ScanMalware.com URL Scanner

ใช้ทำอะไรได้

ตัวนี้ยังไม่ได้เรียบเรียงเป็นภาษาไทย ด้านล่างคือข้อเท็จจริงที่เราอ่านจาก registry

• การเชื่อมต่อ: รันบนคลาวด์
• ช่องทาง (transport): Streamable HTTP
• หมวด: ความปลอดภัยไซเบอร์
• ต้องใส่ค่าเหล่านี้: Authorization

ติดตั้ง

เลือกโปรแกรม AI ที่คุณใช้ แล้วคัดลอกค่าตั้งไปวาง

ต้องเตรียมก่อน

• รันบนคลาวด์ไม่ต้องลงโปรแกรมเพิ่ม ต่อผ่านอินเทอร์เน็ตได้เลย

คุณใช้แอปไหน

claude mcp add --transport http scanmalware https://mcp.scanmalware.com/mcp --header 'Authorization: ใส่ค่าของคุณ'

{
  "mcpServers": {
    "scanmalware": {
      "url": "https://mcp.scanmalware.com/mcp",
      "headers": {
        "Authorization": "ใส่ค่าของคุณ"
      }
    }
  }
}

{
  "servers": {
    "scanmalware": {
      "type": "http",
      "url": "https://mcp.scanmalware.com/mcp",
      "headers": {
        "Authorization": "ใส่ค่าของคุณ"
      }
    }
  }
}

ตัวเลือกเก็บในคุกกี้บนเครื่องนี้ ไม่ต้องมีบัญชี

ค่าที่ต้องใส่เอง

• Authorization ความลับ HTTP header
  Optional Bearer token when MCP_AUTH_TOKEN is set.

ค่าตั้งนี้สร้างจากข้อมูลใน registry ของผู้ทำ ถ้าไม่ตรงกับ README ให้เชื่อ README

ใช้กับโปรแกรมไหนได้

ดูจากแบบการต่อของ server ตัวนี้ และเอกสารของผู้ทำโปรแกรมแต่ละตัว ตรวจเมื่อ 10 พ.ย. 2569

ต่อผ่านคลาวด์ได้ใน

ClaudeChatGPTGooseLM StudioMsty StudioCherry StudioCursorVS Code + GitHub CopilotVisual StudioWindsurf (Devin Desktop)ZedKiroClineContinueJetBrains AI AssistantClaude CodeCodex CLIGemini CLIOpenCodenodecodeWarpLibreChatOpen WebUIRaycast

ดูโปรแกรมทั้งหมดพร้อมข้อดีข้อเสีย →

ทำอะไรได้บ้าง

ชื่อและคำอธิบายเครื่องมือตามที่ server ตอบมาเมื่อ 10 พ.ย. 2569 ผู้ทำเป็นคนเขียน ไม่ใช่เรา แสดงเป็นข้อความล้วน

• get_recent_scans

  List the most recent public scans, newest first (paginated with page and limit). Each row has the scan ID, URL, status, visibility and submission time. Unlisted and private scans are never included.

• submit_scan

  Submit a URL to ScanMalware to be rendered and analysed in a sandboxed browser; returns the new scan_id. scan_type is required and sets who can see the result: 'public' lists the URL and its results in the public feed, visible to anyone and to search engines; 'unlisted' keeps the

• get_scan_summary

  Get a compact summary of one scan: submitted URL, final URL after redirects, status, completion time and the security verdict (verdict text, risk level, confidence and risk factors). Useful as the first look at a scan; the verdict is empty for a few seconds after a scan completes

• wait_for_scan

  Wait for a submitted scan to finish by polling its status every poll_interval_s seconds, up to timeout_s seconds (default 180). Returns the final compact summary (URL, final URL, status, completion time and the security verdict), or the last known status with timeout set to true

• get_scan_result

  Get the full result document of one scan: URLs and redirects, page title, load times, links, network requests, IP addresses, JavaScript files, TLS, fuzzy hashes, screenshot hashes, favicon and the security verdict. The response is large; the compact summary is enough for a verdic

• search_scans

  Search the archive of public scans by text in the URL, domain or page title (paginated); q needs at least 3 characters and search_type narrows the match (default 'all'). Each result has the scan ID, URL, status, title, submission time and hosting ASN.

