isMalicious threat intelligence for AI agents

@ismalicious/mcp-server

A zero-dependency Model Context Protocol server that gives an AI agent isMalicious threat intelligence: reputation verdicts for IP addresses, domains, URLs, file hashes, email addresses and phone numbers, the CVE catalog, the isinjected gate that scans untrusted content for prompt injection before the agent acts on it, and a scanner that reads one whole email message for phishing and malware.

Install

{

"mcpServers": { "ismalicious": { "command": "npx", "args": ["-y", "@ismalicious/mcp-server"], "env": { "ISMALICIOUS_API_KEY": "your-api-key", "ISMALICIOUS_API_SECRET": "your-api-secret" } } } }

Keys: https://ismalicious.com/app/account. Free keys exist. Without the two variables the server still starts, offering only bootstrap_key, which mints a free key from an email address and uses it for the session (see below).

Registry name: com.ismalicious/mcp-server (https://registry.modelcontextprotocol.io/v0/servers?search=ismalicious).

Remote (Streamable HTTP)

The same server runs at https://api.ismalicious.com/mcp, for clients that connect to a URL instead of starting a process. Send the key pair with every request:

Authorization: Bearer <apiKey>:<apiSecret>

The base64 of : , or an X-API-KEY header carrying it, works too. Claude Code:

claude mcp add --transport http ismalicious https://api.ismalicious.com/mcp \

--header "Authorization: Bearer : "

Clients that take a JSON entry (Cursor and others):

{

"mcpServers": { "ismalicious": { "url": "https://api.ismalicious.com/mcp", "headers": { "Authorization": "Bearer : " } } } }

What differs from the local server:

• No `check_password_exposure`. Its promise is that the password never leaves your machine; over HTTP it would reach ours whole. Run the local server for it.
• No `bootstrap_key`. Get a free key at https://ismalicious.com/app/account.
• Listing needs no key, calling does. Without a key, initialize, tools/list and ping answer (so directory crawlers see the tools) and any tool call gets 401. A key that is sent is checked against GET /gate/quota, which bills nothing, and a refused one gets 401 on any request; an accepted one is not checked again for 5 minutes.
• Stateless. Each POST carries one JSON-RPC message (or a batch of up to 10, run in order, with at most one tools/call), answered as application/json; no session, no SSE stream (GET answers 405). A request needs a string or number id: without one only notifications/* are handled, and anything else is dropped unanswered. Without a key, a body is limited to 64 KiB. A notifications/cancelled arrives in another request and cancels nothing; closing the connection cancels the call it carries. The ismalicious://quota resource reports the scan meter, never the request headers of earlier calls.
• Deadlines. check_indicators stops at 50 s instead of 60 s, under the edge's own timeout; the others keep theirs. A call the client stopped waiting for is still billed, so give the client at least 60 s per call (OpenSRE's MCP gateway: timeout_seconds of 90, since its 30 s default covers a listing session and a calling session together).
• Billing is the same. Each tool call costs what it costs locally, and the result cache (see Latency) is shared across your requests for the same key, so a repeat within its lifetime is still free. The environment variables below do not apply.

Every lookup tool is read-only (readOnlyHint: true). For a gateway that only lets certified read-only tools run without confirmation, such as OpenSRE's MCP gateway, nine remote tools qualify: scan_before_use, check_url, check_indicator, get_cve, recent_cves, search_indicators, check_indicators, scan_email, exploited_cves. The three vulnerability-monitoring tools added in 0.8.0 change the account and say so (readOnlyHint: false, destructiveHint: false): watch_domain and watch_dependencies start watching a source (idempotentHint: true: adding it again returns the one already watched), ack_finding sets a finding's status.

To serve it yourself, @ismalicious/mcp-server/streamable-http exports handleStreamableHttp(request, options) on web-standard Request and Response.

Tools

| scan_email | Scan one email message for phishing and malware: raw eml or parsed message. verdict (malicious/suspicious/clean/inconclusive), recommendedAction (quarantine/review/warn/deliver), risk 0-100, a headline to relay, the strongest reasons, coverage.skipped. malicious needs a listing in the dataset; clean needs your own system's DMARC pass and a sender domain the dataset knows as established; deliver