原型 · 预览版：收录官方注册中心里的全部服务器，每 30 分钟同步一次。评价和账户功能将在后续阶段推出。
PopNx MCP为使用 AI 的人准备的 MCP 服务器 · 用大白话讲清楚
新手模式 开
配色跟随系统浅色深色
语言ไทยEnglish中文日本語한국어EspañolDeutsch
☰ 菜单设置
新手模式 开
配色跟随系统浅色深色
语言ไทยEnglish中文日本語한국어EspañolDeutsch

Ohey research

作者：Oheyresearch版本 1.0.0i★ –i在云端运行
注册名称ca.ohey/research

安装

概览

作者提供的说明（英文原文）

Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

  • 连接方式: 在云端运行
  • 传输方式: Streamable HTTP
  • 分类: 搜索与 AI 记忆

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

你需要

你用的是哪个应用？

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

适用于网页版、桌面版和手机版 Claude：

  1. 打开 Settings → Connectors
  2. 点击 Add custom connector
  3. 粘贴下面的地址，然后点击 Add
  4. 如果要求登录，请登录作者的服务
SettingsConnectors1+ Add2https://…3
https://ohey.ca/mcp/research

在终端中运行这条命令

claude mcp add --transport http research https://ohey.ca/mcp/research

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "research": {
      "url": "https://ohey.ca/mcp/research"
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "research": {
      "type": "http",
      "url": "https://ohey.ca/mcp/research"
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

ChatGPT 只能连接互联网上的服务器：

  1. 打开网页版 ChatGPT → Settings → Connectors (Apps)
  2. 点击 Create 或 Add（部分套餐需要先在 Advanced 中开启 Developer mode）
  3. 粘贴下面的地址，起个名字，然后保存
  4. 如果要求登录，请登录作者的服务
SettingsConnectors1+ Create2https://…3
https://ohey.ca/mcp/research

菜单名称可能因套餐和版本不同而略有差异。

你的选择通过 Cookie 保存在这台设备上，无需账户。

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

工具名称和描述与服务器在 2026年11月6日 报告的完全一致。这些内容由作者撰写，不是我们写的；我们以纯文本形式显示。

  • list_threats

    Every technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits with names and site counts in one call.

  • get_threat

    A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and core versions, kits seen together on the same sites, its EtherHiding contracts, the hosts its ClickFix commands fetch f

  • list_research_articles

    Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facts and indicators.

  • get_article

    One research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defanged as published. Read the page at url for the full write-up.

  • search_etherhiding_contracts

    Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when Ohey last read each one. firstSeen is the day Ohey first read the contract, not when it was deployed; many contracts sha

  • get_etherhiding_contract

    One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as an array, one entry per chain the address is tracked on (usually one), each with history: its 20 most recent changes, and historyCapped is t

  • get_feed_stats

    The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed as legitimate services and kept out. week.added (and daily): hosts that entered the feed. week.entered: website tips that

  • search_clickfix_commands

    Hosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kits credited with each (a ClickFix kit is credited when it is on at least half the sites whose command used the host), sites whose captured c

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月7日

  • ✓ 通过

    作者与仓库一致

    注册名称已通过域名 ohey.ca 验证（注册中心会核实域名所有权）

  • … 尚未检查

    仍在维护

    我们还没有从 GitHub 读取这个仓库

  • … 尚未检查

    有许可证

    我们还没有从 GitHub 读取这个仓库

  • ✓ 通过

    端点有响应

    在 590 毫秒内响应（HTTP 200）

  • – 不适用

    使用 OAuth 登录

    无需登录

  • ✓ 通过

    工具描述中没有隐藏指令

    已读取 8 个工具描述，未发现针对 AI 的隐藏指令

与“搜索与 AI 记忆”中的其他服务器比较i

  • 星标数多于此分类中其他 7258 个服务器的 0%
  • 发布到注册中心的时间比此分类中其他 7258 个服务器的 93% 更新
  • 基础检查结果等于或优于此分类中其他 7258 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

Ohey research 安全吗？

它在 3 项适用的基础检查中通过了 3 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

注册中心没有列出必需的密钥，不过有些服务器会在首次使用时要求你登录。

它在我的电脑上运行还是在云端？

它在作者的云端运行。通过互联网连接，无需安装，但你发送的内容会经过作者的服务器。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（1.0.0）于前天进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。它通过 URL 连接，所以接受远程 MCP 服务器的应用也可以使用，例如开启开发者模式的 ChatGPT。

有什么可以替代它？

同一分类中有：Context7, Codebase Memory, Exa

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

Context7

作者：upstash

Up-to-date docs for AI agents

电脑或云端★ 64,224MIT今天更新
安装

Codebase Memory

作者：DeusData

Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.

在你的电脑上运行★ 48,148MIT20天前更新
安装

Exa

作者：exa-labs

Connect AI agents to Exa for web search, content fetching, and multi-step research.

在云端运行★ 5,213MIT上个月更新
安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

Ohey MCP servers

Ohey scans websites for injected malware: ClickFix and fake update lures, skimmers, phishing kits, EtherHiding loaders, and the C2 and distribution servers behind them. There are two remote MCP servers (Streamable HTTP).

ServerURLSign-in
Researchhttps://ohey.ca/mcp/researchNone
Feed and APIhttps://ohey.ca/mcpOhey account with API access

Install

Both servers are remote Streamable HTTP servers, so there is nothing to download. The examples add the research server; for the feed server, use the name ohey and the URL https://ohey.ca/mcp, and the client opens ohey.ca to sign in the first time.

