com.scanmalware.mcp/scanmalware-mcp · v0.1.6 · security
ScanMalware.com URL Scanner is healthy: it completed an MCP handshake in 2923 ms and exposes 128 tools. It scores 53/100.
MCP server for ScanMalware.com URL scanning, malware detection, and analysis.
Endpoint: https://mcp.scanmalware.com/mcp (streamable-http)
Repository · Website · JSON · Add to my inventory
| health | 17 / 25 |
| authEase | 15 / 15 |
| toolQuality | 12 / 15 |
| maintenance | 1 / 15 |
| adoption | 0 / 10 |
| usage | 0 / 10 |
| security | 8 / 10 |
Scoring v0.3, computed 2026-10-14T21:45:57.441Z.
| Checked (UTC) | Status | Latency | Error |
|---|---|---|---|
| 2026-10-14T21:45:37.385Z | Healthy | 2923 |
get_recent_scans | List the most recent public scans, newest first (paginated with page and limit). Each row has the scan ID, URL, status, visibility and submission time. Unlisted and private scans are never included. |
submit_scan | Submit a URL to ScanMalware to be rendered and analysed in a sandboxed browser; returns the new scan_id. scan_type is required and sets who can see the result: 'public' lists the URL and its results in the public feed, visible to anyone and to search engines; 'unlisted' keeps the scan out of public |
get_scan_summary | Get a compact summary of one scan: submitted URL, final URL after redirects, status, completion time and the security verdict (verdict text, risk level, confidence and risk factors). Useful as the first look at a scan; the verdict is empty for a few seconds after a scan completes. scan_id is the UUI |
wait_for_scan | Wait for a submitted scan to finish by polling its status every poll_interval_s seconds, up to timeout_s seconds (default 180). Returns the final compact summary (URL, final URL, status, completion time and the security verdict), or the last known status with timeout set to true if the scan is still |
get_scan_result | Get the full result document of one scan: URLs and redirects, page title, load times, links, network requests, IP addresses, JavaScript files, TLS, fuzzy hashes, screenshot hashes, favicon and the security verdict. The response is large; the compact summary is enough for a verdict. scan_id is the UU |
search_scans | Search the archive of public scans by text in the URL, domain or page title (paginated); q needs at least 3 characters and search_type narrows the match (default 'all'). Each result has the scan ID, URL, status, title, submission time and hosting ASN. |
get_ai_analysis | Get the AI analysis of one scan: classification (LEGITIMATE to CONFIRMED_SCAM), scam type, risk score, confidence, impersonated brand and the key evidence behind it. The analysis is produced a few minutes after the scan completes and returns not found until then. It can disagree with the scanner's o |
get_scan_progress | Get the progress of a running scan: current step, total steps, step name, percentage and status. Useful for checking whether a scan has finished before reading its results. scan_id is the UUID of a ScanMalware scan. |
get_scan_ioc | Check one scan against threat-intelligence indicator feeds: matching IP addresses and domains the page contacted, the threat types, and a summary of total and unique matches. scan_id is the UUID of a ScanMalware scan. |
get_tls_details | Get the TLS certificate the scanned site presented: subject, issuer, validity dates, whether it was valid or expired, and related details. scan_id is the UUID of a ScanMalware scan. |
get_tls_asn1 | Get the raw ASN.1 structure of the TLS certificate from one scan, for detailed certificate inspection. scan_id is the UUID of a ScanMalware scan. |
get_technologies_by_scan | List the web technologies detected on a scanned page (frameworks, CMS, CDN, analytics and so on), with versions where known. scan_id is the UUID of a ScanMalware scan. |
get_bot_protection | Get the bot-protection and CAPTCHA services detected on a scanned page (for example Cloudflare Turnstile), with a detected flag. Phishing kits often use these to hide from scanners. scan_id is the UUID of a ScanMalware scan. |
get_yara_matches | Get the YARA rule matches recorded for one scan, with the matching rules and a summary by severity and category. scan_id is the UUID of a ScanMalware scan. |
get_jarm_signatures | Get the JARM TLS server fingerprints measured for the hosts in one scan, with whether each matches a known signature. A shared JARM often points to the same server software or hosting platform, so it is a weak pivot on its own. scan_id is the UUID of a ScanMalware scan. |
