency 15, compatibility 15, protocol 5, reliability 10, stability 5. Token counts are estimates (~3.6 characters per token).
Operator? Fix these, then re-check live. Embed the readiness badge:
[](https://glimind.com/server/mcp-registry%2Fio.github.0xdaniellopez%2Fphishunt?ref=badge)
<a href="https://glimind.com/server/mcp-registry%2Fio.github.0xdaniellopez%2Fphishunt?ref=badge"><img src="https://glimind.com/v1/readiness/badge/mcp-registry%2Fio.github.0xdaniellopez%2Fphishunt.svg" alt="MCP agent-readiness"></a>
.. image:: https://glimind.com/v1/readiness/badge/mcp-registry%2Fio.github.0xdaniellopez%2Fphishunt.svg :target: https://glimind.com/server/mcp-registry%2Fio.github.0xdaniellopez%2Fphishunt?ref=badge :alt: MCP agent-readiness
Glimind records every version of this server's tool definitions in a signed, append-only transparency log. Current manifest sha256:851532915e4a0395…, first seen 2026-10-17, included at leaf 3791 of 66,676. Version history · verify what your client received.
Compare: most reliable security servers · most reliable web servers
Glimind tells agents whether a server is up right now and how to call it, then fails over to a live alternative when it isn't.
Claude Code
claude mcp add --transport http glimind https://glimind.com/mcp
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"glimind": {
"type": "http",
"url": "https://glimind.com/mcp"
}
}
}
As of 2026-10-25 14:19 UTC, the 0xdaniellopez Phishunt MCP server is up with a Glimind reliability score of 100/100 (grade A). Over the last 30 days it answered 100% of Glimind's liveness checks.
0xdaniellopez Phishunt MCP server advertises 11 tools, including analyze_url, analyze_url_deep, check_domain, get_brand_metadata, get_campaign.
Point your MCP client at this streamable-http endpoint: https://mcp.phishunt.io/
Glimind scanned all 11 tool definitions for tool-poisoning patterns — hidden or invisible characters, instructions that override the model, concealment from the user, requests to read credential or MCP config files, conversation exfiltration and cross-tool shadowing — and found none. This checks what the server tells the model, not what its code does; review the source before granting access to sensitive data.
Status page: 90-day uptime, every outage and how long it lasted.
Claim this listing to get the Verified operator marker, a remediation checklist and owner analytics, or embed the live badge from any of the tool pages above. Maintainers: alerts, deploy attestation and monthly reports.
Status is an automated estimate from Glimind's liveness checks (handshake and tool listing only; no tool is ever called) and may lag or differ from your network. Glimind is not affiliated with this server or its operator. Operator? Request a correction or opt out at https://glimind.com/opt-out.