Context7
Up-to-date docs for AI agents
Descripción del creador (original en inglés)
Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.
Estos tres nunca se combinan en una sola puntuación: las opiniones, las mediciones y la popularidad son cosas distintas.
Todavía no escribimos un resumen sencillo para este. Abajo están los datos que leímos del registro.
Elige la app de IA que usas y copia la configuración.
Necesitas
¿Qué app usas?
Elige tu app arriba. La recordamos, así que la próxima vez el botón dirá “Instalar en …”.
Funciona en Claude para web, escritorio y móvil:
https://ohey.ca/mcp/researchEjecuta esto en tu terminal
claude mcp add --transport http research https://ohey.ca/mcp/researchPégalo en .cursor/mcp.json de tu proyecto, o en ~/.cursor/mcp.json
{
"mcpServers": {
"research": {
"url": "https://ohey.ca/mcp/research"
}
}
}Tu navegador te pide permiso para abrir la app; luego la app muestra la configuración y te pide confirmar. Los valores de las claves quedan vacíos para que los completes tú.
Pégalo en .vscode/mcp.json de tu proyecto
{
"servers": {
"research": {
"type": "http",
"url": "https://ohey.ca/mcp/research"
}
}
}Tu navegador te pide permiso para abrir la app; luego la app muestra la configuración y te pide confirmar. Los valores de las claves quedan vacíos para que los completes tú.
ChatGPT solo se conecta a servidores en internet:
https://ohey.ca/mcp/researchLos nombres de los menús pueden variar un poco según el plan y con el tiempo.
Tu elección se guarda en una cookie en este dispositivo; no necesitas cuenta.
Esta configuración se genera a partir de la ficha del creador en el registro. Si el README dice otra cosa, sigue el README.
Nombres y descripciones de las herramientas tal como los informó el servidor el 6 nov 2026. Los escribió el creador, no nosotros; los mostramos como texto sin formato.
list_threatsEvery technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits with names and site counts in one call.
get_threatA technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and core versions, kits seen together on the same sites, its EtherHiding contracts, the hosts its ClickFix commands fetch f
list_research_articlesOhey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facts and indicators.
get_articleOne research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defanged as published. Read the page at url for the full write-up.
search_etherhiding_contractsSmart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when Ohey last read each one. firstSeen is the day Ohey first read the contract, not when it was deployed; many contracts sha
get_etherhiding_contractOne contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as an array, one entry per chain the address is tracked on (usually one), each with history: its 20 most recent changes, and historyCapped is t
get_feed_statsThe size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed as legitimate services and kept out. week.added (and daily): hosts that entered the feed. week.entered: website tips that
search_clickfix_commandsHosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kits credited with each (a ClickFix kit is credited when it is on at least half the sites whose command used the host), sites whose captured c
Revisamos información que cualquiera puede ver; no hemos leído el código. Las revisiones que no aplican no se cuentan. · Revisado el 7 nov 2026
El nombre en el registro se verificó con el dominio ohey.ca (el registro comprueba quién es dueño del dominio)
Todavía no hemos leído este repo en GitHub
Todavía no hemos leído este repo en GitHub
Respondió en 590 ms (HTTP 200)
No hace falta iniciar sesión
Leímos 8 descripciones de herramientas y no encontramos instrucciones ocultas para la IA
Comparado con todos los servidores activos de esta categoría en el registro. Las estrellas solo cuentan cuando quien lo publica es dueño del repo.
Superó 3 de 3 revisiones básicas aplicables. No hemos leído el código. Antes de agregar una clave o un token, revisa qué acceso pide el servidor y usa una clave que tenga solo los permisos que necesitas.
El registro no indica ninguna clave obligatoria, aunque algunos servidores te piden iniciar sesión la primera vez que los usas.
Se ejecuta en la nube del creador. Te conectas por internet sin instalar nada, pero lo que envías pasa por los servidores del creador.
El repo de GitHub cambió por última vez –, y la última versión (1.0.0) llegó al registro anteayer.
Las apps compatibles con MCP, como Claude Desktop, Claude Code, Cursor y VS Code. Se conecta por URL, así que también funcionan las apps que aceptan servidores MCP remotos, como ChatGPT en modo desarrollador.
En la misma categoría: Context7, Codebase Memory, Exa
Servidores de la misma categoría hechos por otros creadores, ordenados por estrellas.
Cómo leer una tarjeta:★ Estrellas de GitHubiTres pilares: reseñas · revisiones · usoiActualizado = fecha en que se publicó la última versión en el registroi
Up-to-date docs for AI agents
Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.
Connect AI agents to Exa for web search, content fetching, and multi-step research.
Copiado tal cual del repo del creador. PopNx MCP no lo ha revisado ni lo respalda. Se quitaron HTML, imágenes y scripts. Los enlaces llevan fuera de este sitio.
Ohey scans websites for injected malware: ClickFix and fake update lures, skimmers, phishing kits, EtherHiding loaders, and the C2 and distribution servers behind them. There are two remote MCP servers (Streamable HTTP).
| Server | URL | Sign-in |
|---|---|---|
| Research | https://ohey.ca/mcp/research | None |
| Feed and API | https://ohey.ca/mcp | Ohey account with API access |
Both servers are remote Streamable HTTP servers, so there is nothing to download. The examples add the research server; for the feed server, use the name ohey and the URL https://ohey.ca/mcp, and the client opens ohey.ca to sign in the first time.
