Phishunt

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Remote HTTP

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "phishunt": {
      "url": "https://mcp.phishunt.io/"
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Capabilities & Tool Schemas (11)Self-reported

Inspect callable tools, capabilities, and parameters exposed to AI agents by Phishunt.

check_domain

Is this host (or a list of up to 20) in the active phishunt feed? Exact match; misses are checked against the archive.

list_brand_phishings

List active phishings targeting a brand (e.g. `microsoft`).

get_recent_detections

Delta sync: detections since an ISO date.

get_brand_metadata

Curated brand metadata (display name, category, AI characterisation, active count).

get_cert_metadata

Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings).

search_phishings

Free-text search across active phishing URLs/domains/IPs (min 3 chars).

Documentation Overview

phishunt-mcp

Model Context Protocol (MCP) server for phishunt.io.

Exposes the public phishing-domains feed as MCP tools so AI agents can look up suspicious domains, list phishings by targeted brand, and sync detection deltas.

Endpoint: https://mcp.phishunt.io/ (HTTP JSON-RPC 2.0, POST)
Protocol version: 2025-11-25
Auth: none (data is CC0)
License (data): CC0-1.0 · License (code): MIT

Tools

Name	Purpose
`check_domain`	Is this host (or a list of up to 20) in the active phishunt feed? Exact match; misses are checked against the archive.
`list_brand_phishings`	List active phishings targeting a brand (e.g. `microsoft`).
`get_recent_detections`	Delta sync: detections since an ISO date.
`get_brand_metadata`	Curated brand metadata (display name, category, AI characterisation, active count).
`get_cert_metadata`	Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings).
`search_phishings`	Free-text search across active phishing URLs/domains/IPs (min 3 chars).
`analyze_url`	Passive phishing-signal analysis of any URL/domain - returns a single adjudicated `verdict` (phishing / likely_phishing / suspicious / no_evidence / not_assessed) plus the supporting evidence (URL-shape heuristics, stored score/verdict if known, external-feed cross-reference, historical detections). Unknown suspicious domains are auto-queued for full analysis.
`analyze_url_deep`	ACTIVE deep analysis of a URL (contacts the target: HTTP + TLS cert + RDAP + NS + GeoIP, SOCKS5-isolated) and re-scores it with the full 5-layer engine. Slow (5-15s), token-gated, and rate-limited (shared 50/day budget, single-flight) — requires `DEEP_TOKEN` configured on this Worker; use only when `analyze_url` is inconclusive.
`get_related_infrastructure`	Find infrastructure/content overlap for a known indicator (shared IP, cert, nameservers, favicon, etc.); surfaces the possible campaign / suspected cluster it belongs to.
`get_campaigns`	List possible campaigns / suspected clusters (shared-infrastructure groupings), optionally filtered by brand or active-only.
`get_campaign`	Full detail for one possible campaign / suspected cluster: evidence breakdown, every member indicator, export links.

Use with Claude Desktop / Claude.ai / other MCP clients

Add to your MCP client config:

config.json

{
  "mcpServers": {
    "phishunt": {
      "url": "https://mcp.phishunt.io/"
    }
  }
}

Quick test

Terminal

curl -sX POST https://mcp.phishunt.io/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | jq .

Secrets

analyze_url_deep needs a DEEP_TOKEN Worker secret (the backend's X-Phishunt-Deep-Token). Without it configured, the tool still appears in tools/list but fails clean on tools/call — it never reaches the backend.

Terminal

wrangler secret put DEEP_TOKEN

Develop

Terminal

npm install
npm run dev          # wrangler dev on http://localhost:8787
MCP_URL=http://localhost:8787 npm test

Deploy

Terminal

npm run deploy       # wrangler deploy
MCP_URL=https://mcp.phishunt.io npm test

Read the full README →View source on GitHub →

Related MCP Servers

View all in Security View all alternatives

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars

Stargazers on the source repository.

Last commit

17d ago

Most recent push to the default branch.

Tools exposed

Callable tools this server registers over MCP.

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Phishunt

Phishunt is a hosted MCP server. Add it as a remote server in your client's config: "mcpServers": { "phishunt": { "url": "https://mcp.phishunt.io/" } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/phishunt?style=directory)](https://allmcps.com/mcp/phishunt)

HTML Embed

<a href="https://allmcps.com/mcp/phishunt"><img src="https://allmcps.com/api/badge/phishunt?style=directory" alt="Phishunt on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

5/7 checks healthy over the last 45d

52Quality signal: Good · 52/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools25/30

Adoption & activity4/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to Phishunt →Install in Claude Desktop Install in Cursor Install in VS Code Setup guides for all 13 MCP clients

Documentation Overview

phishunt-mcp

Model Context Protocol (MCP) server for phishunt.io.

Exposes the public phishing-domains feed as MCP tools so AI agents can look up suspicious domains, list phishings by targeted brand, and sync detection deltas.

Endpoint: https://mcp.phishunt.io/ (HTTP JSON-RPC 2.0, POST)
Protocol version: 2025-11-25
Auth: none (data is CC0)
License (data): CC0-1.0 · License (code): MIT

Tools

Name	Purpose
`check_domain`	Is this host (or a list of up to 20) in the active phishunt feed? Exact match; misses are checked against the archive.
`list_brand_phishings`	List active phishings targeting a brand (e.g. `microsoft`).
`get_recent_detections`	Delta sync: detections since an ISO date.
`get_brand_metadata`	Curated brand metadata (display name, category, AI characterisation, active count).
`get_cert_metadata`	Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings).
`search_phishings`	Free-text search across active phishing URLs/domains/IPs (min 3 chars).
`analyze_url`	Passive phishing-signal analysis of any URL/domain - returns a single adjudicated `verdict` (phishing / likely_phishing / suspicious / no_evidence / not_assessed) plus the supporting evidence (URL-shape heuristics, stored score/verdict if known, external-feed cross-reference, historical detections). Unknown suspicious domains are auto-queued for full analysis.
`analyze_url_deep`	ACTIVE deep analysis of a URL (contacts the target: HTTP + TLS cert + RDAP + NS + GeoIP, SOCKS5-isolated) and re-scores it with the full 5-layer engine. Slow (5-15s), token-gated, and rate-limited (shared 50/day budget, single-flight) — requires `DEEP_TOKEN` configured on this Worker; use only when `analyze_url` is inconclusive.
`get_related_infrastructure`	Find infrastructure/content overlap for a known indicator (shared IP, cert, nameservers, favicon, etc.); surfaces the possible campaign / suspected cluster it belongs to.
`get_campaigns`	List possible campaigns / suspected clusters (shared-infrastructure groupings), optionally filtered by brand or active-only.
`get_campaign`	Full detail for one possible campaign / suspected cluster: evidence breakdown, every member indicator, export links.

Use with Claude Desktop / Claude.ai / other MCP clients

Add to your MCP client config:

config.json

{
  "mcpServers": {
    "phishunt": {
      "url": "https://mcp.phishunt.io/"
    }
  }
}

Quick test

Terminal

curl -sX POST https://mcp.phishunt.io/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | jq .

Secrets

Terminal

wrangler secret put DEEP_TOKEN

Develop

Terminal

npm install
npm run dev          # wrangler dev on http://localhost:8787
MCP_URL=http://localhost:8787 npm test

Deploy

Terminal

npm run deploy       # wrangler deploy
MCP_URL=https://mcp.phishunt.io npm test