MCP.Market

ScanMalware.com URL Scanner MCP server

online · 96% uptime
by mcp.scanmalware.com·com.scanmalware.mcp/scanmalware-mcp·v0.1.6
No reviews yet

MCP server for ScanMalware.com URL scanning, malware detection, and analysis.

A88/100grade A
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
A88/100

full report

Adoption
Growing

0 stars

Reviews

Write one

Nobody has reviewed ScanMalware.com URL Scanner yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

ScanMalware.com URL Scanner tools (128, 3 write)

write = sends, deletes, buys or posts
  • find_js_fingerprint_similar_by_hashFree

    Find similar JS fingerprints by hash.

  • get_ai_analysisFree

    Get AI analysis for a scan_id (if available).

  • get_analyzer_resultsFree

    Get analyzer results for a scan_id.

  • get_analyzer_statsFree

    Get analyzer statistics overview.

  • get_api_rootFree

    Get API root metadata.

  • get_bot_protectionFree

    Get bot-protection detection for a scan_id.

  • get_capabilities_by_dateFree

    Get capability stats by date.

  • get_clipboard_eventsFree

    Get clipboard events for a scan_id.

  • get_clipboard_statsFree

    Get clipboard statistics.

  • get_cpe_by_scanFree

    Get CPEs for a scan_id.

  • get_cpe_statsFree

    Get CPE statistics.

  • get_ct_certificatesFree

    Get certificate transparency data for a domain.

  • get_ct_dns_recordsFree

    Get CT DNS records for a domain.

  • get_ct_domains_by_ipFree

    Find CT domains on an IP address.

  • get_ct_similar_domainsFree

    Find similar CT domains for a domain.

  • get_ct_timelineFree

    Get CT certificate timeline for a domain.

  • get_domain_historyFree

    Get historical scans for a domain (paginated).

  • get_domain_scansFree

    Get recent scans for a domain.

  • get_domain_statsFree

    Get summary statistics for a domain.

  • get_faviconFree

    Get the favicon for a scan_id: size, hashes, and the image itself base64-encoded. Use the md5 with search_by_favicon to pivot.

  • get_favicon_statsFree

    Get favicon statistics.

  • get_healthFree

    Get API health status.

  • get_ids_alertsFree

    Get IDS alerts for a scan_id.

  • get_ip_statsFree

    Get IP statistics (paginated).

  • get_jarm_signaturesFree

    Get JARM signatures for a scan_id.

  • get_jarm_statsFree

    Get JARM statistics.

  • get_js_fingerprinter2Free

    Get JS Fingerprinter2 results for a scan_id.

  • get_js_fingerprinter2_coverageFree

    Get JS Fingerprinter2 fingerprint coverage.

  • get_js_fingerprinter2_healthFree

    Get JS Fingerprinter2 health check.

  • get_js_fingerprinter2_statsFree

    Get JS Fingerprinter2 stats.

  • get_js_fingerprintsFree

    Get JavaScript fingerprints for a scan_id.

  • get_js_library_inventoryFree

    Get JS fingerprint library inventory.

  • get_js_segments_by_scanFree

    Get JS segments for a scan_id.

  • get_js_segments_suspiciousFree

    Get suspicious JS segments for a scan_id.

  • get_js_segments_unknownFree

    Get unknown JS segments for a scan_id.

  • get_jsfingerprintFree

    Get JS fingerprint by ID.

  • get_jsfingerprint_bundle_statsFree

    Get JS fingerprint bundle statistics.

  • get_jsfingerprint_hash_prevalenceFree

    Get JS fingerprint hash prevalence for a scan_id.

  • get_jsfingerprint_library_statsFree

    Get JS fingerprint library statistics.

  • get_jsfingerprint_similarFree

    Find similar JS fingerprints.

  • get_jsfingerprint_similarity_countsFree

    Get JS fingerprint similarity counts.

  • get_jsfingerprint_sourceFree

    Get JS fingerprint source.

  • get_latest_capabilitiesFree

    Get latest capability stats.

  • get_malware_by_scanFree

    Get malware details for a scan_id.

  • get_malware_statsFree

    Get malware stats.