get_analyzer_results | List which analysis modules ran for one scan (for example JavaScript fingerprinting and AI analysis), with each module's status, success flag and timing. Useful for checking why a result is missing. scan_id is the UUID of a ScanMalware scan. |
get_clipboard_events | Get the clipboard writes the page attempted while it was scanned, with the event count and whether collection ran. Empty with an explanatory note when the page wrote nothing. scan_id is the UUID of a ScanMalware scan. |
get_js_fingerprints | List the JavaScript files a scanned page loaded, each with its fingerprint: hashes (SHA-256, SHA-1, MD5, normalized and fuzzy), size metrics, detected library and bundler. The include_* options add function lists, HTTP headers or ML vector details. Useful for collecting script hashes to search for e |
get_scan_reports | List the user reports and votes filed about one scan (for example marked safe or malicious), with the total count; report_type filters by kind. Empty when nobody has reported the scan. scan_id is the UUID of a ScanMalware scan. |
get_domain_scans | List the recent scans of a domain and its subdomains, newest first, up to limit; status filters by scan status. Each row has matched_on: 'url' when the scan was submitted for a host under this domain, and only 'final_url' when another site redirected there. A verdict on a final_url-only row belongs |
get_domain_history | Get the scan history of a domain with the total count and the scans, paginated with page and limit. |
get_domain_stats | Get scan counts for a domain: total, unique, completed and failed scans, first and latest scan, and scans in the last 24 hours, 7 days and 30 days. |
search_by_ip | List scans of pages served from an IP address (paginated), each with scan ID, URL and time. On shared hosting and CDNs an IP serves many unrelated sites, so a match is not evidence of a connection. |
get_ip_stats | Get statistics for an IP address across the archive: total scans, unique URLs, first and last seen, geolocation, ASN and organisation, BGP and DNS data; paginated. |
search_by_asn | Get what the archive knows about an autonomous system (ASN number, without 'AS'): organisation, total scans, unique URLs, first and last seen and BGP prefixes; paginated. |
search_similar_scans | Find scans that look like this one by screenshot similarity, favicon or fuzzy page hash (methods, default screenshot), each with URL, final URL, title and what it matched by; paginated. Useful for finding copies of a phishing page on other hosts. scan_id is the UUID of a ScanMalware scan. |
search_semantic | Search scans by meaning rather than exact words, comparing the query with scanned page content (for example 'bank login page asking for card details'). threshold (default 0.7) is the minimum similarity; an empty result means nothing was similar enough. |
search_by_favicon | Search scans by favicon hash (paginated): a mmh3 hash by default, or the favicon's MD5 with hash_type='md5'. |
search_ai_high_risk | List scans that the AI analysis rated high risk, optionally above min_risk_score and min_confidence, each with URL, title and the analysis. min_risk_score is on the AI's 0-10 risk scale (default 7) and min_confidence is a 0-100 percentage (default 70). |
search_ai_scam_type | List scans whose AI analysis named a given scam type, such as 'Phishing', each with URL, title, submission time and the analysis (verdict, classification, risk score). The match is on the scam type text the analysis produced. |
search_ai_classification | List scans whose AI analysis gave a specific classification: LEGITIMATE, LOW_RISK, MODERATE_RISK, HIGH_RISK or CONFIRMED_SCAM. Each result has the URL, title, submission time and the analysis. |
get_analyzer_stats | Get platform-wide statistics for the scan analysis modules: the modules and their run counts. Describes the service, not a particular scan. |
search_analyzer_high_risk | List scans that the security analyzer scored as high risk, highest first (paginated), each with URL, risk score, verdict, confidence and analysis time. min_risk_score raises the threshold. |
get_favicon | Get the favicon recorded for a scan_id: its size, MD5 and SHA-256 hashes, and the image base64-encoded. found is false when no favicon is stored for the scan. |