Both are in the MCP Registry as ca.ohey/research and ca.ohey/ohey.
Web, desktop and mobile: Settings, Connectors, Add custom connector, then paste the URL.
Claude Code:
claude mcp add --transport http ohey-research https://ohey.ca/mcp/research
Custom MCP servers need developer mode, which OpenAI offers on some plans and has moved between settings pages; a Business or Enterprise admin may have to allow custom connectors first.
codex mcp add ohey-research --url https://ohey.ca/mcp/research
For the feed server, add it with --url https://ohey.ca/mcp, then run codex mcp login ohey to sign in. Or in ~/.codex/config.toml:
[mcp_servers.ohey-research]
url = "https://ohey.ca/mcp/research"
gemini mcp add --transport http ohey-research https://ohey.ca/mcp/research
Or in settings.json, under mcpServers:
"ohey-research": { "httpUrl": "https://ohey.ca/mcp/research" }
For the feed server, run /mcp auth ohey in the CLI to sign in.
In ~/.cursor/mcp.json, or .cursor/mcp.json in a project:
{
"mcpServers": { "ohey-research": { "url": "https://ohey.ca/mcp/research" } } }
code --add-mcp '{"name":"ohey-research","type":"http","url":"https://ohey.ca/mcp/research"}'
Or run MCP: Add Server, choose HTTP and paste the URL. The JSON form, in .vscode/mcp.json or your user mcp.json:
{
"servers": { "ohey-research": { "type": "http", "url": "https://ohey.ca/mcp/research" } } }
Any client that supports remote MCP servers over Streamable HTTP takes the URL as is. Most read an mcpServers object with a url (some call the field serverUrl or httpUrl). A client that only runs local stdio servers can reach either one through mcp-remote:
{
"mcpServers": { "ohey-research": { "command": "npx", "args": ["-y", "mcp-remote", "https://ohey.ca/mcp/research"] } } }
The research Ohey publishes on ohey.ca/threats and ohey.ca/research, as tools. Anyone can connect, with no sign-in.
| Tool | What it does |
|---|---|
list_threats | Every technique, with its page, a summary, site counts and its kits. |
get_threat | A technique or kit: sites matched by month, how many were still infected when rescanned, WordPress and Joomla shares, common plugins, kits seen on the same sites, its EtherHiding contracts, its ClickFix command hosts and articles. |
list_research_articles | Research articles, newest first. |
get_article | One article's summary, key facts (hashes, active window, scale) and its indicators of compromise, as Markdown. |
search_clickfix_commands | Hosts that ClickFix lure commands fetch from, by kit or host, with the latest command for each, defanged. |
search_etherhiding_contracts | Contracts that compromised sites read their next stage from, by kit, chain or destination host. |
get_etherhiding_contract | One contract's destinations over time. |
get_feed_stats | Feed size, last week's additions and removals, and the capture archive. |
Counts update daily from Ohey's scans. Both search tools take offset to page past limit, and sort: "firstSeen" for the newest first. A host search that finds nothing returns a coverage note: the trackers list only contract destinations and command hosts, so a miss means "not tracked", not "clean". Checking any host against the full feed is the feed server's job.
Hosts and commands are live malware infrastructure. They come defanged ([.], hxxp), and results that carry commands include a notice for the person reading. Refang or run them only in an isolated research environment. See the terms.
Ohey's API as tools: look up any host, search the feed, read CVEs and scan URLs. You sign in with your Ohey account, so there is no API key to copy. Ask for an account with API access at ohey.ca/contact.
Connect it the same way as the research server, with https://ohey.ca/mcp as the URL (Install). Signing in opens ohey.ca; approve the connection there and the client gets access. Clients register themselves from the server's OAuth metadata, so there is no client ID to set.
| Tool | What it does |
|---|---|
search_indicators | Hosts in the feed, filtered by tag or family, with roles, families, tags and the reason each was admitted. |
get_host | A host's feed entry, vulnerable software from its latest capture, its captures summary and DNS records. |
get_host_captures | Each time the scanner loaded the host: when, what it returned and what matched. |
list_delisted | Hosts that review excluded or took out of the feed, with the reason and who decided. |
get_vulnerability | One CVE with its NVD, EPSS, KEV, GitHub and OSV data. |
list_vulnerabilities | Published CVEs in order, or only WordPress plugin, theme and core CVEs. |
start_scan | Loads a URL in Ohey's scanner and records what it finds. |
get_scan | The scan result: whether the page is malicious, what matched, commands and clipboard writes it tried to plant, and suspected C2. |
The scan tools appear only when you tick "Scan URLs" while approving. Scans count against your account.
Approving a client creates an API key named after it, under Account in the Ohey portal. Tool calls are rate limited and counted against that key like any API request. Revoke the key to disconnect the client.
The full API, with every response field, is documented at ohey.ca/docs.
Report security issues to hey@ohey.ca. See security.txt.