• get_ai_analysis

  Get the AI analysis of one scan: classification (LEGITIMATE to CONFIRMED_SCAM), scam type, risk score, confidence, impersonated brand and the key evidence behind it. The analysis is produced a few minutes after the scan completes and returns not found until then. It can disagree

• get_scan_progress

  Get the progress of a running scan: current step, total steps, step name, percentage and status. Useful for checking whether a scan has finished before reading its results. scan_id is the UUID of a ScanMalware scan.

• get_scan_ioc

  Check one scan against threat-intelligence indicator feeds: matching IP addresses and domains the page contacted, the threat types, and a summary of total and unique matches. scan_id is the UUID of a ScanMalware scan.

• get_tls_details

  Get the TLS certificate the scanned site presented: subject, issuer, validity dates, whether it was valid or expired, and related details. scan_id is the UUID of a ScanMalware scan.

• get_tls_asn1

  Get the raw ASN.1 structure of the TLS certificate from one scan, for detailed certificate inspection. scan_id is the UUID of a ScanMalware scan.

• get_technologies_by_scan

  List the web technologies detected on a scanned page (frameworks, CMS, CDN, analytics and so on), with versions where known. scan_id is the UUID of a ScanMalware scan.

• get_bot_protection

  Get the bot-protection and CAPTCHA services detected on a scanned page (for example Cloudflare Turnstile), with a detected flag. Phishing kits often use these to hide from scanners. scan_id is the UUID of a ScanMalware scan.

• get_yara_matches

  Get the YARA rule matches recorded for one scan, with the matching rules and a summary by severity and category. scan_id is the UUID of a ScanMalware scan.

• get_jarm_signatures

  Get the JARM TLS server fingerprints measured for the hosts in one scan, with whether each matches a known signature. A shared JARM often points to the same server software or hosting platform, so it is a weak pivot on its own. scan_id is the UUID of a ScanMalware scan.

• get_analyzer_results

  List which analysis modules ran for one scan (for example JavaScript fingerprinting and AI analysis), with each module's status, success flag and timing. Useful for checking why a result is missing. scan_id is the UUID of a ScanMalware scan.

• get_clipboard_events

  Get the clipboard writes the page attempted while it was scanned, with the event count and whether collection ran. Empty with an explanatory note when the page wrote nothing. scan_id is the UUID of a ScanMalware scan.

• get_js_fingerprints

  List the JavaScript files a scanned page loaded, each with its fingerprint: hashes (SHA-256, SHA-1, MD5, normalized and fuzzy), size metrics, detected library and bundler. The include_* options add function lists, HTTP headers or ML vector details. Useful for collecting script ha

• get_scan_reports

  List the user reports and votes filed about one scan (for example marked safe or malicious), with the total count; report_type filters by kind. Empty when nobody has reported the scan. scan_id is the UUID of a ScanMalware scan.

• get_domain_scans

  List the recent scans of a domain and its subdomains, newest first, up to limit; status filters by scan status. Each row has matched_on: 'url' when the scan was submitted for a host under this domain, and only 'final_url' when another site redirected there. A verdict on a final_u

• get_domain_history

  Get the scan history of a domain with the total count and the scans, paginated with page and limit.

• get_domain_stats

  Get scan counts for a domain: total, unique, completed and failed scans, first and latest scan, and scans in the last 24 hours, 7 days and 30 days.

• search_by_ip

  List scans of pages served from an IP address (paginated), each with scan ID, URL and time. On shared hosting and CDNs an IP serves many unrelated sites, so a match is not evidence of a connection.

• get_ip_stats

  Get statistics for an IP address across the archive: total scans, unique URLs, first and last seen, geolocation, ASN and organisation, BGP and DNS data; paginated.

• search_by_asn

  Get what the archive knows about an autonomous system (ASN number, without 'AS'): organisation, total scans, unique URLs, first and last seen and BGP prefixes; paginated.

• search_similar_scans

  Find scans that look like this one by screenshot similarity, favicon or fuzzy page hash (methods, default screenshot), each with URL, final URL, title and what it matched by; paginated. Useful for finding copies of a phishing page on other hosts. scan_id is the UUID of a ScanMalw

• search_semantic

  Search scans by meaning, comparing text with screenshot embeddings (for example 'bank login page asking for card details'). threshold defaults to -0.2 on a -1 to 1 scale; text-to-image scores are usually around -0.4 to 0.1, so useful thresholds are around -0.3 to 0. An empty resu

• search_by_favicon

  Search scans by favicon hash (paginated): a mmh3 hash by default, or the favicon's MD5 with hash_type='md5'.