get_favicon_stats | Get favicon statistics across the archive: total favicons, those seen in the last 24 hours and the most common hashes with sample URLs. This aggregate query can take up to 90 seconds by default. |
get_screenshot_stats | Get screenshot statistics across the archive: total screenshots, hash coverage and the distribution of perceptual hash types. |
search_similar_screenshots | Find screenshots within max_distance (Hamming distance, default 3) of an integer perceptual hash (hash_type, default phash), each with scan, URL, title, distance and similarity score. |
search_ocr | Search OCR text (paginated). q must contain at least 3 characters after trimming. This query can take up to 90 seconds by default. |
search_ocr_pattern | Search the text read by OCR from scan screenshots for a pattern (paginated); case_sensitive controls matching. Useful for finding pages that show the same lure text as an image. |
search_by_jarm | List scans whose server presented this JARM TLS fingerprint (paginated). Large hosting platforms share JARMs across many unrelated sites, so check what the matches have in common. |
search_by_fuzzy_hash | List scans whose page content has a similar fuzzy hash (hash_type tlsh, ssdeep or sdhash; the value comes from a scan result), each with URL, title and time; paginated. Useful for finding near-identical copies of a page. |
search_by_screenshot_hash | List scans whose screenshot has this perceptual hash (hash_type ahash, phash, dhash, whash, color_hash or crop_resistant), optionally within similarity_threshold, each with URL, title and time; paginated. Useful for finding pages that look the same. |
search_suspicious_clipboard | List scans where the page wrote suspicious content to the clipboard (for example PowerShell commands), each with URL, event count, reason and time; pattern filters the content; paginated. |
get_recent_threats | List malware threats detected in scans during the last hours (default window set by the API), with totals and grouping by threat. |
get_recent_yara_threats | List YARA rule matches from scans in the last hours, each with the scan, URL, rule, category, severity and confidence. |
get_ct_certificates | Get the certificates issued for a domain according to Certificate Transparency logs, with a found flag. |
get_ct_dns_records | List subdomains of a domain found through Certificate Transparency, with their DNS records (type, IP addresses, TTL) and when they were seen. Useful for finding the other hosts of a domain. |
get_ct_domains_by_ip | List domains that Certificate Transparency and DNS data associate with an IP address, with record counts and the total. |
get_ct_similar_domains | Find domains with names similar to a domain in Certificate Transparency data (for example lookalikes and typosquats), each with a certificate count and the kind of similarity. |
get_ct_timeline | Get the certificate history of a domain from Certificate Transparency: when certificates were issued and when the certificate changed. |
get_api_root | Get the ScanMalware API's name, version, status, main endpoints and feature list. |
get_health | Check whether the ScanMalware API is up. Returns the service status. |
get_platform_stats | Get the current scan queue length, running scans and scans completed in the last 24 hours by visibility. |
get_latest_capabilities | Get the current size of ScanMalware's detection content: indicator count, malware detection rules and ClamAV signatures. |
get_capabilities_by_date | Get the size of ScanMalware's detection content (indicators, detection rules, ClamAV signatures) on a given date (scan_date, YYYY-MM-DD). |
get_clipboard_stats | Get clipboard and pastejacking statistics across the archive: event totals, detections and daily activity. |
get_cpe_stats | Get CPE statistics across the archive: scans with CPEs, unique CPEs, total detections, top vendors and products. |
get_cpe_by_scan | List the CPE identifiers (product and version names in the NVD format) derived from the technologies detected on a scanned page, with their source. Useful for matching against vulnerability data. scan_id is the UUID of a ScanMalware scan. |
search_cpe | Find scans with a CPE identifier matching a pattern such as 'cpe:2.3:a:facebook:react' (paginated). Useful for finding sites running a given product. |
