Phishunt MCP server

What it does

MCP server that exposes the phishunt.io public phishing feed, allowing AI agents to check domains against active and archived phishing data, search by brand, and analyze URLs for phishing signals. For security researchers, developers, and AI applications that need to assess domain reputation and detect phishing infrastructure.

• Check whether a domain or list of domains are in the active phishing feed or historical archive.
• Search for all phishing URLs targeting a specific brand or analyze the infrastructure connections between suspected phishing campaigns.
• Perform passive analysis of a URL to get a verdict (phishing/likely_phishing/suspicious/no_evidence/not_assessed) with supporting evidence from heuristics, stored scores, and external feeds.

Tools this server exposes

Tool	Does
check_domain	Check if a host or up to 20 hosts are in the active phishunt feed or archive, using exact matching.
list_brand_phishings	List all active phishings targeting a specified brand.
get_recent_detections	Retrieve phishing detections since a given ISO date for delta synchronization.
get_brand_metadata	Retrieve curated metadata for a brand including display name, category, AI characterization, and active phishing count.
get_cert_metadata	Retrieve factual metadata about an abused TLS intermediate CA including operator, root, key type, and sibling certificates.
search_phishings	Perform free-text search across active phishing URLs, domains, and IPs (minimum 3 characters).
analyze_url	Perform passive phishing-signal analysis of any URL or domain, returning a verdict with supporting evidence from heuristics, stored scores, and external feeds.
analyze_url_deep	Perform active deep analysis of a URL by contacting the target (HTTP, TLS cert, RDAP, NS, GeoIP, SOCKS5-isolated) and re-scoring with the full 5-layer engine; r
get_related_infrastructure	Find infrastructure and content overlap for a known indicator such as shared IP, certificate, nameservers, or favicon to identify possible campaigns or suspecte
get_campaigns	List possible campaigns or suspected clusters based on shared infrastructure groupings, optionally filtered by brand or active status.
get_campaign	Retrieve full details for one campaign or suspected cluster including evidence breakdown, member indicators, and export links.

Before you enable it

An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.