ScanMalware MCP MCP server

An MCP server that provides access to ScanMalware.com's URL scanning, malware detection, and analysis tools, allowing agents to check URLs for security threats.

Endpoint and access

No sign-in: your client connects and lists tools immediately, with no account or key.

No sign-inEndpoint checked 2026-10-05Operated by ScanMalware

MCP endpoint (Streamable HTTP)

https://mcp.scanmalware.com/mcp

Vendor documentation

What you can do with it

Scan URLs for malware
Detect security threats
Analyze URL safety

Tools advertised by the last live check:

get_recent_scans
submit_scan
get_scan_summary
wait_for_scan
get_scan_result
search_scans
get_ai_analysis
get_scan_progress
get_scan_ioc
get_tls_details
get_tls_asn1
get_technologies_by_scan
get_bot_protection
get_yara_matches
get_jarm_signatures
get_analyzer_results
get_clipboard_events
get_js_fingerprints
get_scan_reports
get_domain_scans
get_domain_history
get_domain_stats
search_by_ip
get_ip_stats
search_by_asn
search_similar_scans
search_semantic
search_by_favicon
search_ai_high_risk
search_ai_scam_type
search_ai_classification
get_analyzer_stats
search_analyzer_high_risk
get_favicon
get_favicon_stats
get_screenshot_stats
search_similar_screenshots
search_ocr
search_ocr_pattern
search_by_jarm
search_by_fuzzy_hash
search_by_screenshot_hash
search_suspicious_clipboard
get_recent_threats
get_recent_yara_threats
get_ct_certificates
get_ct_dns_records
get_ct_domains_by_ip
get_ct_similar_domains
get_ct_timeline
get_api_root
get_health
get_platform_stats
get_latest_capabilities
get_capabilities_by_date
get_clipboard_stats
get_cpe_stats
get_cpe_by_scan
search_cpe
get_ids_alerts
get_jarm_stats
get_malware_stats
get_malware_by_scan
get_yara_stats
get_yara_by_scan
get_safe_browsing_stats
get_safe_browsing
get_top_tracking_keys
search_tracking_key
search_technologies
get_technology_combinations
get_popular_technologies
get_technology_stats
search_by_nameserver
get_rdap
search_by_registrar
submit_scan_report
get_ocr_stats
get_ocr_by_scan
get_open_graph
get_pastejacking
get_netlog
get_pcap_metadata
search_favicon_mmh3
get_js_fingerprinter2
get_js_fingerprinter2_stats
get_js_fingerprinter2_health
get_js_fingerprinter2_coverage
search_js_obfuscation
search_js_malware_families
search_js_fingerprinter2_composite_hash
search_js_fingerprinter2_signature
search_js_fingerprinter2_similar
get_js_segments_by_scan
search_js_segments_by_hash
search_js_segments_by_normalized_hash
get_js_segments_suspicious
get_js_segments_unknown
run_js_differential_analysis
get_js_library_inventory
search_js_fingerprint_patterns
search_js_fingerprint_obfuscated
search_js_fingerprint_by_server
search_js_fingerprint_by_bundler
search_js_fingerprint_by_cdn
search_js_fingerprint_by_library
search_js_fingerprint_by_library_version
search_js_fingerprint_by_fuzzy_hash
search_js_fingerprint_by_md5
search_js_fingerprint_by_normalized_hash
search_js_fingerprint_by_sha1
search_js_fingerprint_by_sha256
find_js_fingerprint_similar_by_hash
search_jsfingerprints_by_bundler
search_jsfingerprints_by_library
search_jsfingerprints_by_library_version
search_jsfingerprints_by_fuzzy_hash
search_jsfingerprints_by_md5
search_jsfingerprints_by_normalized_hash
search_jsfingerprints_by_sha1
search_jsfingerprints_by_sha256
get_jsfingerprint
get_jsfingerprint_similar
get_jsfingerprint_similarity_counts
get_jsfingerprint_source
get_jsfingerprint_bundle_stats
get_jsfingerprint_library_stats
get_jsfingerprint_hash_prevalence

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers a Streamable HTTP server. Use --scope project to write .mcp.json for the repo.

Claude Code configuration

claude mcp add --transport http scanmalware-mcp https://mcp.scanmalware.com/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).

Codex configuration

codex mcp add scanmalware-mcp --url https://mcp.scanmalware.com/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable scanmalware-mcp in your MCP settings.

Cursor configuration

{
  "mcpServers": {
    "scanmalware-mcp": {
      "url": "https://mcp.scanmalware.com/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure). The type must be streamableHttp for a remote HTTP server.

Cline configuration

{
  "mcpServers": {
    "scanmalware-mcp": {
      "type": "streamableHttp",
      "url": "https://mcp.scanmalware.com/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start scanmalware-mcp and inspect its tools.

VS Code configuration

{
  "servers": {
    "scanmalware-mcp": {
      "type": "http",
      "url": "https://mcp.scanmalware.com/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.

Gemini CLI configuration

gemini mcp add --transport http scanmalware-mcp https://mcp.scanmalware.com/mcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.

Claude Desktop configuration

{
  "mcpServers": {
    "scanmalware-mcp": {
      "url": "https://mcp.scanmalware.com/mcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.

Windsurf configuration

{
  "mcpServers": {
    "scanmalware-mcp": {
      "serverUrl": "https://mcp.scanmalware.com/mcp"
    }
  }
}

See all 957

Do you run ScanMalware MCP?

Prove ownership with a DNS record, a well-known file, or your Official MCP Registry entry, and your edits publish immediately. Proofs are re-checked weekly; admins can still hide or remove a listing.

Claim this listing