  • get_netlogFree

    Describe the network log (Chrome NetLog) for a scan_id: whether one exists, its size, and its encoding. The log itself is not returned - these are routinely tens of megabytes gzipped.

  • get_ocr_by_scanFree

    Get OCR data for a scan_id.

  • get_ocr_statsFree

    Get OCR stats.

  • get_open_graphFree

    Get Open Graph data for a scan_id.

  • get_pastejackingFree

    Get pastejacking findings for a scan_id.

  • get_pcap_metadataFree

    Get PCAP metadata for a scan_id.

  • get_platform_statsFree

    Get platform statistics.

  • get_popular_technologiesFree

    Get popular technologies (paginated).

  • get_rdapFree

    Get RDAP details for a scan_id.

  • get_recent_scansFree

    Get recent public scans (paginated).

  • get_recent_threatsFree

    Get recent malware threats.

  • get_recent_yara_threatsFree

    Get recent YARA threats.

  • get_safe_browsingFree

    Get safe browsing threats for a scan_id.

  • get_safe_browsing_statsFree

    Get safe browsing stats.

  • get_scan_iocFree

    Get IOC matches for a scan_id.

  • get_scan_progressFree

    Get scan progress by scan_id.

  • get_scan_reportsFree

    Get available reports for a scan_id.

  • get_scan_resultFree

    Get full scan result by scan_id.

  • get_scan_summaryFree

    Get compact scan summary by scan_id.

  • get_screenshot_statsFree

    Get screenshot statistics.

  • get_technologies_by_scanFree

    Get detected technologies for a scan_id.

  • get_technology_combinationsFree

    Get technology combinations (paginated).

  • get_technology_statsFree

    Get technology stats.

  • get_tls_asn1Free

    Get TLS certificate ASN.1 data for a scan_id.

  • get_tls_detailsFree

    Get TLS details for a scan_id.

  • get_top_tracking_keysFree

    Get top tracking keys.

  • get_yara_by_scanFree

    Get YARA results for a scan_id.

  • get_yara_matchesFree

    Get YARA matches for a scan_id.

  • get_yara_statsFree

    Get YARA stats.

  • run_js_differential_analysiswrite actionFree

    Run JS differential analysis for a scan_id.

  • search_ai_classificationFree

    Search AI scans by classification.

  • search_ai_high_riskFree

    Search AI high-risk scans.

  • search_ai_scam_typeFree

    Search AI scans by scam type.

  • search_analyzer_high_riskFree

    Search analyzer high-risk scans (paginated).

  • search_by_asnFree

    Search scans by ASN (paginated).

  • search_by_faviconFree

    Search scans by favicon hash (paginated).

  • search_by_fuzzy_hashFree

    Search scans by fuzzy hash (paginated).

  • search_by_ipFree

    Search scans by IP address (paginated).

  • search_by_jarmFree

    Search scans by JARM signature (paginated).

  • search_by_nameserverFree

    Search scans by nameserver.

  • search_by_registrarFree

    Search scans by registrar (paginated).

  • search_by_screenshot_hashFree

    Search scans by screenshot hash (paginated).

  • search_cpeFree

    Search CPEs by pattern (paginated).

  • search_favicon_mmh3Free

    Search favicon by mmh3 hash (paginated).

  • search_js_fingerprint_by_bundlerFree

    Search JS fingerprints by bundler type.

  • search_js_fingerprint_by_cdnFree

    Search JS fingerprints by CDN.

  • search_js_fingerprint_by_fuzzy_hashFree

    Search JS fingerprints by fuzzy hash.

  • search_js_fingerprint_by_libraryFree

    Search JS fingerprints by library name.

  • search_js_fingerprint_by_library_versionFree

    Search JS fingerprints by library version.

  • search_js_fingerprint_by_md5Free

    Search JS fingerprints by MD5 hash.

  • search_js_fingerprint_by_normalized_hashFree

    Search JS fingerprints by normalized hash.

  • search_js_fingerprint_by_serverFree

    Search JS fingerprints by server type.

  • search_js_fingerprint_by_sha1Free

    Search JS fingerprints by SHA1 hash.

