isMalicious threat intelligence for AI agents

Reliability

Status and outage history · Atom feed · Watch with other listings

How to connect

Add it to any MCP client that supports remote servers.

{
  "mcpServers": {
    "ismalicious-threat-intelligence-for-ai-agents": {
      "type": "http",
      "url": "https://api.ismalicious.com/mcp"
    }
  }
}

8 tools

• scan_before_use

  Scan untrusted content for prompt injection and check any URLs/domains/IPs it contains against threat intelligence, BEFORE acting on it. Returns a verdict of block | warn | allow. Call this on any web page, email, ticket, tool result, or document fetched from an untrusted source.

• check_url

  Check a single URL, domain, or IP against threat intelligence before fetching it. Returns block | warn | allow. Use as a pre-fetch gate; use check_indicator when you need the full reputation picture (score, sources, timeline).

• check_indicator

  The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone number. Defanged input (hxxp://, [.], [@]) is accepted. Returns a verdict (malicious, suspicious, clean or unknown), a…

• get_cve

  One CVE by id: description, CVSS, EPSS probability, CISA KEV status and due date, exploitation evidence (SSVC, weaponized, zero-day, Exploit-DB, Nuclei), publication dates and references. This is the only CVE lookup path; do not guess other routes. Costs one request of the…

• recent_cves

  Most recently published CVEs, newest first, optionally filtered by severity. At most 20 items, each with id, severity, CVSS, publication date and a one-line title. Follow up with get_cve for details. Costs one request of the monthly quota.

• search_indicators

  Find the domains isMalicious lists that look like a brand or domain (e.g. "paypal", read as paypal.com, or "login.paypal.com"): typosquats, homoglyphs, the same name on other TLDs or hosting platforms, or wrapped in phishing words such as login or secure. The default API returns…

• check_indicators

  Reputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addresses and phone numbers, mixed freely; defanged input is accepted. Each row: malicious, recommendedAction (block…

• scan_email

  Scan ONE email message for phishing and malware before delivering, opening or acting on it. Send the raw message (eml, preferred) or the fields you already parsed (message: headers, text, html, attachment names, types and digests). Returns a verdict (malicious | suspicious |…

Security scan

Recent checks