MCP server for ScanMalware.com URL scanning, malware detection, and analysis.
Listed on
- Official MCP Registry
- Glamavia MCP Toplist
- PulseMCPvia MCP Toplist
First seen 2 Oct 2026. One server, whatever directories list it: each directory listing keeps its own page and history.
3
Directories
2 via MCP Toplist
128
Tools
From an anonymous probe
-
ToolBench grade
Not graded by Arcade
0
GitHub stars
From MCP Toplist
Tools
| Tool | Description | Behaviour |
|---|---|---|
| find_js_fingerprint_similar_by_hash | Find similar JS fingerprints by hash. | Read-only |
| get_ai_analysis | Get AI analysis for a scan_id (if available). | Read-only |
| get_analyzer_results | Get analyzer results for a scan_id. | Read-only |
| get_analyzer_stats | Get analyzer statistics overview. | Read-only |
| get_api_root | Get API root metadata. | Read-only |
| get_bot_protection | Get bot-protection detection for a scan_id. | Read-only |
| get_capabilities_by_date | Get capability stats by date. | Read-only |
| get_clipboard_events | Get clipboard events for a scan_id. | Read-only |
| get_clipboard_stats | Get clipboard statistics. | Read-only |
| get_cpe_by_scan | Get CPEs for a scan_id. | Read-only |
| get_cpe_stats | Get CPE statistics. | Read-only |
| get_ct_certificates | Get certificate transparency data for a domain. | Read-only |
| get_ct_dns_records | Get CT DNS records for a domain. | Read-only |
| get_ct_domains_by_ip | Find CT domains on an IP address. | Read-only |
| get_ct_similar_domains | Find similar CT domains for a domain. | Read-only |
| get_ct_timeline | Get CT certificate timeline for a domain. | Read-only |
| get_domain_history | Get historical scans for a domain (paginated). | Read-only |
| get_domain_scans | Get recent scans for a domain. | Read-only |
| get_domain_stats | Get summary statistics for a domain. | Read-only |
| get_favicon | Get the favicon for a scan_id: size, hashes, and the image itself base64-encoded. Use the md5 with search_by_favicon to pivot. | Read-only |
| get_favicon_stats | Get favicon statistics. This aggregate query can take up to 90 seconds by default. | Read-only |
| get_health | Get API health status. | Read-only |
| get_ids_alerts | Get IDS alerts for a scan_id. | Read-only |
| get_ip_stats | Get IP statistics (paginated). | Read-only |
| get_jarm_signatures | Get JARM signatures for a scan_id. | Read-only |
| get_jarm_stats | Get JARM statistics. | Read-only |
| get_js_fingerprinter2 | Get JS Fingerprinter2 results for a scan_id. | Read-only |
| get_js_fingerprinter2_coverage | Get JS Fingerprinter2 fingerprint coverage. | Read-only |
| get_js_fingerprinter2_health | Get JS Fingerprinter2 health check. | Read-only |
| get_js_fingerprinter2_stats | Get JS Fingerprinter2 stats. | Read-only |
| get_js_fingerprints | Get JavaScript fingerprints for a scan_id. | Read-only |
| get_js_library_inventory | Get JS fingerprint library inventory. | Read-only |
| get_js_segments_by_scan | Get JS segments for a scan_id. | Read-only |
| get_js_segments_suspicious | Get suspicious JS segments for a scan_id. | Read-only |
| get_js_segments_unknown | Get unknown JS segments for a scan_id. | Read-only |
| get_jsfingerprint | Get JS fingerprint by ID. | Read-only |
| get_jsfingerprint_bundle_stats | Get JS fingerprint bundle statistics. | Read-only |
| get_jsfingerprint_hash_prevalence | Get JS fingerprint hash prevalence for a scan_id. | Read-only |
| get_jsfingerprint_library_stats | Get JS fingerprint library statistics. | Read-only |
| get_jsfingerprint_similar | Find similar JS fingerprints. | Read-only |
| get_jsfingerprint_similarity_counts | Get JS fingerprint similarity counts. | Read-only |
| get_jsfingerprint_source | Get JS fingerprint source. | Read-only |
| get_latest_capabilities | Get latest capability stats. | Read-only |
| get_malware_by_scan | Get malware details for a scan_id. | Read-only |
| get_malware_stats | Get malware stats. | Read-only |
| get_netlog | Describe the network log (Chrome NetLog) for a scan_id: whether one exists, its size, and its encoding. The log itself is not returned - these are routinely tens of megabytes gzipped. | Read-only |
