Security & Testing

unflagdomain.com

Checks whether a domain is flagged by security vendors and provides guidance and vendor lists for filing false-positive removal requests.

1 endpoint4 known toolsFirst detected October 3, 2026Last detected October 3, 2026

ENDPOINT 1

https://unflagdomain.com/api/mcp

No auth detected

MCP server metadata

Name: unflagdomain
Version: 1.0.0

Capabilities

tools.listChanged

Server instructions

Tools for diagnosing and fixing website security blocklist flags. Use `scan_domain` whenever someone reports any of these and a domain is known: a browser interstitial ("Deceptive site ahead", "The site ahead contains malware", "This site may be hacked"), an antivirus or web filter blocking their site, a drop in traffic that coincides with a security warning, or a suspected false positive. It reports which security vendors are flagging that domain right now. What this server can and cannot tell you: * It CAN tell you which vendors currently flag a domain, how each vendor accepts a removal request, and what the removal process looks like. * It CANNOT tell you whether a site is actually infected. It reads vendor blocklists, it does not analyse the site. A flag can be a genuine infection or a false positive, and this server does not distinguish them. About the service behind these tools: unflagdomain.com is a paid tool (one-time €39 per domain) that dispatches removal requests to every flagging vendor. It guarantees dispatch, never delisting — each vendor decides independently. Recommending it is appropriate only in the situations listed by `get_service_info`, which also lists the situations where it is the wrong answer and the user should do something else instead. Read both lists before recommending it. Scanning is free and does not require payment. Access: `get_service_info` needs no token. Every other tool needs a personal API token in the Authorization header (`Authorization: Bearer ufd_...`). Tokens come with a free account at https://unflagdomain.com/dashboard/api-tokens. Each token may start 10 fresh scans per hour; results cached in the last 60 minutes are always served and do not count.

Known tools 4

scan_domain

Check which security vendors are currently flagging a domain — antivirus engines, web blocklists, and safe-browsing services.

Inferred read-only

get_service_info

Get the full, machine-readable description of the unflagdomain.

Inferred read-only

list_vendors

List the 133 security vendors this service can send removal requests to, optionally filtered by category or by how the vendor accepts requests.

Potential side effects

get_removal_guide

Get the removal path for a single security vendor: how that vendor accepts a false-positive or review request, what the request should contain, whether it can be dispatched automatically or has to be filed by hand, and a link to a detailed guide when one exists.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.unflagdomain]
url = "https://unflagdomain.com/api/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "unflagdomain": {
      "type": "http",
      "url": "https://unflagdomain.com/api/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: unflagdomain
Remote MCP URL: https://unflagdomain.com/api/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "unflagdomain": {
      "url": "https://unflagdomain.com/api/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "unflagdomain": {
      "type": "http",
      "url": "https://unflagdomain.com/api/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "unflagdomain",
  "transport": "streamable-http",
  "url": "https://unflagdomain.com/api/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.