get_ids_alerts | Get intrusion detection (IDS) alerts raised on the network traffic recorded during one scan, with a severity breakdown and total count. Empty when no rule fired. scan_id is the UUID of a ScanMalware scan. |
get_jarm_stats | Get JARM statistics across the archive, including the most common signatures. Common signatures usually belong to large hosting platforms. |
get_malware_stats | Get malware detection statistics across the archive: overall and last-24-hour counts, top threats and hourly trend. |
get_malware_by_scan | Get the malware detections for files the scanned page delivered, with threat names, detection counts and the detection source. Empty when nothing was detected. scan_id is the UUID of a ScanMalware scan. |
get_yara_stats | Get YARA statistics across the archive: overall and last-24-hour matches, severity and category distribution and top threats. |
get_yara_by_scan | Get YARA rule matches for one scan, with a summary by severity (critical, high, medium, low) and category. Empty when no rule matched. scan_id is the UUID of a ScanMalware scan. |
get_safe_browsing_stats | Get Google Safe Browsing statistics across the archive: total threats, threats in the last 7 days, scans with threats and threat types. |
get_safe_browsing | Get Google Safe Browsing threats found for the URLs in one scan, with a has_threats flag. scan_id is the UUID of a ScanMalware scan. |
get_top_tracking_keys | List the tracking and site keys seen on the most sites (analytics IDs, CAPTCHA keys and so on), with the tracker name, category and site count; tracker_type filters by kind. |
search_tracking_key | Find scans that embed a given tracking or site key, such as an analytics ID or a CAPTCHA site key (tracker_type and key), sorted latest or oldest; paginated. A shared key often ties sites to one operator. |
search_technologies | Search the web technologies detected across the archive by name (q) or category, each with how many scans used it and when it was last seen; paginated. |
get_technology_combinations | List the technologies most often detected together with a given technology, with counts; min_occurrences drops rare pairs; paginated. |
get_popular_technologies | List the most frequently detected web technologies over the last days (paginated). |
get_technology_stats | Get technology detection statistics across the archive: unique technologies, total detections and counts per category. This aggregate query can take up to 90 seconds by default. |
search_by_nameserver | List the scanned domains that use a given nameserver, with totals and counts per top-level domain. Useful for finding domains registered together. |
get_rdap | Get registration data (RDAP) for the scanned domain and its IP addresses: registrar, registration and expiry dates, domain age, nameservers and status. A very young domain is a common phishing signal. scan_id is the UUID of a ScanMalware scan. |
search_by_registrar | List scans of domains registered through a given registrar (paginated), with the total. Common registrars match very many domains. |
submit_scan_report | Vote on a scan, as the Mark as Safe and Mark as Malicious buttons on its result page do: report_type 'positive_feedback' marks the scanned page as safe and 'malware' marks it as malicious. report_details is an optional note of up to 1000 characters. Votes are recorded as crowd feedback on the scan a |
get_ocr_stats | Get OCR statistics across the archive: scans with OCR text, average confidence and length, language distribution and daily counts. |
get_ocr_by_scan | Get the text read by OCR from the scan's screenshot, with language, confidence, word and character counts and any regions flagged as suspicious. Useful when page text is drawn as images. scan_id is the UUID of a ScanMalware scan. |
get_open_graph | Get the Open Graph and Twitter card metadata the scanned page declared (title, description, image, site name). Phishing pages often copy a brand's metadata. scan_id is the UUID of a ScanMalware scan. |
get_pastejacking | Get pastejacking findings for one scan: attempts by the page to replace what a visitor copies, a common trick for making victims paste malicious commands. Includes a detected flag and a note. scan_id is the UUID of a ScanMalware scan. |
get_netlog | Describe the network log (Chrome NetLog) for a scan_id: whether one exists, its size, and its encoding. The log itself is not returned - these are routinely tens of megabytes gzipped. |