| get_ocr_by_scan | Get OCR data for a scan_id. | Read-only |
| get_ocr_stats | Get OCR stats. | Read-only |
| get_open_graph | Get Open Graph data for a scan_id. | Read-only |
| get_pastejacking | Get pastejacking findings for a scan_id. | Read-only |
| get_pcap_metadata | Get PCAP metadata for a scan_id. | Read-only |
| get_platform_stats | Get platform statistics. | Read-only |
| get_popular_technologies | Get popular technologies (paginated). | Read-only |
| get_rdap | Get RDAP details for a scan_id. | Read-only |
| get_recent_scans | Get recent public scans (paginated). | Read-only |
| get_recent_threats | Get recent malware threats. | Read-only |
| get_recent_yara_threats | Get recent YARA threats. | Read-only |
| get_safe_browsing | Get safe browsing threats for a scan_id. | Read-only |
| get_safe_browsing_stats | Get safe browsing stats. | Read-only |
| get_scan_ioc | Get IOC matches for a scan_id. | Read-only |
| get_scan_progress | Get scan progress by scan_id. | Read-only |
| get_scan_reports | Get available reports for a scan_id. | Read-only |
| get_scan_result | Get full scan result by scan_id. | Read-only |
| get_scan_summary | Get compact scan summary by scan_id. | Read-only |
| get_screenshot_stats | Get screenshot statistics. | Read-only |
| get_technologies_by_scan | Get detected technologies for a scan_id. | Read-only |
| get_technology_combinations | Get technology combinations (paginated). | Read-only |
| get_technology_stats | Get technology stats. | Read-only |
| get_tls_asn1 | Get TLS certificate ASN.1 data for a scan_id. | Read-only |
| get_tls_details | Get TLS details for a scan_id. | Read-only |
| get_top_tracking_keys | Get top tracking keys. | Read-only |
| get_yara_by_scan | Get YARA results for a scan_id. | Read-only |
| get_yara_matches | Get YARA matches for a scan_id. | Read-only |
| get_yara_stats | Get YARA stats. | Read-only |
| run_js_differential_analysis | Run JS differential analysis for a scan_id. | Read-only |
| search_ai_classification | Search AI scans by classification. | Read-only |
| search_ai_high_risk | Search AI high-risk scans. | Read-only |
| search_ai_scam_type | Search AI scans by scam type. | Read-only |
| search_analyzer_high_risk | Search analyzer high-risk scans (paginated). | Read-only |
| search_by_asn | Search scans by ASN (paginated). | Read-only |
| search_by_favicon | Search scans by favicon hash (paginated). | Read-only |
| search_by_fuzzy_hash | Search scans by fuzzy hash (paginated). | Read-only |
| search_by_ip | Search scans by IP address (paginated). | Read-only |
| search_by_jarm | Search scans by JARM signature (paginated). | Read-only |
| search_by_nameserver | Search scans by nameserver. | Read-only |
| search_by_registrar | Search scans by registrar (paginated). | Read-only |
| search_by_screenshot_hash | Search scans by screenshot hash (paginated). | Read-only |
| search_cpe | Search CPEs by pattern (paginated). | Read-only |
| search_favicon_mmh3 | Search favicon by mmh3 hash (paginated). | Read-only |
| search_js_fingerprint_by_bundler | Search JS fingerprints by bundler type. | Read-only |
| search_js_fingerprint_by_cdn | Search JS fingerprints by CDN. | Read-only |
| search_js_fingerprint_by_fuzzy_hash | Search JS fingerprints by fuzzy hash. | Read-only |
| search_js_fingerprint_by_library | Search JS fingerprints by detected library name. Use identifiers from get_js_library_inventory, such as 'react' or 'nextjs'. The display name 'Next.js' is accepted as an alias for 'nextjs'. | Read-only |
| search_js_fingerprint_by_library_version | Search JS fingerprints by library version. | Read-only |
| search_js_fingerprint_by_md5 | Search JS fingerprints by MD5 hash. | Read-only |
| search_js_fingerprint_by_normalized_hash | Search JS fingerprints by normalized hash. | Read-only |
| search_js_fingerprint_by_server | Search JS fingerprints by server type. | Read-only |
| search_js_fingerprint_by_sha1 | Search JS fingerprints by SHA1 hash. | Read-only |
| search_js_fingerprint_by_sha256 | Search JS fingerprints by SHA256 hash. | Read-only |
| search_js_fingerprint_obfuscated | Search obfuscated JS fingerprints. | Read-only |
