# Phishunt Mcp

> Model Context Protocol (MCP) server for phishunt.io — query the public phishing feed from AI agents.

- **Type:** MCP server
- **Install:** `agentstack add mcp-0xdaniellopez-phishunt-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [0xDanielLopez](https://agentstack.voostack.com/s/0xdaniellopez)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [0xDanielLopez](https://github.com/0xDanielLopez)
- **Source:** https://github.com/0xDanielLopez/phishunt-mcp
- **Website:** https://mcp.phishunt.io

## Install

```sh
agentstack add mcp-0xdaniellopez-phishunt-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# phishunt-mcp

**Model Context Protocol (MCP) server for [phishunt.io](https://phishunt.io).**

Exposes the public phishing-domains feed as MCP tools so AI agents can look up
suspicious domains, list phishings by targeted brand, and sync detection deltas.

- **Endpoint**: `https://mcp.phishunt.io/` (HTTP JSON-RPC 2.0, POST)
- **Protocol version**: 2025-11-25
- **Auth**: none (data is CC0)
- **License (data)**: CC0-1.0 · **License (code)**: MIT

## Tools

| Name | Purpose |
|---|---|
| `check_domain` | Is this domain/URL substring in the active phishunt feed? |
| `list_brand_phishings` | List active phishings targeting a brand (e.g. `microsoft`). |
| `get_recent_detections` | Delta sync: detections since an ISO date. |
| `get_brand_metadata` | Curated brand metadata (display name, category, AI characterisation, active count). |
| `get_cert_metadata` | Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings). |
| `search_phishings` | Free-text search across active phishing URLs/domains/IPs (min 3 chars). |
| `analyze_url` | Passive phishing-signal analysis of any URL/domain (URL-shape heuristics, stored score/verdict if known, historical detections). Unknown suspicious domains are auto-queued for full analysis. |
| `get_related_infrastructure` | Find infrastructure/content overlap for a known indicator (shared IP, cert, nameservers, favicon, etc.); surfaces the possible campaign / suspected cluster it belongs to. |
| `get_campaigns` | List possible campaigns / suspected clusters (shared-infrastructure groupings), optionally filtered by brand or active-only. |
| `get_campaign` | Full detail for one possible campaign / suspected cluster: evidence breakdown, every member indicator, export links. |

## Use with Claude Desktop / Claude.ai / other MCP clients

Add to your MCP client config:

```json
{
  "mcpServers": {
    "phishunt": {
      "url": "https://mcp.phishunt.io/"
    }
  }
}
```

## Quick test

```bash
curl -sX POST https://mcp.phishunt.io/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | jq .
```

## Develop

```bash
npm install
npm run dev          # wrangler dev on http://localhost:8787
MCP_URL=http://localhost:8787 npm test
```

## Deploy

```bash
npm run deploy       # wrangler deploy
MCP_URL=https://mcp.phishunt.io npm test
```

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [0xDanielLopez](https://github.com/0xDanielLopez)
- **Source:** [0xDanielLopez/phishunt-mcp](https://github.com/0xDanielLopez/phishunt-mcp)
- **License:** MIT
- **Homepage:** https://mcp.phishunt.io

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-0xdaniellopez-phishunt-mcp
- Seller: https://agentstack.voostack.com/s/0xdaniellopez
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.