  • search_js_fingerprint_by_sha256Free

    Search JS fingerprints by SHA256 hash.

  • search_js_fingerprint_obfuscatedFree

    Search obfuscated JS fingerprints.

  • search_js_fingerprint_patternsFree

    Search JS fingerprints by patterns.

  • search_js_fingerprinter2_composite_hashFree

    Search JS Fingerprinter2 by composite hash.

  • search_js_fingerprinter2_signatureFree

    Search JS Fingerprinter2 by signature.

  • search_js_fingerprinter2_similarFree

    Search JS Fingerprinter2 similar scans.

  • search_js_malware_familiesFree

    Search JS malware families.

  • search_js_obfuscationFree

    Search JS obfuscation signals.

  • search_js_segments_by_hashFree

    Search JS segments by code hash.

  • search_js_segments_by_normalized_hashFree

    Search JS segments by normalized hash.

  • search_jsfingerprints_by_bundlerFree

    Search JS fingerprints by bundler (paginated).

  • search_jsfingerprints_by_fuzzy_hashFree

    Search JS fingerprints by fuzzy hash (paginated).

  • search_jsfingerprints_by_libraryFree

    Search JS fingerprints by library (paginated).

  • search_jsfingerprints_by_library_versionFree

    Search JS fingerprints by library version (paginated).

  • search_jsfingerprints_by_md5Free

    Search JS fingerprints by MD5 (paginated).

  • search_jsfingerprints_by_normalized_hashFree

    Search JS fingerprints by normalized hash (paginated).

  • search_jsfingerprints_by_sha1Free

    Search JS fingerprints by SHA1 (paginated).

  • search_jsfingerprints_by_sha256Free

    Search JS fingerprints by SHA256 (paginated).

  • search_ocrFree

    Search OCR text (paginated).

  • search_ocr_patternFree

    Search OCR by pattern (paginated).

  • search_scansFree

    Search scans (q must be at least 3 characters).

  • search_semanticFree

    Semantic search over scans (paginated).

  • search_similar_scansFree

    Search for scans similar to a scan_id (paginated).

  • search_similar_screenshotsFree

    Search for similar screenshots by hash.

  • search_suspicious_clipboardFree

    Search suspicious clipboard indicators (paginated).

  • search_technologiesFree

    Search technologies (paginated).

  • search_tracking_keyFree

    Search by tracking key (paginated).

  • submit_scanwrite actionFree

    Submit a URL for scanning.

  • submit_scan_reportwrite actionFree

    Submit a scan report.

  • wait_for_scanFree

    Poll until a scan reaches a terminal status, returning the final summary.

Public scan report

scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it

no findings
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 1376ms20/20
  • Tool poisoning128 tool descriptions checked15/15
  • Auth qualityAPI key sent as a header8/15
  • Maintenancelast push 21 days ago15/15
  • Maintainer identityendpoint served from the registry-verified namespace domain8/10
Overall 88/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How ScanMalware.com URL Scanner compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
88/100
higher than 75% of 48,255 servers
Tools
128
the typical server has 7
Tools that change things
2%
typical: 0%. Fewer write tools means less an agent can break
Uptime
96%
of our recent checks; the typical remote server answers 100%
Response time
502 ms
faster than 29% of 30,031 servers

What its tools let an agent do: 125 read · 2 change · 1 run or deploy

Install ScanMalware.com URL Scanner in Claude Code, Cursor or VS Code

claude mcp add --transport http scanmalware-mcp https://mcp.scanmalware.com/mcp
Add to Cursor

What the publisher says

From the ScanMalware.com URL Scanner repository's README, as published. We do not edit it. Read it on GitHub

scanmalware-mcp

Minimal Python MCP server that wraps the public ScanMalware.com API.

Operations

See docs/OPERATIONS.md for deployment, TLS, logging, and how to connect to the DigitalOcean droplet.

