Context7
Up-to-date docs for AI agents
Beschreibung vom Entwickler (englisches Original)
Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.
Diese drei werden nie zu einer Punktzahl zusammengefasst: Meinungen, Messungen und Beliebtheit sind verschiedene Dinge.
Für diesen Server haben wir noch keine Zusammenfassung in einfacher Sprache geschrieben. Unten stehen die Fakten, die wir aus der Registry gelesen haben.
Wähle die KI-App, die du nutzt, und kopiere die Einstellungen.
Du brauchst
Welche App nutzt du?
Wähle oben deine App. Wir merken sie uns, damit der Button beim nächsten Mal „In … installieren“ anzeigt.
Funktioniert in Claude im Web, auf dem Desktop und auf dem Handy:
https://ohey.ca/mcp/researchFühre das in deinem Terminal aus
claude mcp add --transport http research https://ohey.ca/mcp/researchIn .cursor/mcp.json in deinem Projekt oder in ~/.cursor/mcp.json einfügen
{
"mcpServers": {
"research": {
"url": "https://ohey.ca/mcp/research"
}
}
}Dein Browser fragt, ob er die App öffnen darf, dann zeigt die App die Einstellungen und bittet dich um Bestätigung. Schlüsselwerte bleiben leer, damit du sie selbst einträgst.
In .vscode/mcp.json in deinem Projekt einfügen
{
"servers": {
"research": {
"type": "http",
"url": "https://ohey.ca/mcp/research"
}
}
}Dein Browser fragt, ob er die App öffnen darf, dann zeigt die App die Einstellungen und bittet dich um Bestätigung. Schlüsselwerte bleiben leer, damit du sie selbst einträgst.
ChatGPT verbindet sich nur mit Servern im Internet:
https://ohey.ca/mcp/researchMenünamen können sich je nach Tarif und mit der Zeit leicht unterscheiden.
Deine Auswahl bleibt in einem Cookie auf diesem Gerät; kein Konto nötig.
Diese Einstellungen werden aus dem Registry-Eintrag des Entwicklers erzeugt. Wenn in der README etwas anderes steht, folge der README.
Tool-Namen und -Beschreibungen genau so, wie der Server sie am 6. Nov. 2026 gemeldet hat. Geschrieben hat sie der Entwickler, nicht wir; wir zeigen sie als reinen Text.
list_threatsEvery technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits with names and site counts in one call.
get_threatA technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and core versions, kits seen together on the same sites, its EtherHiding contracts, the hosts its ClickFix commands fetch f
list_research_articlesOhey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facts and indicators.
get_articleOne research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defanged as published. Read the page at url for the full write-up.
search_etherhiding_contractsSmart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when Ohey last read each one. firstSeen is the day Ohey first read the contract, not when it was deployed; many contracts sha
get_etherhiding_contractOne contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as an array, one entry per chain the address is tracked on (usually one), each with history: its 20 most recent changes, and historyCapped is t
get_feed_statsThe size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed as legitimate services and kept out. week.added (and daily): hosts that entered the feed. week.entered: website tips that
search_clickfix_commandsHosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kits credited with each (a ClickFix kit is credited when it is on at least half the sites whose command used the host), sites whose captured c
Wir prüfen Informationen, die jeder sehen kann; den Code haben wir nicht gelesen. Checks, die nicht zutreffen, werden nicht mitgezählt. · Geprüft am 6. Nov. 2026
Der Registry-Name wurde über die Domain ohey.ca bestätigt (die Registry prüft, wem die Domain gehört)
Dieses Repo haben wir noch nicht von GitHub gelesen
Dieses Repo haben wir noch nicht von GitHub gelesen
Antwort in 590 ms (HTTP 200)
Keine Anmeldung nötig
Wir haben 8 Tool-Beschreibungen gelesen und keine versteckten Anweisungen an die KI gefunden
Verglichen mit allen aktiven Servern dieser Kategorie in der Registry. Sterne zählen nur, wenn dem Herausgeber das Repo gehört.
Er hat 3 von 3 zutreffenden Basischecks bestanden. Den Code haben wir nicht gelesen. Bevor du einen Schlüssel oder Token hinzufügst, sieh nach, welche Zugriffe der Server verlangt, und nutze einen Schlüssel, der nur die Berechtigungen hat, die du brauchst.
Die Registry nennt keinen erforderlichen Schlüssel, manche Server bitten dich aber bei der ersten Nutzung, dich anzumelden.
Er läuft in der Cloud des Entwicklers. Du verbindest dich übers Internet, ohne etwas zu installieren, aber was du sendest, läuft über die Server des Entwicklers.
Das GitHub-Repo wurde zuletzt – geändert, und die neueste Version (1.0.0) kam vorgestern in die Registry.
Apps, die MCP unterstützen, etwa Claude Desktop, Claude Code, Cursor und VS Code. Er verbindet sich per URL, also funktionieren auch Apps, die Remote-MCP-Server akzeptieren, zum Beispiel ChatGPT im Entwicklermodus.
In derselben Kategorie: Context7, Codebase Memory, Exa
Server derselben Kategorie von anderen Entwicklern, sortiert nach Sternen.
So liest du eine Karte:★ GitHub-SterneiDrei Säulen: Bewertungen · Checks · NutzungiAktualisiert = neueste Version in der Registry veröffentlichti
Up-to-date docs for AI agents
Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.
Connect AI agents to Exa for web search, content fetching, and multi-step research.
Unverändert aus dem Repo des Entwicklers übernommen. PopNx MCP hat den Inhalt weder geprüft noch empfiehlt es ihn. HTML, Bilder und Skripte wurden entfernt. Links führen von dieser Website weg.
