Skip to content

ScanMalware.com URL Scanner

by mcp.scanmalware.com · remote · no sign-in to list tools · v0.1.6 · published by com.scanmalware.mcp

MCP server for ScanMalware.com URL scanning, malware detection, and analysis.

Changes · 3
CompareRegistry entry

128 tools: 3 change things and 125 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http scanmalware https://mcp.scanmalware.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnrun_js_differential_analysis

    The server marks "run_js_differential_analysis" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "run_js_differential_analysis" says "run": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

128 tools

Changes things 3Claude Code: ask
  • run_js_differential_analysisCompare the JavaScript of one scan against known libraries and report which code segments match a library, which are unknown and which look suspicious, with a per-library breakdown…1 finding

    Why it is in this group

    • The name "run_js_differential_analysis" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "run_js_differential_analysis" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "run_js_differential_analysis" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Compare the JavaScript of one scan against known libraries and report which code segments match a library, which are unknown and which look suspicious, with a per-library breakdown. Matches below min_confidence (default 0.8) are not counted; known library code is excluded unless include_known_libraries is true. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Run JS Differential Analysis
  • submit_scanSubmit a URL to ScanMalware to be rendered and analysed in a sandboxed browser; returns the new scan_id.No findings

    Why it is in this group

    • The name "submit_scan" says "submit": a word for a change.
    Description, as the server wrote it
    Submit a URL to ScanMalware to be rendered and analysed in a sandboxed browser; returns the new scan_id. scan_type is required and sets who can see the result: 'public' lists the URL and its results in the public feed, visible to anyone and to search engines; 'unlisted' keeps the scan out of public listings, but anyone with its link can open it; 'private' limits the result to the ScanMalware account of this server's SCANMALWARE_BEARER_TOKEN and is rejected when no token is configured. Wraps POST /api/v1/scan of the ScanMalware API, documented at https://scanmalware.com/api-docs.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
    • title: Submit Scan
  • submit_scan_reportVote on a scan, as the Mark as Safe and Mark as Malicious buttons on its result page do: report_type 'positive_feedback' marks the scanned page as safe and 'malware' marks it as ma…No findings

    Why it is in this group

    • The name "submit_scan_report" says "submit": a word for a change.
    Description, as the server wrote it
    Vote on a scan, as the Mark as Safe and Mark as Malicious buttons on its result page do: report_type 'positive_feedback' marks the scanned page as safe and 'malware' marks it as malicious. report_details is an optional note of up to 1000 characters. Votes are recorded as crowd feedback on the scan and are rate-limited per client IP. The website's other report types (phishing, spam, copyright and so on) need a captcha and are not available here.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
    • title: Submit Scan Report
Only reads 125Claude Code: allow
  • find_js_fingerprint_similar_by_hashFind JavaScript files similar to the file with this content SHA-256, above threshold (default 0.7), up to limit results; exclude_exact_matches drops identical copies.No findings

    Why it is in this group

    • The name "find_js_fingerprint_similar_by_hash" says "find": a word for reading.
    Description, as the server wrote it
    Find JavaScript files similar to the file with this content SHA-256, above threshold (default 0.7), up to limit results; exclude_exact_matches drops identical copies. Useful for finding modified versions of a known script.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Find JS Fingerprint Similar By Hash
  • get_ai_analysisGet the AI analysis of one scan: classification (LEGITIMATE to CONFIRMED_SCAM), scam type, risk score, confidence, impersonated brand and the key evidence behind it.No findings

    Why it is in this group

    • The name "get_ai_analysis" says "get": a word for reading.
    Description, as the server wrote it
    Get the AI analysis of one scan: classification (LEGITIMATE to CONFIRMED_SCAM), scam type, risk score, confidence, impersonated brand and the key evidence behind it. The analysis is produced a few minutes after the scan completes and returns not found until then. It can disagree with the scanner's own security verdict. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get AI Analysis
  • get_analyzer_resultsList which analysis modules ran for one scan (for example JavaScript fingerprinting and AI analysis), with each module's status, success flag and timing.No findings

    Why it is in this group

    • The name "get_analyzer_results" says "get": a word for reading.
    Description, as the server wrote it
    List which analysis modules ran for one scan (for example JavaScript fingerprinting and AI analysis), with each module's status, success flag and timing. Useful for checking why a result is missing. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Analyzer Results
  • get_analyzer_statsGet platform-wide statistics for the scan analysis modules: the modules and their run counts.No findings

