English Français العربية

Phishunt

السجل الرسمي الأمن

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.

الشيفرة المصدرية الموقع التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http phishunt 'https://mcp.phishunt.io/'
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "phishunt": {
            "type": "http",
            "url": "https://mcp.phishunt.io/"
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. phishunt-mcp
  2. Tools
  3. Use with Claude Desktop / Claude.ai / other MCP clients
  4. Quick test
  5. Secrets
  6. Develop
  7. Deploy

phishunt-mcp

Model Context Protocol (MCP) server for phishunt.io.

Exposes the public phishing-domains feed as MCP tools so AI agents can look up suspicious domains, list phishings by targeted brand, and sync detection deltas.

  • Endpoint: https://mcp.phishunt.io/ (HTTP JSON-RPC 2.0, POST)
  • Protocol version: 2025-11-25
  • Auth: none (data is CC0)
  • License (data): CC0-1.0 · License (code): MIT

Tools

NamePurpose
check_domainIs this host (or a list of up to 20) in the active phishunt feed? Exact match; misses are checked against the archive. PREVIOUSLY DETECTED is printed only when the archived row's verdict is medium, high or critical; a low/noise archive row is reported as a low-signal candidate, and a host that is not valid DNS is reported as such instead of an upstream error.
list_brand_phishingsList active phishings targeting a brand (e.g. microsoft).
get_recent_detectionsDelta sync: detections since an ISO date.
get_brand_metadataCurated brand metadata (display name, category, AI characterisation, active count).
get_cert_metadataFactual metadata for an abused TLS intermediate CA (operator, root, key type, siblings).
search_phishingsFree-text search across active phishing URLs/domains/IPs (min 3 chars).
analyze_urlPassive phishing-signal analysis of any URL/domain - returns a single adjudicated verdict (phishing / likely_phishing / suspicious / no_evidence / not_assessed) plus a calibrated probability block beside it (P of malicious at the API's ~1.3% base rate, relative risk, 80% interval, per-class evidence; URL-only estimates stay low by design, so a low probability is not proof of safety) and the supporting evidence (URL-shape heuristics, stored score/verdict if known, external-feed cross-reference, historical detections). Unknown suspicious domains are auto-queued for full analysis.
analyze_url_deepACTIVE deep analysis of a URL (contacts the target: HTTP + TLS cert + RDAP + NS + GeoIP, SOCKS5-isolated) and, when the render lane is free, renders the page in a headless browser through the same proxy; it re-scores with the full 5-layer engine and returns coverage (active_rendered / active_no_render), render.status and a probability block. Slow (typically 15-45s, up to ~50s), token-gated, and rate-limited (shared 50/day budget, single-flight) - requires DEEP_TOKEN configured on this Worker; use only when analyze_url is inconclusive.
get_related_infrastructureFind infrastructure/content overlap for a known indicator (shared IP, cert, nameservers, favicon, etc.); surfaces the possible campaign / suspected cluster it belongs to.
get_campaignsList possible campaigns / suspected clusters (shared-infrastructure groupings), optionally filtered by brand or active-only.
get_campaignFull detail for one possible campaign / suspected cluster: evidence breakdown, every member indicator, export links.

Use with Claude Desktop / Claude.ai / other MCP clients

Add to your MCP client config:

{
  "mcpServers": {
    "phishunt": {
      "url": "https://mcp.phishunt.io/"
    }
  }
}

Quick test

curl -sX POST https://mcp.phishunt.io/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | jq .

Secrets

analyze_url_deep needs a DEEP_TOKEN Worker secret (the backend's X-Phishunt-Deep-Token). Without it configured, the tool still appears in tools/list but fails clean on tools/call — it never reaches the backend.

wrangler secret put DEEP_TOKEN

Develop

npm install
npm run dev          # wrangler dev on http://localhost:8787
MCP_URL=http://localhost:8787 npm test

Deploy

npm run deploy       # wrangler deploy
MCP_URL=https://mcp.phishunt.io npm test
# after the phishunt-backend release that adds `probability` and `history.apex_candidates_seen`:
REQUIRE_PROBABILITY=1 MCP_URL=https://mcp.phishunt.io npm test

Without REQUIRE_PROBABILITY=1 the live probability / history assertions are reported as SKIPPED while the backend field is absent or probability.status is unavailable; with it they fail.

الأسئلة الشائعة

ما هو Phishunt؟

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.

كيف أثبّت Phishunt؟

يعمل كخادم بعيد. في Claude Code: claude mcp add --transport http phishunt 'https://mcp.phishunt.io/'. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج Phishunt إلى مفتاح API؟

لا يذكر إدراجه في السجل أي مفتاح أو سر إلزامي. قد تتطلب بعض الميزات حسابًا لدى الخدمة التي يتصل بها.

هل Phishunt مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص MIT.

من يصون Phishunt؟

ينشره 0xDanielLopez. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.