get_pcap_metadata | Describe the packet capture (PCAP) recorded during one scan: whether it exists, its size, compression and content type. The capture itself is not returned. scan_id is the UUID of a ScanMalware scan. |
search_favicon_mmh3 | List scans whose favicon has this mmh3 hash (the same convention as Shodan's http.favicon.hash), each with the page URL, title and favicon details; paginated. Phishing kits often reuse one favicon across many hosts. |
get_js_runtime_behaviour | Get the runtime JavaScript behaviour recorded for one scan: overall risk, risk scores, number of scripts, eval and Function-constructor calls and high-risk events, with a behavioural signature and composite hash. include_detailed_events adds the individual events. scan_id is the UUID of a ScanMalwar |
get_js_runtime_stats | Get platform-wide statistics for runtime JavaScript analysis: risk distribution, averages and totals of eval calls and high-risk events. Describes the service, not a scan. |
get_js_runtime_health | Check whether the runtime JavaScript analysis service is up, with its version. |
get_js_runtime_coverage | Get how many scans have runtime JavaScript fingerprints: coverage percentage and the number of unique composite hashes and signatures. Describes the service, not a scan. |
search_js_obfuscation | List scans by the obfuscation signals their runtime JavaScript showed, newest analysis first: overall risk, maximum and average risk score, eval and Function constructor calls and high-risk events. Optional filters are risk_level (such as 'high' or 'critical'), min_risk_score (0-100) and has_eval; w |
search_js_malware_families | List groups of scans whose runtime JavaScript behaves alike (possible malware families), with clusters of at least min_cluster_size scans (default 2) at similarity_threshold or above (0 to 1, default 0.95). When the service has clustering switched off, status is 'disabled' and no families are return |
search_js_runtime_by_composite_hash | Find scans whose runtime JavaScript behaviour has this composite hash, each with the target URL, overall risk and time. The same composite hash across hosts usually means the same kit. |
search_js_runtime_by_signature | Find scans with this behavioural signature (for example 'setTimeout:30|fetch:4|complex'), each with the target URL, overall risk and time. An uncached query can take up to 90 seconds by default. |
search_js_runtime_similar | Find scans whose runtime JavaScript behaviour is similar to this scan's, above min_similarity; include_self keeps the scan itself. scan_id is the UUID of a ScanMalware scan. |
get_js_segments_by_scan | List the code segments (functions and blocks) extracted from one scan's JavaScript, each with location, length, snippet and hashes; script_url narrows to one file, paginated with limit and offset. scan_id is the UUID of a ScanMalware scan. |
search_js_segments_by_hash | Find code segments with this exact code hash across the archive, with the scans and scripts they appear in; paginated with limit and offset. |
search_js_segments_by_normalized_hash | Find code segments with this normalized hash (formatting-independent) across the archive, with the scans and scripts they appear in; paginated with limit and offset. |
get_js_segments_suspicious | List the JavaScript code segments from one scan scored as suspicious, above min_risk_score, with location, snippet and risk details; paginated with limit and offset. scan_id is the UUID of a ScanMalware scan. |
get_js_segments_unknown | List the JavaScript code segments from one scan that match no known library, at least min_code_length long; these are usually the page's own or a kit's code. Paginated with limit and offset. scan_id is the UUID of a ScanMalware scan. |
run_js_differential_analysis | Compare the JavaScript of one scan against known libraries and report which code segments match a library, which are unknown and which look suspicious, with a per-library breakdown. Matches below min_confidence (default 0.8) are not counted; known library code is excluded unless include_known_librar |
get_js_library_inventory | List the JavaScript libraries and versions detected across the archive, with how many scans used each; library filters to one library and min_count drops rare versions. Identifiers are lowercase names such as 'react', 'jquery' or 'nextjs'. |