• search_ai_high_risk

  List scans that the AI analysis rated high risk, optionally above min_risk_score and min_confidence, each with URL, title and the analysis. min_risk_score is on the AI's 0-10 risk scale (default 7) and min_confidence is a 0-100 percentage (default 70).

• search_ai_scam_type

  List scans whose AI analysis named a given scam type, such as 'Phishing', each with URL, title, submission time and the analysis (verdict, classification, risk score). The match is on the scam type text the analysis produced.

• search_ai_classification

  List scans whose AI analysis gave a specific classification: LEGITIMATE, LOW_RISK, MODERATE_RISK, HIGH_RISK or CONFIRMED_SCAM. Each result has the URL, title, submission time and the analysis.

• get_analyzer_stats

  Get platform-wide statistics for the scan analysis modules: the modules and their run counts. Describes the service, not a particular scan.

• search_analyzer_high_risk

  List scans that the security analyzer scored as high risk, highest first (paginated), each with URL, risk score, verdict, confidence and analysis time. min_risk_score raises the threshold.

• get_favicon

  Get the favicon recorded for a scan_id: its size, MD5 and SHA-256 hashes, and the image base64-encoded. found is false when no favicon is stored for the scan.

• get_favicon_stats

  Get favicon statistics across the archive: total favicons, those seen in the last 24 hours and the most common hashes with sample URLs. This aggregate query can take up to 90 seconds by default.

• get_screenshot_stats

  Get screenshot statistics across the archive: total screenshots, hash coverage and the distribution of perceptual hash types.

• search_similar_screenshots

  Find screenshots within max_distance (Hamming distance, default 3) of an integer perceptual hash (hash_type, default phash), each with scan, URL, title, distance and similarity score.

• search_ocr

  Search OCR text (paginated). q must contain at least 3 characters after trimming. This query can take up to 90 seconds by default.

• search_ocr_pattern

  Search the text read by OCR from scan screenshots for a pattern (paginated); case_sensitive controls matching. Useful for finding pages that show the same lure text as an image.

• search_by_jarm

  List scans whose server presented this JARM TLS fingerprint (paginated). Large hosting platforms share JARMs across many unrelated sites, so check what the matches have in common.

• search_by_fuzzy_hash

  List scans whose page content has a similar fuzzy hash (hash_type tlsh, ssdeep or sdhash; the value comes from a scan result), each with URL, title and time; paginated. Useful for finding near-identical copies of a page.

• search_by_screenshot_hash

  List scans whose screenshot has this perceptual hash (hash_type ahash, phash, dhash, whash, color_hash or crop_resistant), optionally within similarity_threshold, each with URL, title and time; paginated. Useful for finding pages that look the same.

• search_suspicious_clipboard

  List scans where the page wrote suspicious content to the clipboard (for example PowerShell commands), each with URL, event count, reason and time; pattern filters the content; paginated.

• get_recent_threats

  List malware threats detected in scans during the last hours (default window set by the API), with totals and grouping by threat.

• get_recent_yara_threats

  List YARA rule matches from scans in the last hours, each with the scan, URL, rule, category, severity and confidence.

• get_ct_certificates

  Get the certificates issued for a domain according to Certificate Transparency logs, with a found flag.

• get_ct_dns_records

  List subdomains of a domain found through Certificate Transparency, with their DNS records (type, IP addresses, TTL) and when they were seen. Useful for finding the other hosts of a domain.

• get_ct_domains_by_ip

  List domains that Certificate Transparency and DNS data associate with an IP address, with record counts and the total.

• get_ct_similar_domains

  Find domains with names similar to a domain in Certificate Transparency data (for example lookalikes and typosquats), each with a certificate count and the kind of similarity.

• get_ct_timeline

  Get the certificate history of a domain from Certificate Transparency: when certificates were issued and when the certificate changed.

• get_api_root

  Get the ScanMalware API's name, version, status, main endpoints and feature list.

• get_health

  Check whether the ScanMalware API is up. Returns the service status.

• get_platform_stats

  Get the current scan queue length, running scans and scans completed in the last 24 hours by visibility.

