Ohey research

Name: Ohey research
Author: Oheyresearch

by Oheyresearchversion 1.0.0i★ –iRuns in the cloud

Registry nameca.ohey/research

Install

Overview

Description from the maker (original English)

Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi3 of 3 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs in the cloud
Transport: Streamable HTTP
Category: Search & AI memory

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 3 of 3 passed
Runs on the maker’s server: what you ask it goes through their server.
Can do 8 things (tools) list_threats, get_threat, list_research_articles, get_article …
The registry lists no key to fill in.

You need

Runs in the cloudNothing to install; it connects over the internet

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

Open Settings → Connectors
Press Add custom connector
Paste the address below and press Add
If it asks you to sign in, sign in with the maker

https://ohey.ca/mcp/research

Run this in your terminal

claude mcp add --transport http research https://ohey.ca/mcp/research

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "research": {
      "url": "https://ohey.ca/mcp/research"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "research": {
      "type": "http",
      "url": "https://ohey.ca/mcp/research"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

Open ChatGPT on the web → Settings → Connectors (Apps)
Press Create or Add (some plans need Developer mode under Advanced first)
Paste the address below, give it a name and save
If it asks you to sign in, sign in with the maker

https://ohey.ca/mcp/research

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Tool names and descriptions exactly as the server reported them on Nov 6, 2026. The maker wrote them, not us; we show them as plain text.

list_threats
Every technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits with names and site counts in one call.
get_threat
A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and core versions, kits seen together on the same sites, its EtherHiding contracts, the hosts its ClickFix commands fetch f
list_research_articles
Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facts and indicators.
get_article
One research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defanged as published. Read the page at url for the full write-up.
search_etherhiding_contracts
Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when Ohey last read each one. firstSeen is the day Ohey first read the contract, not when it was deployed; many contracts sha
get_etherhiding_contract
One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as an array, one entry per chain the address is tracked on (usually one), each with history: its 20 most recent changes, and historyCapped is t
get_feed_stats
The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed as legitimate services and kept out. week.added (and daily): hosts that entered the feed. week.entered: website tips that
search_clickfix_commands
Hosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kits credited with each (a ClickFix kit is credited when it is on at least half the sites whose command used the host), sites whose captured c

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified against the domain ohey.ca (the registry checks domain ownership)
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
✓ Pass
Endpoint responds
Responded in 590 ms (HTTP 200)
– Not applicable
Sign-in with OAuth
No sign-in needed
✓ Pass
No hidden instructions in tool descriptions
Read 8 tool descriptions and found no hidden instructions to the AI

Compared with others in Search & AI memoryi

More stars than 0% of the other 7258 servers in this category
Published to the registry more recently than 93% of the other 7258 servers in this category
Basic checks equal to or better than 100% of the other 7258 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Ohey research safe?

It passed 3 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.0.0) reached the registry 2 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Context7, Codebase Memory, Exa

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Context7

by upstash

Feeds AI the latest docs for libraries and frameworks before it answers, so code it writes does not use outdated, removed functions.

Computer or cloud★ 64,224MITUpdated today

Install

Codebase Memory

by DeusData

Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.

Runs on your computer★ 48,148MITUpdated 20 days ago

Install

Exa

by exa-labs

Connect AI agents to Exa for web search, content fetching, and multi-step research.

Runs in the cloud★ 5,213MITUpdated last month

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Ohey MCP servers

Ohey scans websites for injected malware: ClickFix and fake update lures, skimmers, phishing kits, EtherHiding loaders, and the C2 and distribution servers behind them. There are two remote MCP servers (Streamable HTTP).

Server	URL	Sign-in
Research	`https://ohey.ca/mcp/research`	None
Feed and API	`https://ohey.ca/mcp`	Ohey account with API access

Install

Both servers are remote Streamable HTTP servers, so there is nothing to download. The examples add the research server; for the feed server, use the name ohey and the URL https://ohey.ca/mcp, and the client opens ohey.ca to sign in the first time.

Both are in the MCP Registry as ca.ohey/research and ca.ohey/ohey.

Claude

Web, desktop and mobile: Settings, Connectors, Add custom connector, then paste the URL.

Claude Code:

claude mcp add --transport http ohey-research https://ohey.ca/mcp/research

ChatGPT

Custom MCP servers need developer mode, which OpenAI offers on some plans and has moved between settings pages; a Business or Enterprise admin may have to allow custom connectors first.

Turn on developer mode in ChatGPT's settings.
Add a custom connector (or app), give it a name and paste the URL.
Set Authentication to No authentication for the research server, or OAuth for the feed server.
In a new chat, turn the connector on from the tools menu.

