Is the Phishunt MCP server free to use?

Yes. Phishunt is listed on AllMCPs as a free, open Model Context Protocol server you can install into Claude Desktop, Cursor, or any MCP-compatible client.

Is the Phishunt MCP server free to use?

Yes. Phishunt is listed on AllMCPs as a free, open Model Context Protocol server you can install into Claude Desktop, Cursor, or any MCP-compatible client.

Phishunt

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Install Config Generator

Choose your client

claude_desktop_config.json

{
  "mcpServers": {
    "phishunt": {
      "command": "npx",
      "args": [
        "-y",
        "phishunt"
      ]
    }
  }
}

💡 Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)

Documentation Overview

phishunt-mcp

Model Context Protocol (MCP) server for phishunt.io.

Exposes the public phishing-domains feed as MCP tools so AI agents can look up suspicious domains, list phishings by targeted brand, and sync detection deltas.

Endpoint: https://mcp.phishunt.io/ (HTTP JSON-RPC 2.0, POST)
Protocol version: 2025-11-25
Auth: none (data is CC0)
License (data): CC0-1.0 · License (code): MIT

Tools

Name	Purpose
`check_domain`	Is this domain/URL substring in the active phishunt feed?
`list_brand_phishings`	List active phishings targeting a brand (e.g. `microsoft`).
`get_recent_detections`	Delta sync: detections since an ISO date.
`get_brand_metadata`	Curated brand metadata (display name, category, AI characterisation, active count).
`get_cert_metadata`	Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings).
`search_phishings`	Free-text search across active phishing URLs/domains/IPs (min 3 chars).
`analyze_url`	Passive phishing-signal analysis of any URL/domain - returns a single adjudicated `verdict` (phishing / likely_phishing / suspicious / no_evidence / not_assessed) plus the supporting evidence (URL-shape heuristics, stored score/verdict if known, external-feed cross-reference, historical detections). Unknown suspicious domains are auto-queued for full analysis.
`analyze_url_deep`	ACTIVE deep analysis of a URL (contacts the target: HTTP + TLS cert + RDAP + NS + GeoIP, SOCKS5-isolated) and re-scores it with the full 5-layer engine. Slow (5-15s), token-gated, and rate-limited (shared 50/day budget, single-flight) — requires `DEEP_TOKEN` configured on this Worker; use only when `analyze_url` is inconclusive.
`get_related_infrastructure`	Find infrastructure/content overlap for a known indicator (shared IP, cert, nameservers, favicon, etc.); surfaces the possible campaign / suspected cluster it belongs to.
`get_campaigns`	List possible campaigns / suspected clusters (shared-infrastructure groupings), optionally filtered by brand or active-only.
`get_campaign`	Full detail for one possible campaign / suspected cluster: evidence breakdown, every member indicator, export links.

Use with Claude Desktop / Claude.ai / other MCP clients

Add to your MCP client config:

config.json

{
  "mcpServers": {
    "phishunt": {
      "url": "https://mcp.phishunt.io/"
    }
  }
}

Quick test

Terminal

curl -sX POST https://mcp.phishunt.io/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | jq .

Secrets

analyze_url_deep needs a DEEP_TOKEN Worker secret (the backend's X-Phishunt-Deep-Token). Without it configured, the tool still appears in tools/list but fails clean on tools/call — it never reaches the backend.

Terminal

wrangler secret put DEEP_TOKEN

Develop

Terminal

npm install
npm run dev          # wrangler dev on http://localhost:8787
MCP_URL=http://localhost:8787 npm test

Deploy

Terminal

npm run deploy       # wrangler deploy
MCP_URL=https://mcp.phishunt.io npm test

Related MCP Servers

View all in Security View all alternatives

Frequently Asked Questions about Phishunt

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "phishunt": { "command": "npx", "args": ["-y", "Phishunt"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/phishunt?style=directory)](https://allmcps.com/mcp/phishunt)

HTML Embed

<a href="https://allmcps.com/mcp/phishunt"><img src="https://allmcps.com/api/badge/phishunt?style=directory" alt="Phishunt on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

27Quality signal: Emerging · 27/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools11/30

Adoption & activity1/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to get the verified badge.

Free dofollow backlink: after claiming, verify your product site and place a dofollow AllMCPs badge — we recheck it stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to Phishunt →Install in Claude Desktop Install in Cursor Install in VS Code

Documentation Overview

phishunt-mcp

Model Context Protocol (MCP) server for phishunt.io.

Exposes the public phishing-domains feed as MCP tools so AI agents can look up suspicious domains, list phishings by targeted brand, and sync detection deltas.

Endpoint: https://mcp.phishunt.io/ (HTTP JSON-RPC 2.0, POST)
Protocol version: 2025-11-25
Auth: none (data is CC0)
License (data): CC0-1.0 · License (code): MIT

Tools

Name	Purpose
`check_domain`	Is this domain/URL substring in the active phishunt feed?
`list_brand_phishings`	List active phishings targeting a brand (e.g. `microsoft`).
`get_recent_detections`	Delta sync: detections since an ISO date.
`get_brand_metadata`	Curated brand metadata (display name, category, AI characterisation, active count).
`get_cert_metadata`	Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings).
`search_phishings`	Free-text search across active phishing URLs/domains/IPs (min 3 chars).
`analyze_url`	Passive phishing-signal analysis of any URL/domain - returns a single adjudicated `verdict` (phishing / likely_phishing / suspicious / no_evidence / not_assessed) plus the supporting evidence (URL-shape heuristics, stored score/verdict if known, external-feed cross-reference, historical detections). Unknown suspicious domains are auto-queued for full analysis.
`analyze_url_deep`	ACTIVE deep analysis of a URL (contacts the target: HTTP + TLS cert + RDAP + NS + GeoIP, SOCKS5-isolated) and re-scores it with the full 5-layer engine. Slow (5-15s), token-gated, and rate-limited (shared 50/day budget, single-flight) — requires `DEEP_TOKEN` configured on this Worker; use only when `analyze_url` is inconclusive.
`get_related_infrastructure`	Find infrastructure/content overlap for a known indicator (shared IP, cert, nameservers, favicon, etc.); surfaces the possible campaign / suspected cluster it belongs to.
`get_campaigns`	List possible campaigns / suspected clusters (shared-infrastructure groupings), optionally filtered by brand or active-only.
`get_campaign`	Full detail for one possible campaign / suspected cluster: evidence breakdown, every member indicator, export links.

Use with Claude Desktop / Claude.ai / other MCP clients

Add to your MCP client config:

config.json

{
  "mcpServers": {
    "phishunt": {
      "url": "https://mcp.phishunt.io/"
    }
  }
}

Quick test

Terminal

curl -sX POST https://mcp.phishunt.io/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | jq .

Secrets

Terminal

wrangler secret put DEEP_TOKEN

Develop

Terminal

npm install
npm run dev          # wrangler dev on http://localhost:8787
MCP_URL=http://localhost:8787 npm test

Deploy

Terminal

npm run deploy       # wrangler deploy
MCP_URL=https://mcp.phishunt.io npm test