Log inSubmit server
Phishclean MCP logo

Phishclean MCP

Analyzes URLs, passwords, emails, headers, JWTs, secrets, and HTML for phishing and security issues over MCP.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Phishclean MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "phishclean-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "phishclean-mcp"
      ],
      "env": {
        "PHISHCLEAN_API_KEY": "YOUR_VALUE_HERE",
        "PHISHCLEAN_API_URL": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

The install command started, but didn't respond the way we expected when we tried to talk to it.

npx -y phishclean-mcp

initialize succeeded but no response to tools/list.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 2d ago.

Overview

The phishclean-mcp MCP server connects MCP-compatible clients to PhishClean’s security analysis API. It provides tools for checking URLs, passwords, email content and headers, JWTs, source-code secrets, and HTML pages. Each request is sent as an HTTPS POST with the supplied input, while passwords are analyzed and discarded. Use it when an agent needs phishing detection or lightweight security checks during investigation and development workflows.

Use cases

  • Check suspicious URLs for phishing indicators
  • Evaluate password strength during security reviews
  • Inspect email text and headers for phishing
  • Scan source code for exposed API keys
  • Review JWTs for common security issues

Key features

  • URL phishing signal checks
  • Password entropy and crack-time analysis
  • Email body and header inspection
  • JWT decoding and issue detection
  • API key scanning in source code
  • HTML page phishing analysis

Tools7

What Phishclean MCP lets your agent do. Expand a tool for its parameters.

Self-reported~134 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

5/5 checks healthy over the last 19d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 2d ago via OSV.dev · phishclean-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads68Package downloads in the last 30 days.
Last commit6d agoMost recent push to the default branch.
Install checkInconclusiveStarted but did not complete the MCP handshake in our test.
Tools exposed7Callable tools this server registers over MCP.

How Phishclean MCP works

What phishclean-mcp does

The phishclean-mcp MCP server exposes PhishClean analysis functions as tools that an MCP client can call. It covers several common security review tasks:

  • Inspect URLs for domain impersonation, suspicious top-level domains, and exposed tokens.
  • Measure password entropy, estimated cracking time, and common password patterns.
  • Review email text for urgency, threats, and requests for credentials.
  • Examine email headers for SPF, DKIM, DMARC, and spoofing indicators.
  • Decode JWTs and identify expired tokens, alg:none, or sensitive data.
  • Search source code for exposed credentials associated with services such as AWS, Stripe, GitHub, and Google.
  • Run a broader HTML page check covering 12 phishing indicators.

This places the project in the 🔒 Security category and makes it suitable for agent-assisted triage, code review, and phishing investigation.

How it works

The package runs as a thin stdio MCP client. A tool invocation sends one HTTPS POST request to the PhishClean API at https://www.phishclean.com/api/v1/, using the argument supplied to that tool. The server does not persist or log submitted content beyond rate-limiting behavior, according to the project documentation. Passwords are processed for analysis and then discarded.

The implementation is contained in a single index.js file, which may help developers inspect the request flow before deploying it. The browser extension linked by the project is separate and should not be treated as part of this MCP server.

Setup and configuration

Run the package with Node.js and npm through:

Terminal
npx phishclean-mcp

For Claude Code, the documented setup is:

Terminal
claude mcp add phishclean -- npx -y phishclean-mcp

Claude Desktop can use an MCP configuration entry with npx as the command and -y phishclean-mcp as its arguments. The configuration file is under the Claude application support directory on macOS and %APPDATA% on Windows.

No API key is needed for the stated free allowance of 30 requests per hour. Higher limits use PHISHCLEAN_API_KEY, obtained through the PhishClean developer portal. PHISHCLEAN_API_URL can replace the default API endpoint, including for a locally hosted endpoint.

Tools and capabilities

The phishclean-mcp MCP server exposes seven tools: check_link, check_password, check_email, analyze_headers, decode_jwt, scan_secrets, and scan_page. Inputs are respectively a URL, password, email body, email headers, JWT, source code, or HTML source, as applicable.

Use check_link for URL-focused phishing signals and scan_page when the HTML itself needs broader inspection. Use check_email for message wording and analyze_headers for authentication and spoofing evidence. scan_secrets is aimed at detecting leaked API keys in code, while decode_jwt focuses on token contents and basic JWT security issues.

Limitations and notes

The free tier is limited to 30 requests per hour. The documented paid tiers increase that limit, but pricing and quotas are controlled by PhishClean rather than the MCP package. Because submitted arguments are sent to the configured API endpoint, operators should review their data-handling requirements before sending sensitive material.

The project is licensed under MIT. Its MCP interface is separate from PhishClean’s local browser extension, which has its own source repository and distribution channels.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Phishclean MCP

phishclean-mcp is an MCP server that connects MCP-compatible clients to the PhishClean security API. Its main tools check links, passwords, email text, email headers, JWTs, source-code secrets, and HTML pages for phishing indicators and other security issues.

Install it by running `npx phishclean-mcp`, or add `claude mcp add phishclean -- npx -y phishclean-mcp` for Claude Code. Claude Desktop requires an entry in its `claude_desktop_config.json` file.

No, an API key is not required for the documented free allowance of 30 requests per hour. Set `PHISHCLEAN_API_KEY` when using higher-rate PhishClean plans.

phishclean-mcp works with Claude Desktop, Claude Code, Gemini CLI, and other MCP-compatible clients. It runs as a standard stdio server, so compatible MCP clients can launch it with the documented `npx` command.

Yes, set `PHISHCLEAN_API_URL` to replace the default `https://www.phishclean.com/api/v1/` endpoint. The documentation shows using this variable to point the server at another endpoint, including a local one.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewPhishclean MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/phishclean-mcp?style=directory)](https://allmcps.com/mcp/phishclean-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/phishclean-mcp"><img src="https://allmcps.com/api/badge/phishclean-mcp?style=directory" alt="Phishclean MCP on AllMCPs" /></a>