Run locally (Streamable HTTP)

python -m venv .venv
source .venv/bin/activate
pip install -U pip
pip install .

export MCP_TRANSPORT=streamable-http
export MCP_HOST=127.0.0.1
export MCP_PORT=8000

scanmalware-mcp

Run with Docker

docker build -t scanmalware-mcp .
docker run --rm -p 127.0.0.1:8000:8000 \\
  -e MCP_TRANSPORT=streamable-http \\
  -e MCP_HOST=0.0.0.0 \\
  -e MCP_PORT=8000 \\
  scanmalware-mcp

Optional: set MCPAUTHTOKEN to require Authorization: Bearer for HTTP transports.

Optional auth env vars (only needed for auth-gated endpoints):

  • SCANMALWAREBEARERTOKEN

Other env vars:

  • SCANMALWAREBASEURL (default: https://scanmalware.com)
  • SCANMALWAREALLOWHTTP (default: false)
  • SCANMALWARETIMEOUTS (default: 30)
  • SCANMALWAREMAXDOWNLOAD_BYTES (default: 10485760)
  • SCANMALWAREALLOWPRIVATE_TARGETS (default: false)
  • SCANMALWARECACERT (optional; path to a CA bundle for SSL bump)

MCP server security env vars:

  • MCPAUTHTOKEN (if set, HTTP transports require Authorization: Bearer )
  • MCPRESOURCESERVERURL / MCPISSUERURL (optional; only used when MCPAUTH_TOKEN is set)

Transport note: the HTTP transports run stateless (stateless_http=True), so responses carry no mcp-session-id header. Clients must not require one. This keeps per-session state - and therefore memory - flat.

Tool note: submitscan does not call /api/v1/csrf-token; there is no CSRF token tool. Tool note: some upstream endpoints are disabled and excluded from the tool list (e.g., getimprovements, findscreenshotduplicates, getaistats, searchjsfingerprinter2codehash, searchjssegmentsbytlsh). Some search tools require at least one filter and will raise a validation error if none are provided.

Example prompts

Phishing triage (submit → wait → summarize):

Submit a scan for https://example-login-update.com, wait for completion, and
return status, risk_score, and the top indicators. If high risk, include the
AI analysis and screenshot resource.

Brand abuse monitoring:

Search scans for "acme login" (limit 5). For each result, list scan_id,
status, risk_score, and URL. Highlight anything marked high risk.

TLS/certificate inspection:

For scan_id 1234...abcd, fetch TLS details and the certificate PEM download.
Summarize issuer, subject, validity dates, and SANs; flag mismatches.

Deploy to DigitalOcean (Debian + Docker + Nginx)

The deploy bundle lives in deploy/ and runs two containers:

  • mcp (this server, streamable HTTP on port 8000)
  • nginx (frontend on port 80; proxies /mcp to the MCP server)

Prereqs

  • doctl authenticated (doctl auth init)
  • SSH key uploaded to DigitalOcean (used by doctl compute droplet create)

Create a small droplet in Germany (Frankfurt)

DROPLET_NAME=scanmalware-mcp-small
REGION=fra1
SIZE=s-1vcpu-2gb
IMAGE=debian-12-x64
SSH_KEYS=$(doctl compute ssh-key list --format ID --no-header | paste -sd, -)

doctl compute droplet create "$DROPLET_NAME" \
  --region "$REGION" \
  --size "$SIZE" \
  --image "$IMAGE" \
  --ssh-keys "$SSH_KEYS" \
  --tag-name scanmalware-mcp \
  --wait

Firewall (public HTTP/HTTPS + SSH)

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

ScanMalware.com URL Scanner: common questions

Is ScanMalware.com URL Scanner MCP server safe?
Yes, by our scan: it is graded A (88/100). Read the ScanMalware.com URL Scanner safety report
How do I install ScanMalware.com URL Scanner?
It runs remotely at mcp.scanmalware.com. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does ScanMalware.com URL Scanner need an API key?
Yes. The registry entry asks for Authorization.
Is ScanMalware.com URL Scanner maintained?
The last commit was 55 days ago (2026-09-10). The latest release is v0.1.6.
Is ScanMalware.com URL Scanner up?
96% of our last 28 checks got an answer. We check remote servers about four times a day.
How does ScanMalware.com URL Scanner compare with other MCP servers?
safety score 88/100 (higher than 75% of 48,255 servers); tools 128 (the typical server has 7); tools that change things 2% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.