English Français العربية

Ohey

السجل الرسمي أخرى

Look up hosts in the Ohey web malware feed, read CVEs and scan URLs with Ohey's scanner.

الشيفرة المصدرية الموقع التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http ohey 'https://ohey.ca/mcp'
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "ohey": {
            "type": "http",
            "url": "https://ohey.ca/mcp"
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. Ohey MCP servers
  2. Research server
  3. Feed and API server
  4. Security

Ohey MCP servers

Ohey scans websites for injected malware: ClickFix and fake update lures, skimmers, phishing kits, EtherHiding loaders, and the C2 and distribution servers behind them. There are two remote MCP servers (Streamable HTTP).

ServerURLSign-in
Researchhttps://ohey.ca/mcp/researchNone
Feed and APIhttps://ohey.ca/mcpOhey account with API access

Research server

The research Ohey publishes on ohey.ca/threats, as tools. Anyone can connect.

ToolWhat it does
list_threatsEvery technique, with its page, a summary, site counts and its kits.
get_threatA technique or kit: sites matched by month, how many were still infected when rescanned, WordPress and Joomla shares, common plugins, kits seen on the same sites, its EtherHiding contracts and articles.
list_research_articlesResearch articles, newest first.
search_etherhiding_contractsContracts that compromised sites read their next stage from, by kit, chain or destination host.
get_etherhiding_contractOne contract's destinations over time.
get_feed_statsFeed size, last week's additions and removals, and the capture archive.

Counts update daily from Ohey's scans.

Claude Code:

claude mcp add --transport http ohey-research https://ohey.ca/mcp/research

Feed and API server

Ohey's API as tools: look up any host, search the feed, read CVEs and scan URLs. You sign in with your Ohey account, so there is no API key to copy. Ask for an account with API access at ohey.ca/contact.

Connect

Claude: Settings, Connectors, Add custom connector, then paste the URL.

Claude Code:

claude mcp add --transport http ohey https://ohey.ca/mcp

Other clients: add https://ohey.ca/mcp as a remote MCP server. The client finds the sign-in pages from the server's OAuth metadata and registers itself.

Signing in opens ohey.ca. Approve the connection there and the client gets access.

Tools
ToolWhat it does
search_indicatorsHosts in the feed, filtered by tag or family, with roles, families, tags and the reason each was admitted.
get_hostA host's feed entry, vulnerable software from its latest capture, its captures summary and DNS records.
get_host_capturesEach time the scanner loaded the host: when, what it returned and what matched.
list_delistedHosts that review excluded or took out of the feed, with the reason and who decided.
get_vulnerabilityOne CVE with its NVD, EPSS, KEV, GitHub and OSV data.
list_vulnerabilitiesPublished CVEs in order, or only WordPress plugin, theme and core CVEs.
start_scanLoads a URL in Ohey's scanner and records what it finds.
get_scanThe scan result: whether the page is malicious, what matched, commands and clipboard writes it tried to plant, and suspected C2.

The scan tools appear only when you tick "Scan URLs" while approving. Scans count against your account.

Access and revoking it

Approving a client creates an API key named after it, under Account in the Ohey portal. Tool calls are rate limited and counted against that key like any API request. Revoke the key to disconnect the client.

The full API, with every response field, is documented at ohey.ca/docs.

Security

Report security issues to hey@ohey.ca. See security.txt.

الأسئلة الشائعة

ما هو Ohey؟

Look up hosts in the Ohey web malware feed, read CVEs and scan URLs with Ohey's scanner.

كيف أثبّت Ohey؟

يعمل كخادم بعيد. في Claude Code: claude mcp add --transport http ohey 'https://ohey.ca/mcp'. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج Ohey إلى مفتاح API؟

لا يذكر إدراجه في السجل أي مفتاح أو سر إلزامي. قد تتطلب بعض الميزات حسابًا لدى الخدمة التي يتصل بها.

هل Ohey مفتوح المصدر؟

شيفرته علنية على GitHub، لكن المستودع لا يعلن ترخيصًا قياسيًا.

من يصون Ohey؟

ينشره Oheyresearch. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.