    Why it is in this group

    • The name "get_analyzer_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get platform-wide statistics for the scan analysis modules: the modules and their run counts. Describes the service, not a particular scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Analyzer Stats
  • get_api_rootGet the ScanMalware API's name, version, status, main endpoints and feature list.No findings

    Why it is in this group

    • The name "get_api_root" says "get": a word for reading.
    Description, as the server wrote it
    Get the ScanMalware API's name, version, status, main endpoints and feature list.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get API Root
  • get_bot_protectionGet the bot-protection and CAPTCHA services detected on a scanned page (for example Cloudflare Turnstile), with a detected flag.No findings

    Why it is in this group

    • The name "get_bot_protection" says "get": a word for reading.
    Description, as the server wrote it
    Get the bot-protection and CAPTCHA services detected on a scanned page (for example Cloudflare Turnstile), with a detected flag. Phishing kits often use these to hide from scanners. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Bot Protection
  • get_capabilities_by_dateGet the size of ScanMalware's detection content (indicators, detection rules, ClamAV signatures) on a given date (scan_date, YYYY-MM-DD).No findings

    Why it is in this group

    • The name "get_capabilities_by_date" says "get": a word for reading.
    Description, as the server wrote it
    Get the size of ScanMalware's detection content (indicators, detection rules, ClamAV signatures) on a given date (scan_date, YYYY-MM-DD).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Capabilities By Date
  • get_clipboard_eventsGet the clipboard writes the page attempted while it was scanned, with the event count and whether collection ran.No findings

    Why it is in this group

    • The name "get_clipboard_events" says "get": a word for reading.
    Description, as the server wrote it
    Get the clipboard writes the page attempted while it was scanned, with the event count and whether collection ran. Empty with an explanatory note when the page wrote nothing. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Clipboard Events
  • get_clipboard_statsGet clipboard and pastejacking statistics across the archive: event totals, detections and daily activity.No findings

    Why it is in this group

    • The name "get_clipboard_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get clipboard and pastejacking statistics across the archive: event totals, detections and daily activity.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Clipboard Stats
  • get_cpe_by_scanList the CPE identifiers (product and version names in the NVD format) derived from the technologies detected on a scanned page, with their source.No findings

    Why it is in this group

    • The name "get_cpe_by_scan" says "get": a word for reading.
    Description, as the server wrote it
    List the CPE identifiers (product and version names in the NVD format) derived from the technologies detected on a scanned page, with their source. Useful for matching against vulnerability data. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get CPE By Scan
  • get_cpe_statsGet CPE statistics across the archive: scans with CPEs, unique CPEs, total detections, top vendors and products.No findings

    Why it is in this group

    • The name "get_cpe_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get CPE statistics across the archive: scans with CPEs, unique CPEs, total detections, top vendors and products.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get CPE Stats
  • get_ct_certificatesGet the certificates issued for a domain according to Certificate Transparency logs, with a found flag.No findings

    Why it is in this group

    • The name "get_ct_certificates" says "get": a word for reading.
    Description, as the server wrote it
    Get the certificates issued for a domain according to Certificate Transparency logs, with a found flag.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get CT Certificates
  • get_ct_dns_recordsList subdomains of a domain found through Certificate Transparency, with their DNS records (type, IP addresses, TTL) and when they were seen.No findings

    Why it is in this group

    • The name "get_ct_dns_records" says "get": a word for reading.
    Description, as the server wrote it
    List subdomains of a domain found through Certificate Transparency, with their DNS records (type, IP addresses, TTL) and when they were seen. Useful for finding the other hosts of a domain.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get CT DNS Records
  • get_ct_domains_by_ipList domains that Certificate Transparency and DNS data associate with an IP address, with record counts and the total.No findings

    Why it is in this group

    • The name "get_ct_domains_by_ip" says "get": a word for reading.
    Description, as the server wrote it
    List domains that Certificate Transparency and DNS data associate with an IP address, with record counts and the total.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get CT Domains By IP
  • get_ct_similar_domainsFind domains with names similar to a domain in Certificate Transparency data (for example lookalikes and typosquats), each with a certificate count and the kind of similarity.No findings

    Why it is in this group

    • The name "get_ct_similar_domains" says "get": a word for reading.
    Description, as the server wrote it
    Find domains with names similar to a domain in Certificate Transparency data (for example lookalikes and typosquats), each with a certificate count and the kind of similarity.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get CT Similar Domains
  • get_ct_timelineGet the certificate history of a domain from Certificate Transparency: when certificates were issued and when the certificate changed.No findings

