Categories › Security › Code & dependency scanning
MCP server for ScanMalware.com URL scanning, malware detection, and analysis.
Remote server: your requests and data go to mcp.scanmalware.com. Claude Code: claude mcp add --transport http scanmalware-com-url-scanner https://mcp.scanmalware.com/mcp · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
get_recent_scans — List the most recent public scans, newest first (paginated with page and limit). Each row has the scan ID, URL, status, visibility and submisubmit_scan — Submit a URL to ScanMalware to be rendered and analysed in an isolated analysis environment; returns the new scan_id. scan_type is required get_scan_summary — Get a compact summary of one scan: submitted URL, final URL after redirects, status, completion time and the security verdict (verdict text,wait_for_scan — Wait for a submitted scan to finish by polling its status every poll_interval_s seconds, up to timeout_s seconds (default 180). Returns the get_scan_result — Get the result document of one scan: URLs and redirects, page title, load times, links, network requests, IP addresses, JavaScript files, TLsearch_scans — Search the archive of public scans by text in the URL, domain or page title (paginated); q needs at least 3 characters and search_type narrosearch_smql — Search public scans with the ScanMalware Query Language (SMQL): field filters such as domain:paypal.com, ip:1.2.3.4, favicon_hash:<mmh3>, jsget_smql_facets — Summarise what the scans matching an SMQL query have in common: the most frequent hosting networks, countries, domains, registrars, certificsearch_smql_domains — Search domains rather than scans with SMQL domain filters, including domains ScanMalware never scanned, each with its newest public scan wheget_smql_filters — Describe the SMQL query language. Without category: the syntax, the has: existence checks and the filter names in each category (Core, Netwocount_smql_queries — Count the public scans matching each of up to 25 SMQL queries in one request, for example to see which indicators of a campaign are selectivget_scan_pivot_values — List the searchable values of one scan beyond its main result: SHA-256 of every response body it loaded, its scripts with their structure anget_scan_graph — Compare up to 20 public scans side by side: each with URL, final URL, host, title, AI verdict and risk score, rule-based risk, screenshot URget_ai_analysis — Get the AI analysis of one scan: classification (LEGITIMATE to CONFIRMED_SCAM), scam type, risk score, confidence, impersonated brand and thget_scan_progress — Get the progress of a running scan: current step, total steps, step name, percentage and status. Useful for checking whether a scan has finiget_scan_ioc — Check one scan against threat-intelligence indicator feeds: matching IP addresses and domains the page contacted, the threat types, and a suget_tls_details — Get the TLS certificate the scanned site presented: subject, issuer, validity dates, whether it was valid or expired, and related details. sget_tls_asn1 — Get the raw ASN.1 structure of the TLS certificate from one scan, for detailed certificate inspection. scan_id is the UUID of a ScanMalware get_technologies_by_scan — List the web technologies detected on a scanned page (frameworks, CMS, CDN, analytics and so on), with versions where known. scan_id is the get_bot_protection — Get the bot-protection and CAPTCHA services detected on a scanned page (for example Cloudflare Turnstile), with a detected flag. Phishing kiget_yara_matches — Get the YARA rule matches recorded for one scan, with the matching rules and a summary by severity and category. scan_id is the UUID of a Scget_jarm_signatures — Get the JARM TLS server fingerprints measured for the hosts in one scan, with whether each matches a known signature. A shared JARM often poget_analyzer_results — List which analysis modules ran for one scan (for example JavaScript fingerprinting and AI analysis), with each module's status, success flaget_clipboard_events — Get the clipboard writes the page attempted while it was scanned, with the event count and whether collection ran. Empty with an explanatoryget_js_fingerprints — List the JavaScript files a scanned page loaded, each with its fingerprint: hashes (SHA-256, SHA-1, MD5, normalized and fuzzy), size metricsget_scan_reports — Count the votes users cast on one scan: thumbs up (marked safe), thumbs down (marked malicious) and the total. All zero when nobody has voteget_domain_scans — List the recent scans of a domain and its subdomains, newest first, up to limit; status filters by scan status. Each row has matched_on: 'urget_domain_history — Get the scan history of a domain with the total count and the scans, paginated with page and limit.get_domain_stats — Get scan counts for a domain: total, unique, completed and failed scans, first and latest scan, and scans in the last 24 hours, 7 days and 3search_by_ip — List scans of pages served from an IP address (paginated), each with scan ID, URL and time. On shared hosting and CDNs an IP serves many unrget_ip_stats — Get statistics for an IP address across the archive: total scans, unique URLs, first and last seen, geolocation, ASN and organisation, BGP asearch_by_asn — Get what the archive knows about an autonomous system (ASN number, without 'AS'): organisation, total scans, unique URLs, first and last seesearch_similar_scans — Find scans that look like this one by screenshot similarity, favicon or fuzzy page hash (methods, default screenshot), each with URL, final search_semantic — Search scans by meaning, comparing text with screenshot embeddings (for example 'bank login page asking for card details'). threshold defaulsearch_by_favicon — Search scans by favicon hash (paginated): a mmh3 hash by default, or the favicon's MD5 with hash_type='md5'.search_ai_high_risk — List scans that the AI analysis rated high risk, optionally above min_risk_score and min_confidence, each with URL, title and the analysis. search_ai_scam_type — List scans whose AI analysis named a given scam type, such as 'Phishing', each with URL, title, submission time and the analysis (verdict, csearch_ai_classification — List scans whose AI analysis gave a specific classification: LEGITIMATE, LOW_RISK, MODERATE_RISK, HIGH_RISK or CONFIRMED_SCAM. Each result hget_analyzer_stats — Get platform-wide statistics for the scan analysis modules: the modules and their run counts. Describes the service, not a particular scan.search_analyzer_high_risk — List scans that the security analyzer scored as high risk, highest first (paginated), each with URL, risk score, verdict, confidence and anaNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.