Name: ScanMalware.com URL Scanner
Author: scanmalware

LABSCO SUMMARY

Triage a suspicious link without opening it.

The whole flow is one loop — submit, wait, read the verdict — and the certificate detail is what turns a score into an explanation: a login page whose certificate names a different organisation is the kind of thing a number alone will not tell you.

What it is

A Python server over the public ScanMalware.com API. It submits a URL for scanning, follows the scan to completion, and returns the status, risk score and the indicators behind it, along with TLS and certificate detail, screenshots and previous scans.

What you get

A URL submitted for scanning and followed until it completes (submit_scan)
The verdict: status, risk score and the top indicators
The scan's AI analysis and its screenshot resource, when the risk warrants a closer look
Past scans searched by term, each with its identifier, status, risk score and URL
TLS details and the certificate PEM for a scan — issuer, subject, validity dates and alternative names
Search tools that require at least one filter, so an empty query returns a validation error rather than everything

Requirements

Nothing for the public endpoints. The hosted endpoint is https://mcp.scanmalware.com/mcp over Streamable HTTP; a GET without the MCP accept headers returns 406, which is expected. To run it yourself, pip install . on Python or the Docker image, with MCP_TRANSPORT, MCP_HOST and MCP_PORT set — and MCP_AUTH_TOKEN if you want your own instance to demand a bearer token from connecting clients. SCANMALWARE_BEARER_TOKEN is only for the parts of the upstream API that ask for one. Two limits worth knowing: downloads are capped by SCANMALWARE_MAX_DOWNLOAD_BYTES at 10485760 bytes by default, and private network targets are refused unless SCANMALWARE_ALLOW_PRIVATE_TARGETS is turned on. A few upstream endpoints are disabled and left out of the tool list entirely.

Setup effort

Paste a URL — add the endpoint to your client

See installation options

USE CASES

01

Checking a link before anyone clicks it

Submit the URL, wait for the scan to finish, and read the status, risk score and top indicators. The page gets loaded in their infrastructure rather than on the machine of whoever received the email.

submit_scan

02

Explaining why something is flagged

A risk score on its own convinces nobody. Pull the AI analysis and the screenshot for a high-risk scan so the write-up shows what the page actually was.

get_ai_analysisget_scan_result

03

Watching for impersonation of your brand

Search past scans for your product name and read the results — identifier, status, risk score, URL. Look-alike login pages tend to appear in a public scan corpus before they appear in your inbox.

search_scans

04

Inspecting the certificate behind a login page

Fetch the TLS details and the certificate PEM for the scan, and read issuer, subject, validity dates and alternative names. A mismatch between the certificate's organisation and the brand on the page is the clearest phishing tell there is.

get_tls_detailsget_tls_asn1

128 tools

Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.

`get_recent_scans`

Get recent public scans (paginated).

BEFORE YOU INSTALL

What to know first

Tools you get

128 tools when we connected.

CONTEXT COST

Heavy Standing cost

Rated by the size of the 128 tool definitions that ride along on every turn, not by how many there are

INSTALLATION

Connect your client

Server setup

Setup

Run it locally over Streamable HTTP: git clone https://github.com/scanmalware/mcp-server && cd mcp-server && python -m venv .venv && source .venv/bin/activate && pip install -U pip && pip install .

Start the server on 127.0.0.1:8000: export MCP_TRANSPORT=streamable-http && export MCP_HOST=127.0.0.1 && export MCP_PORT=8000 && scanmalware-mcp

Docker alternative: docker build -t scanmalware-mcp . then docker run --rm -p 127.0.0.1:8000:8000 -e MCP_TRANSPORT=streamable-http -e MCP_HOST=0.0.0.0 -e MCP_PORT=8000 scanmalware-mcp

Or skip local install entirely and point your client at the hosted endpoint https://mcp.scanmalware.com/mcp

Hosted endpoint

Any MCP client — remote

ENDPOINT URL

https://mcp.scanmalware.com/mcp

MCP Clients

Self-hosted HTTP server

SELF-HOSTED HTTP SERVER · TERMINAL

MCP_TRANSPORT=streamable-http MCP_HOST=127.0.0.1 MCP_PORT=8000 scanmalware-mcp

ScanMalware.com URL Scanner

Triage a suspicious link without opening it.

