# phishclean-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/chidhu07/phishclean-mcp  
**GitHub Stars:** 0  
**npm Downloads (last month):** 68  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/phishclean-mcp

## Description
MCP server for PhishClean security analysis tools — check URLs, passwords, emails, headers, JWTs, and source code for security issues

## Tools
Capabilities this server exposes over MCP:

- **check_link** — Check a URL for phishing signals (domain spoofing, suspicious TLDs, token leaks)
- **check_password** — Analyze password strength (entropy, crack time, common patterns)
- **check_email** — Detect phishing in email body text (urgency, threats, credential requests)
- **analyze_headers** — Check email headers for SPF/DKIM/DMARC and spoofing
- **decode_jwt** — Decode JWT and flag security issues (expired, alg:none, sensitive data)
- **scan_secrets** — Scan code for leaked API keys (AWS, Stripe, GitHub, Google, etc.)
- **scan_page** — Full page scan — 12 phishing signals on HTML source

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "phishclean-mcp": {
    "command": "npx",
    "args": ["-y","phishclean-mcp"],
    "env": {
      "PHISHCLEAN_API_KEY": "",
      "PHISHCLEAN_API_URL": ""
    }
  }
}
```

**Requires environment variables:** `PHISHCLEAN_API_KEY`, `PHISHCLEAN_API_URL` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What phishclean-mcp does

The phishclean-mcp MCP server exposes PhishClean analysis functions as tools that an MCP client can call. It covers several common security review tasks:

- Inspect URLs for domain impersonation, suspicious top-level domains, and exposed tokens.
- Measure password entropy, estimated cracking time, and common password patterns.
- Review email text for urgency, threats, and requests for credentials.
- Examine email headers for SPF, DKIM, DMARC, and spoofing indicators.
- Decode JWTs and identify expired tokens, `alg:none`, or sensitive data.
- Search source code for exposed credentials associated with services such as AWS, Stripe, GitHub, and Google.
- Run a broader HTML page check covering 12 phishing indicators.

This places the project in the 🔒 Security category and makes it suitable for agent-assisted triage, code review, and phishing investigation.

## How it works

The package runs as a thin stdio MCP client. A tool invocation sends one HTTPS POST request to the PhishClean API at `https://www.phishclean.com/api/v1/`, using the argument supplied to that tool. The server does not persist or log submitted content beyond rate-limiting behavior, according to the project documentation. Passwords are processed for analysis and then discarded.

The implementation is contained in a single `index.js` file, which may help developers inspect the request flow before deploying it. The browser extension linked by the project is separate and should not be treated as part of this MCP server.

## Setup and configuration

Run the package with Node.js and npm through:

```bash
npx phishclean-mcp
```

For Claude Code, the documented setup is:

```bash
claude mcp add phishclean -- npx -y phishclean-mcp
```

Claude Desktop can use an MCP configuration entry with `npx` as the command and `-y phishclean-mcp` as its arguments. The configuration file is under the Claude application support directory on macOS and `%APPDATA%` on Windows.

No API key is needed for the stated free allowance of 30 requests per hour. Higher limits use `PHISHCLEAN_API_KEY`, obtained through the PhishClean developer portal. `PHISHCLEAN_API_URL` can replace the default API endpoint, including for a locally hosted endpoint.

## Tools and capabilities

The phishclean-mcp MCP server exposes seven tools: `check_link`, `check_password`, `check_email`, `analyze_headers`, `decode_jwt`, `scan_secrets`, and `scan_page`. Inputs are respectively a URL, password, email body, email headers, JWT, source code, or HTML source, as applicable.

Use `check_link` for URL-focused phishing signals and `scan_page` when the HTML itself needs broader inspection. Use `check_email` for message wording and `analyze_headers` for authentication and spoofing evidence. `scan_secrets` is aimed at detecting leaked API keys in code, while `decode_jwt` focuses on token contents and basic JWT security issues.

## Limitations and notes

The free tier is limited to 30 requests per hour. The documented paid tiers increase that limit, but pricing and quotas are controlled by PhishClean rather than the MCP package. Because submitted arguments are sent to the configured API endpoint, operators should review their data-handling requirements before sending sensitive material.

The project is licensed under MIT. Its MCP interface is separate from PhishClean’s local browser extension, which has its own source repository and distribution channels.

_Full upstream README: https://allmcps.com/mcp/phishclean-mcp/readme_