Ohey scans websites for injected malware: ClickFix and fake update lures, skimmers, phishing kits, EtherHiding loaders, and the C2 and distribution servers behind them. There are two remote MCP servers (Streamable HTTP).
| Server | URL | Sign-in |
|---|---|---|
| Research | https://ohey.ca/mcp/research | None |
| Feed and API | https://ohey.ca/mcp | Ohey account with API access |
Both servers are remote Streamable HTTP servers, so there is nothing to download. The examples add the research server; for the feed server, use the name ohey and the URL https://ohey.ca/mcp, and the client opens ohey.ca to sign in the first time.
Both are in the MCP Registry as ca.ohey/research and ca.ohey/ohey.
Web, desktop and mobile: Settings, Connectors, Add custom connector, then paste the URL.
Claude Code:
claude mcp add --transport http ohey-research https://ohey.ca/mcp/research
Custom MCP servers need developer mode, which OpenAI offers on some plans and has moved between settings pages; a Business or Enterprise admin may have to allow custom connectors first.
codex mcp add ohey-research --url https://ohey.ca/mcp/research
For the feed server, add it with --url https://ohey.ca/mcp, then run codex mcp login ohey to sign in. Or in ~/.codex/config.toml:
[mcp_servers.ohey-research]
url = "https://ohey.ca/mcp/research"
gemini mcp add --transport http ohey-research https://ohey.ca/mcp/research
Or in settings.json, under mcpServers:
"ohey-research": { "httpUrl": "https://ohey.ca/mcp/research" }
For the feed server, run /mcp auth ohey in the CLI to sign in.
In ~/.cursor/mcp.json, or .cursor/mcp.json in a project:
{
"mcpServers": { "ohey-research": { "url": "https://ohey.ca/mcp/research" } } }
code --add-mcp '{"name":"ohey-research","type":"http","url":"https://ohey.ca/mcp/research"}'
Or run MCP: Add Server, choose HTTP and paste the URL. The JSON form, in .vscode/mcp.json or your user mcp.json:
{
"servers": { "ohey-research": { "type": "http", "url": "https://ohey.ca/mcp/research" } } }
Any client that supports remote MCP servers over Streamable HTTP takes the URL as is. Most read an mcpServers object with a url (some call the field serverUrl or httpUrl). A client that only runs local stdio servers can reach either one through mcp-remote:
{
"mcpServers": { "ohey-research": { "command": "npx", "args": ["-y", "mcp-remote", "https://ohey.ca/mcp/research"] } } }
The research Ohey publishes on ohey.ca/threats and ohey.ca/research, as tools. Anyone can connect, with no sign-in.
| Tool | What it does |
|---|---|
list_threats | Every technique, with its page, a summary, site counts and its kits. |
get_threat | A technique or kit: sites matched by month, how many were still infected when rescanned, WordPress and Joomla shares, common plugins, kits seen on the same sites, its EtherHiding contracts, its ClickFix command hosts and articles. |
list_research_articles | Research articles, newest first. |
get_article | One article's summary, key facts (hashes, active window, scale) and its indicators of compromise, as Markdown. |
search_clickfix_commands | Hosts that ClickFix lure commands fetch from, by kit or host, with the latest command for each, defanged. |
search_etherhiding_contracts | Contracts that compromised sites read their next stage from, by kit, chain or destination host. |
get_etherhiding_contract | One contract's destinations over time. |
get_feed_stats | Feed size, last week's additions and removals, and the capture archive. |
Counts update daily from Ohey's scans. Both search tools take offset to page past limit, and sort: "firstSeen" for the newest first. A host search that finds nothing returns a coverage note: the trackers list only contract destinations and command hosts, so a miss means "not tracked", not "clean". Checking any host against the full feed is the feed server's job.
Hosts and commands are live malware infrastructure. They come defanged ([.], hxxp), and results that carry commands include a notice for the person reading. Refang or run them only in an isolated research environment. See the terms.
Ohey's API as tools: look up any host, search the feed, read CVEs and scan URLs. You sign in with your Ohey account, so there is no API key to copy. Ask for an account with API access at ohey.ca/contact.
Connect it the same way as the research server, with https://ohey.ca/mcp as the URL (Install). Signing in opens ohey.ca; approve the connection there and the client gets access. Clients register themselves from the server's OAuth metadata, so there is no client ID to set.
| Tool | What it does |
|---|---|
search_indicators | Hosts in the feed, filtered by tag or family, with roles, families, tags and the reason each was admitted. |
get_host | A host's feed entry, vulnerable software from its latest capture, its captures summary and DNS records. |
get_host_captures | Each time the scanner loaded the host: when, what it returned and what matched. |
list_delisted | Hosts that review excluded or took out of the feed, with the reason and who decided. |
get_vulnerability | One CVE with its NVD, EPSS, KEV, GitHub and OSV data. |
list_vulnerabilities | Published CVEs in order, or only WordPress plugin, theme and core CVEs. |
start_scan | Loads a URL in Ohey's scanner and records what it finds. |
get_scan | The scan result: whether the page is malicious, what matched, commands and clipboard writes it tried to plant, and suspected C2. |
The scan tools appear only when you tick "Scan URLs" while approving. Scans count against your account.
Approving a client creates an API key named after it, under Account in the Ohey portal. Tool calls are rate limited and counted against that key like any API request. Revoke the key to disconnect the client.
The full API, with every response field, is documented at ohey.ca/docs.
Report security issues to hey@ohey.ca. See security.txt.