check_indicator

com.ismalicious/mcp-server · Verify this server

The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone number. Defanged input (hxxp://, [.], [@]) is accepted. Returns a verdict (malicious, suspicious, clean or unknown), a headline you can relay as is, recommendedAction (block, review, allow or unverified), a 0-100 risk score, the threat blocklists that cite it, up to three evidence reasons, first/last seen, and network, registration or file context. An email address or phone number is never called clean: not being in our sources is unknown / unverified; its answer adds the sender domain's reputation, disposable and MX facts, or the E.164 form of the number. `infrastructure` says what the entity is known as (cloud range, CDN, Tor exit, VPN, crawler, allowlist) without being a verdict. SHA-512, TLSH, ssdeep and input that is none of the six kinds (an address in a form the API cannot read, digits that are not a phone number, a number written with letters, a host that is not a dotted domain name) are refused before any request, at no cost. The default level, fast, answers from cached intelligence without a live DNS, WHOIS or OTX call (a hash nobody has cached may wait up to ~2.5 s on CIRCL); facets not cached yet are listed in meta.pending, and one re-check after a few seconds may complete them; if they are still pending then, keep the answer and do not re-check again. Costs one request of the monthly quota; check_url is the cheaper pre-fetch gate for a link.