io.github.0xDanielLopez/phishunt MCP Server

This MCP server (“io.github.0xDanielLopez/phishunt”) exposes a public phishing feed of suspicious/confirmed phishing URLs detected hourly. The data is described as having no authentication requirements and is licensed as CC0. Server topics include cloudflare-workers, MCP, MCP server, phishing, and threat-intelligence.

🛠️ Key Features

Public phishing feed
Hourly detection of suspicious/confirmed phishing URLs
No authentication
CC0 licensing

🚀 Use Cases

Threat-intelligence ingestion for phishing URL monitoring
Developer workflows that consume an MCP-based phishing feed
Integrations related to phishing and threat detection

⚡ Developer Benefits

Straightforward access without auth
Fits MCP tooling patterns (listed as “mcp” and “mcp-server” topics)
Reusable content under CC0 license

⚠️ Limitations

Limited to phishing feed data (suspicious/confirmed URLs detected hourly)

phishunt-mcp

Model Context Protocol (MCP) server for phishunt.io.

Exposes the public phishing-domains feed as MCP tools so AI agents can look up suspicious domains, list phishings by targeted brand, and sync detection deltas.

Endpoint: https://mcp.phishunt.io/ (HTTP JSON-RPC 2.0, POST)
Protocol version: 2025-11-25
Auth: none (data is CC0)
License (data): CC0-1.0 · License (code): MIT

Tools

Name	Purpose
`check_domain`	Is this domain/URL substring in the active phishunt feed?
`list_brand_phishings`	List active phishings targeting a brand (e.g. `microsoft`).
`get_recent_detections`	Delta sync: detections since an ISO date.
`get_brand_metadata`	Curated brand metadata (display name, category, AI characterisation, active count).
`get_cert_metadata`	Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings).
`search_phishings`	Free-text search across active phishing URLs/domains/IPs (min 3 chars).
`analyze_url`	Passive phishing-signal analysis of any URL/domain (URL-shape heuristics, stored score/verdict if known, historical detections). Unknown suspicious domains are auto-queued for full analysis.

Use with Claude Desktop / Claude.ai / other MCP clients

Add to your MCP client config:

json

{
  "mcpServers": {
    "phishunt": {
      "url": "https://mcp.phishunt.io/"
    }
  }
}

Quick test

bash

curl -sX POST https://mcp.phishunt.io/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | jq .

Develop

bash

npm install
npm run dev          # wrangler dev on http://localhost:8787
MCP_URL=http://localhost:8787 npm test

Deploy

bash

npm run deploy       # wrangler deploy
MCP_URL=https://mcp.phishunt.io npm test

brand	string	required	Brand slug (lowercase). Examples: 'microsoft', 'binance', 'spotify', 'paypal'. See https://phishunt.io/api/ for the full list.
limit	number	optional	Max results (1-1000). Default 50.

since	string	required	ISO date (YYYY-MM-DD) for the lower bound. Example: '2026-04-15'.
limit	number	optional	Max results (1-1000). Default 100.
brand	string	optional	Optional brand slug filter (e.g. 'amazon').

query	string	required	Search string (min 3 chars). Case-insensitive substring match against URL, domain, or IP.
limit	number	optional	Max results (1-200). Default 50.

Phishunt

io.github.0xDanielLopez/phishunt MCP Server

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

check_domain

list_brand_phishings

get_recent_detections

get_brand_metadata

get_cert_metadata

search_phishings

analyze_url

phishunt-mcp

Tools

Use with Claude Desktop / Claude.ai / other MCP clients

Quick test

Develop

Deploy

Install

Remote endpoint