Both are in the MCP Registry as ca.ohey/research and ca.ohey/ohey.

Claude

Web, desktop and mobile: Settings, Connectors, Add custom connector, then paste the URL.

Claude Code:

claude mcp add --transport http ohey-research https://ohey.ca/mcp/research
ChatGPT

Custom MCP servers need developer mode, which OpenAI offers on some plans and has moved between settings pages; a Business or Enterprise admin may have to allow custom connectors first.

  1. Turn on developer mode in ChatGPT's settings.
  2. Add a custom connector (or app), give it a name and paste the URL.
  3. Set Authentication to No authentication for the research server, or OAuth for the feed server.
  4. In a new chat, turn the connector on from the tools menu.
OpenAI Codex
codex mcp add ohey-research --url https://ohey.ca/mcp/research

For the feed server, add it with --url https://ohey.ca/mcp, then run codex mcp login ohey to sign in. Or in ~/.codex/config.toml:

[mcp_servers.ohey-research]

url = "https://ohey.ca/mcp/research"

Gemini CLI
gemini mcp add --transport http ohey-research https://ohey.ca/mcp/research

Or in settings.json, under mcpServers:

"ohey-research": { "httpUrl": "https://ohey.ca/mcp/research" }

For the feed server, run /mcp auth ohey in the CLI to sign in.

Cursor

In ~/.cursor/mcp.json, or .cursor/mcp.json in a project:

{

"mcpServers": { "ohey-research": { "url": "https://ohey.ca/mcp/research" } } }

VS Code (GitHub Copilot)
code --add-mcp '{"name":"ohey-research","type":"http","url":"https://ohey.ca/mcp/research"}'

Or run MCP: Add Server, choose HTTP and paste the URL. The JSON form, in .vscode/mcp.json or your user mcp.json:

{

"servers": { "ohey-research": { "type": "http", "url": "https://ohey.ca/mcp/research" } } }

Other clients

Any client that supports remote MCP servers over Streamable HTTP takes the URL as is. Most read an mcpServers object with a url (some call the field serverUrl or httpUrl). A client that only runs local stdio servers can reach either one through mcp-remote:

{

"mcpServers": { "ohey-research": { "command": "npx", "args": ["-y", "mcp-remote", "https://ohey.ca/mcp/research"] } } }

Research server

The research Ohey publishes on ohey.ca/threats and ohey.ca/research, as tools. Anyone can connect, with no sign-in.

ToolWhat it does
list_threatsEvery technique, with its page, a summary, site counts and its kits.
get_threatA technique or kit: sites matched by month, how many were still infected when rescanned, WordPress and Joomla shares, common plugins, kits seen on the same sites, its EtherHiding contracts, its ClickFix command hosts and articles.
list_research_articlesResearch articles, newest first.
get_articleOne article's summary, key facts (hashes, active window, scale) and its indicators of compromise, as Markdown.
search_clickfix_commandsHosts that ClickFix lure commands fetch from, by kit or host, with the latest command for each, defanged.
search_etherhiding_contractsContracts that compromised sites read their next stage from, by kit, chain or destination host.
get_etherhiding_contractOne contract's destinations over time.
get_feed_statsFeed size, last week's additions and removals, and the capture archive.

Counts update daily from Ohey's scans. Both search tools take offset to page past limit, and sort: "firstSeen" for the newest first. A host search that finds nothing returns a coverage note: the trackers list only contract destinations and command hosts, so a miss means "not tracked", not "clean". Checking any host against the full feed is the feed server's job.

Hosts and commands are live malware infrastructure. They come defanged ([.], hxxp), and results that carry commands include a notice for the person reading. Refang or run them only in an isolated research environment. See the terms.

Feed and API server

Ohey's API as tools: look up any host, search the feed, read CVEs and scan URLs. You sign in with your Ohey account, so there is no API key to copy. Ask for an account with API access at ohey.ca/contact.

Connect it the same way as the research server, with https://ohey.ca/mcp as the URL (Install). Signing in opens ohey.ca; approve the connection there and the client gets access. Clients register themselves from the server's OAuth metadata, so there is no client ID to set.

Tools
ToolWhat it does
search_indicatorsHosts in the feed, filtered by tag or family, with roles, families, tags and the reason each was admitted.
get_hostA host's feed entry, vulnerable software from its latest capture, its captures summary and DNS records.
get_host_capturesEach time the scanner loaded the host: when, what it returned and what matched.
list_delistedHosts that review excluded or took out of the feed, with the reason and who decided.
get_vulnerabilityOne CVE with its NVD, EPSS, KEV, GitHub and OSV data.
list_vulnerabilitiesPublished CVEs in order, or only WordPress plugin, theme and core CVEs.
start_scanLoads a URL in Ohey's scanner and records what it finds.
get_scanThe scan result: whether the page is malicious, what matched, commands and clipboard writes it tried to plant, and suspected C2.

The scan tools appear only when you tick "Scan URLs" while approving. Scans count against your account.

Access and revoking it

Approving a client creates an API key named after it, under Account in the Ohey portal. Tool calls are rate limited and counted against that key like any API request. Revoke the key to disconnect the client.

The full API, with every response field, is documented at ohey.ca/docs.

Security

Report security issues to hey@ohey.ca. See security.txt.

问 PopNx