| search_js_fingerprint_patterns | Search JS fingerprints by patterns. Supply at least one boolean filter: has_eval, has_crypto, has_websocket, high_entropy, no_library, or cdn_mismatch. For example, use has_eval=true. Explicit false is also a filter; limit alone is not a filter. | Read-only |
| search_js_fingerprinter2_composite_hash | Search JS Fingerprinter2 by composite hash. | Read-only |
| search_js_fingerprinter2_signature | Search JS Fingerprinter2 by signature. | Read-only |
| search_js_fingerprinter2_similar | Search JS Fingerprinter2 similar scans. | Read-only |
| search_js_malware_families | Search JS malware families. Supply min_cluster_size (at least 1) or similarity_threshold (0 to 1), or both; limit alone is not a filter. For example, use min_cluster_size=2. | Read-only |
| search_js_obfuscation | Search JS obfuscation signals. Supply at least one of risk_level, min_risk_score, or has_eval; limit alone is not a filter. For example, use has_eval=true. Explicit false and a min_risk_score of 0 are valid filters. | Read-only |
| search_js_segments_by_hash | Search JS segments by code hash. | Read-only |
| search_js_segments_by_normalized_hash | Search JS segments by normalized hash. | Read-only |
| search_jsfingerprints_by_bundler | Search JS fingerprints by bundler (paginated). | Read-only |
| search_jsfingerprints_by_fuzzy_hash | Search JS fingerprints by fuzzy hash (paginated). | Read-only |
| search_jsfingerprints_by_library | Search JS fingerprints by library (paginated). | Read-only |
| search_jsfingerprints_by_library_version | Search JS fingerprints by library version (paginated). | Read-only |
| search_jsfingerprints_by_md5 | Search JS fingerprints by MD5 (paginated). | Read-only |
| search_jsfingerprints_by_normalized_hash | Search JS fingerprints by normalized hash (paginated). | Read-only |
| search_jsfingerprints_by_sha1 | Search JS fingerprints by SHA1 (paginated). | Read-only |
| search_jsfingerprints_by_sha256 | Search JS fingerprints by SHA256 (paginated). | Read-only |
| search_ocr | Search OCR text (paginated). q must contain at least 3 characters after trimming. This query can take up to 90 seconds by default; allow it to finish before retrying. | Read-only |
| search_ocr_pattern | Search OCR by pattern (paginated). | Read-only |
| search_scans | Search scans (q must be at least 3 characters). | Read-only |
| search_semantic | Semantic search over scans (paginated). | Read-only |
| search_similar_scans | Search for scans similar to a scan_id (paginated). | Read-only |
| search_similar_screenshots | Search for similar screenshots by hash. | Read-only |
| search_suspicious_clipboard | Search suspicious clipboard indicators (paginated). | Read-only |
| search_technologies | Search technologies (paginated). | Read-only |
| search_tracking_key | Search by tracking key (paginated). | Read-only |
| submit_scan | Submit a URL to ScanMalware for scanning. WARNING: scan_type defaults to 'public', which publishes the target URL and scan results in the public feed and makes them visible to other users and search engines. Choose visibility explicitly: 'public' publishes the scan; 'unlisted' keeps it out of public listings but anyone with the direct link can access it; 'private' restricts results to the authenticated ScanMalware account and requires this server's SCANMALWARE_BEARER_TOKEN to be configured. For client targets, confidential URLs, or security engagements, ask the user to choose 'unlisted' or 'private' unless they have already specified visibility; use 'public' only with explicit approval to publish. Never fall back to a less restrictive visibility if submission fails. | Changes data |
| submit_scan_report | Submit a scan report. | Changes data |
| wait_for_scan | Poll until a scan reaches a terminal status, returning the final summary. | Read-only |
| Directory | Listing | Tier | First seen |
|---|---|---|---|
| Official MCP Registry | ScanMalware.com URL Scanner | - | 2 Oct 2026 |
| Glama | Listed there according to MCP Toplist’s dataset; not collected by InvokeRank. | ||
| PulseMCP | Listed there according to MCP Toplist’s dataset; not collected by InvokeRank. | ||