INDIVIDUAL MCP TOOL

analyze_url

Analyze any URL for phishing signals WITHOUT contacting it (passive).

phishunt.ionone authenticationAvailability not checked

LIVE ENDPOINT

https://mcp.phishunt.io

No auth detected

Connect to this endpoint to inspect the live schema for analyze_url and invoke it with your own arguments.

{}

Inferred read-only · medium confidence · heuristic, not a guarantee.

CONNECT WITH APPROVAL

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.phishunt-mcp]
url = "https://mcp.phishunt.io"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "phishunt-mcp": {
      "type": "http",
      "url": "https://mcp.phishunt.io"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: phishunt-mcp
Remote MCP URL: https://mcp.phishunt.io

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "phishunt-mcp": {
      "url": "https://mcp.phishunt.io"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "phishunt-mcp": {
      "type": "http",
      "url": "https://mcp.phishunt.io"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "phishunt-mcp",
  "transport": "streamable-http",
  "url": "https://mcp.phishunt.io"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

check_domain — Check whether a domain (or URL substring) appears in the phishunt active phishing feed.
list_brand_phishings — List active phishing sites targeting a specific brand.
get_recent_detections — Retrieve phishing detections since a given date.
get_brand_metadata — Fetch curated metadata for a tracked brand: display name, STIX industry sector and display vertical, primary domain, an AI-authored characterisation of why the brand tends to be targeted by phishing, and the current count of active phishings.
get_cert_metadata — Fetch factual metadata for a TLS intermediate CA seen on phishing sites: operator, root CA, key type (RSA/ECDSA), typical use case, related sibling intermediates, and the count of active phishings using this intermediate.
search_phishings — Free-text search across active phishing URLs, domains, and IP addresses.
analyze_url_deep — ACTIVE deep analysis of a URL: unlike analyze_url (which NEVER contacts the target), this tool actively fetches it - HTTP response, TLS certificate, RDAP registration, nameservers, and GeoIP, all through a SOCKS5 proxy - and re-scores it with phishunt's full 5-layer detection engine.
get_related_infrastructure — Find infrastructure and content overlap between a known phishing indicator and other phishunt detections: shared IP, TLS certificate, nameservers, favicon/screenshot, redirect target, or naming pattern.