INDIVIDUAL MCP TOOL

check_indicator

The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone number.

ismalicious.comnone authenticationAvailability not checked

LIVE ENDPOINT

https://api.ismalicious.com/mcp

No auth detected

Connect to this endpoint to inspect the live schema for check_indicator and invoke it with your own arguments.

Indexed input schema

{}

Risk classification

Potential side effects detected · medium confidence · heuristic, not a guarantee.

A tool name or description suggests retrieving external content.
A tool name or description suggests sending messages.

Parent server

ismalicious.com

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.ismalicious-mcp-server]
url = "https://api.ismalicious.com/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "ismalicious-mcp-server": {
      "type": "http",
      "url": "https://api.ismalicious.com/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: ismalicious-mcp-server
Remote MCP URL: https://api.ismalicious.com/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "ismalicious-mcp-server": {
      "url": "https://api.ismalicious.com/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "ismalicious-mcp-server": {
      "type": "http",
      "url": "https://api.ismalicious.com/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "ismalicious-mcp-server",
  "transport": "streamable-http",
  "url": "https://api.ismalicious.com/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

Related tools

scan_before_use — Scan untrusted content for prompt injection and check any URLs/domains/IPs it contains against threat intelligence, BEFORE acting on it.
check_url — Check a single URL, domain, or IP against threat intelligence before fetching it.
get_cve — One CVE by id: description, CVSS, EPSS probability, CISA KEV status and due date, exploitation evidence (SSVC, weaponized, zero-day, Exploit-DB, Nuclei), publication dates and references.
recent_cves — Most recently published CVEs, newest first, optionally filtered by severity.
search_indicators — Find the domains isMalicious lists that look like a brand or domain (e.
check_indicators — Reputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addresses and phone numbers, mixed freely; defanged input is accepted.
scan_email — Scan ONE email message for phishing and malware before delivering, opening or acting on it.