Ohey research

Ohey MCP servers

Ohey scans websites for injected malware: ClickFix and fake update lures, skimmers, phishing kits, EtherHiding loaders, and the C2 and distribution servers behind them. There are two remote MCP servers (Streamable HTTP).

Install

Both servers are remote Streamable HTTP servers, so there is nothing to download. The examples add the research server; for the feed server, use the name ohey and the URL https://ohey.ca/mcp, and the client opens ohey.ca to sign in the first time.

Both are in the MCP Registry as ca.ohey/research and ca.ohey/ohey.

Claude

Web, desktop and mobile: Settings, Connectors, Add custom connector, then paste the URL.

Claude Code:

claude mcp add --transport http ohey-research https://ohey.ca/mcp/research

ChatGPT

Custom MCP servers need developer mode, which OpenAI offers on some plans and has moved between settings pages; a Business or Enterprise admin may have to allow custom connectors first.

1. Turn on developer mode in ChatGPT's settings.
2. Add a custom connector (or app), give it a name and paste the URL.
3. Set Authentication to No authentication for the research server, or OAuth for the feed server.
4. In a new chat, turn the connector on from the tools menu.

OpenAI Codex

codex mcp add ohey-research --url https://ohey.ca/mcp/research

For the feed server, add it with --url https://ohey.ca/mcp, then run codex mcp login ohey to sign in. Or in ~/.codex/config.toml:

[mcp_servers.ohey-research]

url = "https://ohey.ca/mcp/research"

Gemini CLI

gemini mcp add --transport http ohey-research https://ohey.ca/mcp/research

Or in settings.json, under mcpServers:

"ohey-research": { "httpUrl": "https://ohey.ca/mcp/research" }

For the feed server, run /mcp auth ohey in the CLI to sign in.

Cursor

In ~/.cursor/mcp.json, or .cursor/mcp.json in a project:

{

"mcpServers": { "ohey-research": { "url": "https://ohey.ca/mcp/research" } } }

VS Code (GitHub Copilot)

code --add-mcp '{"name":"ohey-research","type":"http","url":"https://ohey.ca/mcp/research"}'

Or run MCP: Add Server, choose HTTP and paste the URL. The JSON form, in .vscode/mcp.json or your user mcp.json:

{

"servers": { "ohey-research": { "type": "http", "url": "https://ohey.ca/mcp/research" } } }

Other clients

Any client that supports remote MCP servers over Streamable HTTP takes the URL as is. Most read an mcpServers object with a url (some call the field serverUrl or httpUrl). A client that only runs local stdio servers can reach either one through mcp-remote:

{

"mcpServers": { "ohey-research": { "command": "npx", "args": ["-y", "mcp-remote", "https://ohey.ca/mcp/research"] } } }

Research server

The research Ohey publishes on ohey.ca/threats and ohey.ca/research, as tools. Anyone can connect, with no sign-in.

Counts update daily from Ohey's scans. Both search tools take offset to page past limit, and sort: "firstSeen" for the newest first. A host search that finds nothing returns a coverage note: the trackers list only contract destinations and command hosts, so a miss means "not tracked", not "clean". Checking any host against the full feed is the feed server's job.

Hosts and commands are live malware infrastructure. They come defanged ([.], hxxp), and results that carry commands include a notice for the person reading. Refang or run them only in an isolated research environment. See the terms.

Feed and API server

Ohey's API as tools: look up any host, search the feed, read CVEs and scan URLs. You sign in with your Ohey account, so there is no API key to copy. Ask for an account with API access at ohey.ca/contact.

Connect it the same way as the research server, with https://ohey.ca/mcp as the URL (Install). Signing in opens ohey.ca; approve the connection there and the client gets access. Clients register themselves from the server's OAuth metadata, so there is no client ID to set.

Tools

The scan tools appear only when you tick "Scan URLs" while approving. Scans count against your account.

Access and revoking it

Approving a client creates an API key named after it, under Account in the Ohey portal. Tool calls are rate limited and counted against that key like any API request. Revoke the key to disconnect the client.

The full API, with every response field, is documented at ohey.ca/docs.

Security

Report security issues to hey@ohey.ca. See security.txt.