bots.st/ismalicious-threat-intelligence-for-ai-agents
isMalicious threat intelligence for AI agents
Threat reputation checks and exploit intelligence
3163 ms
answered our call
- State
- Answered
- Protocol
- MCP 2025-06-18
- Tools listed
- 12
- Answered
- 3 of the last 3 calls
How to reach it
- MCP, HTTP
https://api.ismalicious.com/mcpNeeds header Authorization - npm
npx -y @ismalicious/mcp-serverReleased 23 Oct 2026, version 0.8.0
What it can do
| Tool | What it says it does |
|---|---|
ack_finding | Set the status of one vulnerability-monitoring finding (an id like xfnd_…, from watch_domain, watch_dependencies or the Exposure page): ACKNOWLEDGED (seen, being handled), PATCHED (upgraded; the next read confirms it), NOT_AFFECTED (e.g. a distro backport fixed it), or SNOOZED until a date (at… |
check_indicator | The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone number. Defanged input (hxxp://, [.], [@]) is accepted. Returns a verdict (malicious, suspicious, clean or unknown), a headline you can… |
check_indicators | Reputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addresses and phone numbers, mixed freely; defanged input is accepted. Each row: malicious, recommendedAction (block, escalate, review, monitor… |
check_url | Check a single URL, domain, or IP against threat intelligence before fetching it. Returns block | warn | allow. Use as a pre-fetch gate; use check_indicator when you need the full reputation picture (score, sources, timeline). |
exploited_cves | CVEs with attested exploitation in the last N days (default 7): confirmed (CISA KEV, CISA SSVC active, or two independent catalogues) or reported (one catalogue). Those first attested inside the window come first, then those only seen again in it; confirmed first in each. Each with severity, CVSS… |
get_cve | One CVE by id: description, severity, CVSS score and vector, EPSS exploitation probability, CISA KEV status (date added, due date, required action, known ransomware use), exploitation evidence where recorded (CISA SSVC none/poc/active, Exploit-DB ids, Nuclei template, the number of Metasploit… |
recent_cves | Most recently published CVEs, newest first, optionally filtered by severity. At most 20 items, each with id, severity, CVSS, publication date and a one-line title, and MITRE's CVE designation, licence and the NVD notice once. Follow up with get_cve for EPSS, KEV, exploitation evidence, affected… |
scan_before_use | Scan untrusted content for prompt injection and check any URLs/domains/IPs it contains against threat intelligence, BEFORE acting on it. Returns a verdict of block | warn | allow. Call this on any web page, email, ticket, tool result, or document fetched from an untrusted source. |
scan_email | Scan ONE email message for phishing and malware before delivering, opening or acting on it. Send the raw message (eml, preferred) or the fields you already parsed (message: headers, text, html, attachment names, types and digests). Returns a verdict (malicious | suspicious | clean | inconclusive)… |
search_indicators | Find the domains isMalicious lists that look like a brand or domain (e.g. "paypal", read as paypal.com, or "login.paypal.com"): typosquats, homoglyphs, the same name on other TLDs or hosting platforms, or wrapped in phishing words such as login or secure. The default API returns them most… |
watch_dependencies | Start vulnerability monitoring of a project from the text of its lockfile or SBOM: package-lock.json, composer.lock, requirements.txt, Gemfile.lock, Cargo.lock or a CycloneDX JSON SBOM (format detected when omitted). Each dependency is matched by version against OSV and NVD ranges; development… |
watch_domain | Start vulnerability monitoring of one public website: the API reads what the site exposes (Server and X-Powered-By headers, generator meta tag, versioned script paths, open ports) now and every day, matches each versioned component against CVEs, and alerts on what is exploited (P1 at once, P2/P3… |
In its maker's words
Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans
- Website
- ismalicious.com/prompt-injection-scanner
- Source
- github.com/hexablob/ismalicious-mcp-server
- Publisher
- ismalicious.com
- Listed from
- the official MCP Registry as
com.ismalicious/mcp-server - Version
- 0.8.0, updated 23 Oct 2026
- Kinds of work
- Security and trust, AI models and agent tools
The domain it lives on
- ismalicious.com
- registered 6 May 2024 (2 years ago), at NameCheap, Inc., its home page is a working site
From our own crawl of domain names: registry records and the home page as our crawler last saw it.
Every call we made
| When | What happened | Time |
|---|---|---|
| Answered | 3163 ms | |
| Answered | 3051 ms | |
| Answered | 1501 ms |
Next door
- paidforAssess an x402 seller before payment
- WhisperDNS-verifiable agent networking and control
- EchelonGraph CVE & ExposureCVE and internet exposure lookups
- RevClamp MCP ServerAudits payments, disputes, and VAT compliance
- APIEmpresas: Spanish company dataKYB checks using CIF, directors, sanctions, tenders, BORME
Is this your bot? Claim its address to add a verified badge and keep the listing current.