• get_latest_capabilities

  Get the current size of ScanMalware's detection content: indicator count, malware detection rules and ClamAV signatures.

• get_capabilities_by_date

  Get the size of ScanMalware's detection content (indicators, detection rules, ClamAV signatures) on a given date (scan_date, YYYY-MM-DD).

• get_clipboard_stats

  Get clipboard and pastejacking statistics across the archive: event totals, detections and daily activity.

• get_cpe_stats

  Get CPE statistics across the archive: scans with CPEs, unique CPEs, total detections, top vendors and products.

• get_cpe_by_scan

  List the CPE identifiers (product and version names in the NVD format) derived from the technologies detected on a scanned page, with their source. Useful for matching against vulnerability data. scan_id is the UUID of a ScanMalware scan.

• search_cpe

  Find scans with a CPE identifier matching a pattern such as 'cpe:2.3:a:facebook:react' (paginated). Useful for finding sites running a given product.

• get_ids_alerts

  Get intrusion detection (IDS) alerts raised on the network traffic recorded during one scan, with a severity breakdown and total count. Empty when no rule fired. scan_id is the UUID of a ScanMalware scan.

ผลตรวจเบื้องต้นi

เราตรวจจากข้อมูลที่ใครก็เปิดดูได้ ยังไม่ได้อ่านโค้ด ข้อที่ไม่เกี่ยวกับตัวนี้ไม่นับในตัวหาร · ตรวจเมื่อ 11 พ.ย. 2569

• ✓ ผ่าน

  ตัวตนผู้ทำตรงกับ repo

  ชื่อใน registry ยืนยันโดเมน mcp.scanmalware.com แล้ว (registry ตรวจความเป็นเจ้าของโดเมน)

• ✓ ผ่าน

  ยังมีคนดูแล

  มีการแก้โค้ดล่าสุด 3 วันที่ผ่านมา

• … ยังไม่ตรวจ

  มีสัญญาอนุญาต (license)

  ยังไม่ได้อ่านข้อมูล repo จาก GitHub

• ✓ ผ่าน

  endpoint ตอบ

  ตอบกลับใน 559 ms (HTTP 200)

• – ไม่เกี่ยว

  ล็อกอินแบบ OAuth

  ไม่ต้องล็อกอิน

• ✓ ผ่าน

  คำอธิบายเครื่องมือไม่มีคำสั่งแอบแฝง

  อ่านคำอธิบายเครื่องมือ 60 ตัวแล้ว ไม่พบคำสั่งแอบแฝงถึง AI

เทียบกับตัวอื่นในหมวด ความปลอดภัยไซเบอร์i

• ดาวมากกว่า 67% ของอีก 1024 ตัวในหมวดนี้
• ส่งรุ่นใหม่เข้า registry ล่าสุดกว่า 2% ของอีก 1024 ตัวในหมวดนี้
• ผลตรวจเบื้องต้นดีกว่าหรือเท่ากับ 100% ของอีก 1024 ตัวในหมวดนี้

เทียบกับทุก server ที่ยังใช้งานในหมวดนี้ทั้งทะเบียน ดาวนับเฉพาะเมื่อผู้ลงทะเบียนเป็นเจ้าของ repo

ตัวที่ใช้แทนได้

server หมวดเดียวกันจากผู้ทำคนอื่น เรียงตามดาว

อ่านการ์ด:↓ ดาวน์โหลดต่อสัปดาห์i★ ดาว GitHubiสามเสา: รีวิว · ผลตรวจ · การใช้งานiอัปเดต = วันที่ส่งรุ่นล่าสุดเข้า registryi

README จากผู้ทำ

python -m venv .venv

docker build -t scanmalware-mcp .

Submit an unlisted scan for https://example-login-update.com, wait for completion, and

Search scans for "acme login" (limit 5). For each result, list scan_id,

For scan_id 1234...abcd, fetch TLS details and the certificate PEM download.

DROPLET_NAME=scanmalware-mcp-small

doctl compute firewall create \

# Package exactly one commit; a tar of the working tree also picks up untracked

curl -I https://mcp.scanmalware.com/

python - <<'PY'

# Package exactly one commit; a tar of the working tree also picks up untracked

The redeploy script stops all three containers, replaces the files, and rebuilds

./deploy/push-redeploy.sh root@<droplet-ip> /path/to/key

doctl compute droplet delete <old-droplet-id> --force