OpenAI Codex

codex mcp add ohey-research --url https://ohey.ca/mcp/research

For the feed server, add it with --url https://ohey.ca/mcp, then run codex mcp login ohey to sign in. Or in ~/.codex/config.toml:

[mcp_servers.ohey-research]

url = "https://ohey.ca/mcp/research"

Gemini CLI

gemini mcp add --transport http ohey-research https://ohey.ca/mcp/research

Or in settings.json, under mcpServers:

"ohey-research": { "httpUrl": "https://ohey.ca/mcp/research" }

For the feed server, run /mcp auth ohey in the CLI to sign in.

Cursor

In ~/.cursor/mcp.json, or .cursor/mcp.json in a project:

"mcpServers": { "ohey-research": { "url": "https://ohey.ca/mcp/research" } } }

VS Code (GitHub Copilot)

code --add-mcp '{"name":"ohey-research","type":"http","url":"https://ohey.ca/mcp/research"}'

Or run MCP: Add Server, choose HTTP and paste the URL. The JSON form, in .vscode/mcp.json or your user mcp.json:

"servers": { "ohey-research": { "type": "http", "url": "https://ohey.ca/mcp/research" } } }

Other clients

Any client that supports remote MCP servers over Streamable HTTP takes the URL as is. Most read an mcpServers object with a url (some call the field serverUrl or httpUrl). A client that only runs local stdio servers can reach either one through mcp-remote:

"mcpServers": { "ohey-research": { "command": "npx", "args": ["-y", "mcp-remote", "https://ohey.ca/mcp/research"] } } }

Research server

The research Ohey publishes on ohey.ca/threats and ohey.ca/research, as tools. Anyone can connect, with no sign-in.

Tool	What it does
`list_threats`	Every technique, with its page, a summary, site counts and its kits.
`get_threat`	A technique or kit: sites matched by month, how many were still infected when rescanned, WordPress and Joomla shares, common plugins, kits seen on the same sites, its EtherHiding contracts, its ClickFix command hosts and articles.
`list_research_articles`	Research articles, newest first.
`get_article`	One article's summary, key facts (hashes, active window, scale) and its indicators of compromise, as Markdown.
`search_clickfix_commands`	Hosts that ClickFix lure commands fetch from, by kit or host, with the latest command for each, defanged.
`search_etherhiding_contracts`	Contracts that compromised sites read their next stage from, by kit, chain or destination host.
`get_etherhiding_contract`	One contract's destinations over time.
`get_feed_stats`	Feed size, last week's additions and removals, and the capture archive.

Counts update daily from Ohey's scans. Both search tools take offset to page past limit, and sort: "firstSeen" for the newest first. A host search that finds nothing returns a coverage note: the trackers list only contract destinations and command hosts, so a miss means "not tracked", not "clean". Checking any host against the full feed is the feed server's job.

Hosts and commands are live malware infrastructure. They come defanged ([.], hxxp), and results that carry commands include a notice for the person reading. Refang or run them only in an isolated research environment. See the terms.

Feed and API server

Ohey's API as tools: look up any host, search the feed, read CVEs and scan URLs. You sign in with your Ohey account, so there is no API key to copy. Ask for an account with API access at ohey.ca/contact.

Connect it the same way as the research server, with https://ohey.ca/mcp as the URL (Install). Signing in opens ohey.ca; approve the connection there and the client gets access. Clients register themselves from the server's OAuth metadata, so there is no client ID to set.

Tools

Tool	What it does
`search_indicators`	Hosts in the feed, filtered by tag or family, with roles, families, tags and the reason each was admitted.
`get_host`	A host's feed entry, vulnerable software from its latest capture, its captures summary and DNS records.
`get_host_captures`	Each time the scanner loaded the host: when, what it returned and what matched.
`list_delisted`	Hosts that review excluded or took out of the feed, with the reason and who decided.
`get_vulnerability`	One CVE with its NVD, EPSS, KEV, GitHub and OSV data.
`list_vulnerabilities`	Published CVEs in order, or only WordPress plugin, theme and core CVEs.
`start_scan`	Loads a URL in Ohey's scanner and records what it finds.
`get_scan`	The scan result: whether the page is malicious, what matched, commands and clipboard writes it tried to plant, and suspected C2.

The scan tools appear only when you tick "Scan URLs" while approving. Scans count against your account.

Access and revoking it

Approving a client creates an API key named after it, under Account in the Ohey portal. Tool calls are rate limited and counted against that key like any API request. Revoke the key to disconnect the client.

The full API, with every response field, is documented at ohey.ca/docs.

Security

Report security issues to hey@ohey.ca. See security.txt.

Ohey research

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Search & AI memoryi

Common questions

Alternatives

Context7

Codebase Memory

Exa

README from the maker

Ohey MCP servers

Install

Claude

ChatGPT

OpenAI Codex

Gemini CLI

Cursor

VS Code (GitHub Copilot)

Other clients

Research server

Feed and API server

Tools

Access and revoking it

Security