Ohey
Look up hosts in the Ohey web malware feed, read CVEs and scan URLs with Ohey's scanner.
Installation
Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).
claude mcp add --transport http ohey 'https://ohey.ca/mcp'{
"mcpServers": {
"ohey": {
"type": "http",
"url": "https://ohey.ca/mcp"
}
}
}Documentation
Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.
Ohey MCP servers
Ohey scans websites for injected malware: ClickFix and fake update lures, skimmers, phishing kits, EtherHiding loaders, and the C2 and distribution servers behind them. There are two remote MCP servers (Streamable HTTP).
| Server | URL | Sign-in |
|---|---|---|
| Research | https://ohey.ca/mcp/research | None |
| Feed and API | https://ohey.ca/mcp | Ohey account with API access |
Research server
The research Ohey publishes on ohey.ca/threats, as tools. Anyone can connect.
| Tool | What it does |
|---|---|
list_threats | Every technique, with its page, a summary, site counts and its kits. |
get_threat | A technique or kit: sites matched by month, how many were still infected when rescanned, WordPress and Joomla shares, common plugins, kits seen on the same sites, its EtherHiding contracts and articles. |
list_research_articles | Research articles, newest first. |
search_etherhiding_contracts | Contracts that compromised sites read their next stage from, by kit, chain or destination host. |
get_etherhiding_contract | One contract's destinations over time. |
get_feed_stats | Feed size, last week's additions and removals, and the capture archive. |
Counts update daily from Ohey's scans.
Claude Code:
claude mcp add --transport http ohey-research https://ohey.ca/mcp/researchFeed and API server
Ohey's API as tools: look up any host, search the feed, read CVEs and scan URLs. You sign in with your Ohey account, so there is no API key to copy. Ask for an account with API access at ohey.ca/contact.
Connect
Claude: Settings, Connectors, Add custom connector, then paste the URL.
Claude Code:
claude mcp add --transport http ohey https://ohey.ca/mcpOther clients: add https://ohey.ca/mcp as a remote MCP server. The
client finds the sign-in pages from the server's OAuth metadata and registers
itself.
Signing in opens ohey.ca. Approve the connection there and the client gets access.
Tools
| Tool | What it does |
|---|---|
search_indicators | Hosts in the feed, filtered by tag or family, with roles, families, tags and the reason each was admitted. |
get_host | A host's feed entry, vulnerable software from its latest capture, its captures summary and DNS records. |
get_host_captures | Each time the scanner loaded the host: when, what it returned and what matched. |
list_delisted | Hosts that review excluded or took out of the feed, with the reason and who decided. |
get_vulnerability | One CVE with its NVD, EPSS, KEV, GitHub and OSV data. |
list_vulnerabilities | Published CVEs in order, or only WordPress plugin, theme and core CVEs. |
start_scan | Loads a URL in Ohey's scanner and records what it finds. |
get_scan | The scan result: whether the page is malicious, what matched, commands and clipboard writes it tried to plant, and suspected C2. |
The scan tools appear only when you tick "Scan URLs" while approving. Scans count against your account.
Access and revoking it
Approving a client creates an API key named after it, under Account in the Ohey portal. Tool calls are rate limited and counted against that key like any API request. Revoke the key to disconnect the client.
The full API, with every response field, is documented at ohey.ca/docs.
Security
Report security issues to hey@ohey.ca. See security.txt.
Questions fréquentes
Qu'est-ce que Ohey ?
Look up hosts in the Ohey web malware feed, read CVEs and scan URLs with Ohey's scanner.
Comment installer Ohey ?
Il fonctionne comme serveur distant. Dans Claude Code : claude mcp add --transport http ohey 'https://ohey.ca/mcp'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.
Faut-il une clé API pour Ohey ?
Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.
Ohey est-il open source ?
Son code est public sur GitHub, mais le dépôt ne déclare pas de licence standard.
Qui maintient Ohey ?
Il est publié par Oheyresearch. AI.tn le référence sans le maintenir ni le recommander.
Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.