How do I install the phishunt mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

SSyncDev

Start a project

Phishunt MCP Server

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.

Remote serverstreamable-http

What is the Phishunt MCP Server?

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.

What you get

Exposes the public phishing-domains feed as MCP tools so AI agents can look up suspicious domains, list phishings by targeted brand, and sync detection deltas.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
check_domain	Is this domain/URL substring in the active phishunt feed?
list_brand_phishings	List active phishings targeting a brand (e.g. microsoft).
get_recent_detections	Delta sync: detections since an ISO date.
get_brand_metadata	Curated brand metadata (display name, category, AI characterisation, active count).
get_cert_metadata	Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings).
search_phishings	Free-text search across active phishing URLs/domains/IPs (min 3 chars).
analyze_url	Passive phishing-signal analysis of any URL/domain (URL-shape heuristics, stored score/verdict if known, historical detections). Unknown suspicious domains are auto-queued for full analysis.
get_related_infrastructure	Find infrastructure/content overlap for a known indicator (shared IP, cert, nameservers, favicon, etc.); surfaces the possible campaign / suspected cluster it belongs to.
get_campaigns	List possible campaigns / suspected clusters (shared-infrastructure groupings), optionally filtered by brand or active-only.
get_campaign	Full detail for one possible campaign / suspected cluster: evidence breakdown, every member indicator, export links.

How to install the Phishunt MCP Server

{
  "mcpServers": {
    "phishunt": {
      "url": "https://mcp.phishunt.io/"
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Example prompts to try

“Use Phishunt to check domain.”
“Use Phishunt to list brand phishings.”
“Use Phishunt to get recent detections.”

Frequently asked questions

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.