What it is

What you get

Requirements

Setup effort

Checking a link before anyone clicks it

Explaining why something is flagged

Watching for impersonation of your brand

Inspecting the certificate behind a login page

128 tools

get_recent_scans

submit_scan

get_scan_summary

wait_for_scan

get_scan_result

search_scans

get_ai_analysis

get_scan_progress

get_scan_ioc

get_tls_details

get_tls_asn1

get_technologies_by_scan

get_bot_protection

get_yara_matches

get_jarm_signatures

get_analyzer_results

get_clipboard_events

get_js_fingerprints

get_scan_reports

get_domain_scans

get_domain_history

get_domain_stats

search_by_ip

get_ip_stats

search_by_asn

search_similar_scans

search_semantic

search_by_favicon

search_ai_high_risk

search_ai_scam_type

search_ai_classification

get_analyzer_stats

search_analyzer_high_risk

get_favicon

get_favicon_stats

get_screenshot_stats

search_similar_screenshots

search_ocr

search_ocr_pattern

search_by_jarm

search_by_fuzzy_hash

search_by_screenshot_hash

search_suspicious_clipboard

get_recent_threats

get_recent_yara_threats

get_ct_certificates

get_ct_dns_records

get_ct_domains_by_ip

get_ct_similar_domains

get_ct_timeline

get_api_root

get_health

get_platform_stats

get_latest_capabilities

get_capabilities_by_date

get_clipboard_stats

get_cpe_stats

get_cpe_by_scan

search_cpe

get_ids_alerts

get_jarm_stats

get_malware_stats

get_malware_by_scan

get_yara_stats

get_yara_by_scan

get_safe_browsing_stats

get_safe_browsing

get_top_tracking_keys

search_tracking_key

`get_recent_scans`

`submit_scan`

`get_scan_summary`

`wait_for_scan`

`get_scan_result`

`search_scans`

`get_ai_analysis`

`get_scan_progress`

`get_scan_ioc`

`get_tls_details`

`get_tls_asn1`

`get_technologies_by_scan`

`get_bot_protection`

`get_yara_matches`

`get_jarm_signatures`

`get_analyzer_results`

`get_clipboard_events`

`get_js_fingerprints`

`get_scan_reports`

`get_domain_scans`

`get_domain_history`

`get_domain_stats`

`search_by_ip`

`get_ip_stats`

`search_by_asn`

`search_similar_scans`

`search_semantic`

`search_by_favicon`

`search_ai_high_risk`

`search_ai_scam_type`

`search_ai_classification`

`get_analyzer_stats`

`search_analyzer_high_risk`

`get_favicon`

`get_favicon_stats`

`get_screenshot_stats`

`search_similar_screenshots`

`search_ocr`

`search_ocr_pattern`

`search_by_jarm`

`search_by_fuzzy_hash`

`search_by_screenshot_hash`

`search_suspicious_clipboard`

`get_recent_threats`

`get_recent_yara_threats`

`get_ct_certificates`

`get_ct_dns_records`

`get_ct_domains_by_ip`

`get_ct_similar_domains`

`get_ct_timeline`

`get_api_root`

`get_health`

`get_platform_stats`

`get_latest_capabilities`

`get_capabilities_by_date`

`get_clipboard_stats`

`get_cpe_stats`

`get_cpe_by_scan`

`search_cpe`

`get_ids_alerts`

`get_jarm_stats`

`get_malware_stats`

`get_malware_by_scan`

`get_yara_stats`

`get_yara_by_scan`

`get_safe_browsing_stats`

`get_safe_browsing`

`get_top_tracking_keys`

`search_tracking_key`

`search_technologies`

`get_technology_combinations`

`get_popular_technologies`

`get_technology_stats`

`search_by_nameserver`

`get_rdap`

`search_by_registrar`

`submit_scan_report`

`get_ocr_stats`

`get_ocr_by_scan`

`get_open_graph`