Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.
Phishunt MCP server exists for a simple reason — assistants are far more useful when they can act on Phishunt directly instead of describing what you should do. Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.
Exposes the public phishing-domains feed as MCP tools so AI agents can look up suspicious domains, list phishings by targeted brand, and sync detection deltas.
Once Phishunt is connected, these are the calls the assistant has available:
check_domain — Is this domain/URL substring in the active phishunt feed?list_brand_phishings — List active phishings targeting a brand (e.g. microsoft)get_recent_detections — Delta sync: detections since an ISO dateget_brand_metadata — Curated brand metadata (display name, category, AI characterisation, active count)get_cert_metadata — Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings)search_phishings — Free-text search across active phishing URLs/domains/IPs (min 3 chars)analyze_url — Passive phishing-signal analysis of any URL/domain (URL-shape heuristics, stored score/verdict if known, historical detections). Unknown suspiciousget_related_infrastructure — Find infrastructure/content overlap for a known indicator (shared IP, cert, nameservers, favicon, etc.); surfaces the possible campaign / suspectedget_campaigns — List possible campaigns / suspected clusters (shared-infrastructure groupings), optionally filtered by brand or active-onlyget_campaign — Full detail for one possible campaign / suspected cluster: evidence breakdown, every member indicator, export linksBeing a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.
Among the cloud and infrastructure options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Phishunt's toolset — check_domain, list_brand_phishings, get_recent_detections and 7 more — is a fair guide to whether it matches your workflow. It is maintained by 0xDanielLopez; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| check_domain | Is this domain/URL substring in the active phishunt feed? |
| list_brand_phishings | List active phishings targeting a brand (e.g. microsoft). |
| get_recent_detections | Delta sync: detections since an ISO date. |
| get_brand_metadata | Curated brand metadata (display name, category, AI characterisation, active count). |
| get_cert_metadata | Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings). |
| search_phishings | Free-text search across active phishing URLs/domains/IPs (min 3 chars). |
| analyze_url | Passive phishing-signal analysis of any URL/domain (URL-shape heuristics, stored score/verdict if known, historical detections). Unknown suspicious domains are auto-queued for full analysis. |
| get_related_infrastructure | Find infrastructure/content overlap for a known indicator (shared IP, cert, nameservers, favicon, etc.); surfaces the possible campaign / suspected cluster it belongs to. |
| get_campaigns | List possible campaigns / suspected clusters (shared-infrastructure groupings), optionally filtered by brand or active-only. |
| get_campaign | Full detail for one possible campaign / suspected cluster: evidence breakdown, every member indicator, export links. |
{
"mcpServers": {
"phishunt": {
"url": "https://mcp.phishunt.io/"
}
}
}Configuration as documented by the project. Restart the client after saving.
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Stop letting your assistant hallucinate n8n node parameters — this server hands it the real schemas, templates and validation.
AWS Labs' official server suite — current AWS docs, CDK guidance, cost analysis and service tools.
Cloud browsers for AI agents — automation sessions that run in Browserbase's fleet, not on your machine.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.