    Why it is in this group

    • The name "get_ct_timeline" says "get": a word for reading.
    Description, as the server wrote it
    Get the certificate history of a domain from Certificate Transparency: when certificates were issued and when the certificate changed.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get CT Timeline
  • get_domain_historyGet the scan history of a domain with the total count and the scans, paginated with page and limit.No findings

    Why it is in this group

    • The name "get_domain_history" says "get": a word for reading.
    Description, as the server wrote it
    Get the scan history of a domain with the total count and the scans, paginated with page and limit.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Domain History
  • get_domain_scansList the recent scans of a domain and its subdomains, newest first, up to limit; status filters by scan status.No findings

    Why it is in this group

    • The name "get_domain_scans" says "get": a word for reading.
    Description, as the server wrote it
    List the recent scans of a domain and its subdomains, newest first, up to limit; status filters by scan status. Each row has matched_on: 'url' when the scan was submitted for a host under this domain, and only 'final_url' when another site redirected there. A verdict on a final_url-only row belongs to the submitted host, not to this domain.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Domain Scans
  • get_domain_statsGet scan counts for a domain: total, unique, completed and failed scans, first and latest scan, and scans in the last 24 hours, 7 days and 30 days.No findings

    Why it is in this group

    • The name "get_domain_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get scan counts for a domain: total, unique, completed and failed scans, first and latest scan, and scans in the last 24 hours, 7 days and 30 days.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Domain Stats
  • get_faviconGet the favicon recorded for a scan_id: its size, MD5 and SHA-256 hashes, and the image base64-encoded.No findings

    Why it is in this group

    • The name "get_favicon" says "get": a word for reading.
    Description, as the server wrote it
    Get the favicon recorded for a scan_id: its size, MD5 and SHA-256 hashes, and the image base64-encoded. found is false when no favicon is stored for the scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Favicon
  • get_favicon_statsGet favicon statistics across the archive: total favicons, those seen in the last 24 hours and the most common hashes with sample URLs.No findings

    Why it is in this group

    • The name "get_favicon_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get favicon statistics across the archive: total favicons, those seen in the last 24 hours and the most common hashes with sample URLs. This aggregate query can take up to 90 seconds by default.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Favicon Stats
  • get_healthCheck whether the ScanMalware API is up.No findings

    Why it is in this group

    • The name "get_health" says "get": a word for reading.
    Description, as the server wrote it
    Check whether the ScanMalware API is up. Returns the service status.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Health
  • get_ids_alertsGet intrusion detection (IDS) alerts raised on the network traffic recorded during one scan, with a severity breakdown and total count.No findings

    Why it is in this group

    • The name "get_ids_alerts" says "get": a word for reading.
    Description, as the server wrote it
    Get intrusion detection (IDS) alerts raised on the network traffic recorded during one scan, with a severity breakdown and total count. Empty when no rule fired. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get IDS Alerts
  • get_ip_statsGet statistics for an IP address across the archive: total scans, unique URLs, first and last seen, geolocation, ASN and organisation, BGP and DNS data; paginated.No findings

    Why it is in this group

    • The name "get_ip_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get statistics for an IP address across the archive: total scans, unique URLs, first and last seen, geolocation, ASN and organisation, BGP and DNS data; paginated.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get IP Stats
  • get_jarm_signaturesGet the JARM TLS server fingerprints measured for the hosts in one scan, with whether each matches a known signature.No findings

    Why it is in this group

    • The name "get_jarm_signatures" says "get": a word for reading.
    Description, as the server wrote it
    Get the JARM TLS server fingerprints measured for the hosts in one scan, with whether each matches a known signature. A shared JARM often points to the same server software or hosting platform, so it is a weak pivot on its own. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JARM Signatures
  • get_jarm_statsGet JARM statistics across the archive, including the most common signatures.No findings

    Why it is in this group

    • The name "get_jarm_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get JARM statistics across the archive, including the most common signatures. Common signatures usually belong to large hosting platforms.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JARM Stats
  • get_js_fingerprintsList the JavaScript files a scanned page loaded, each with its fingerprint: hashes (SHA-256, SHA-1, MD5, normalized and fuzzy), size metrics, detected library and bundler.No findings

    Why it is in this group

    • The name "get_js_fingerprints" says "get": a word for reading.
    Description, as the server wrote it
    List the JavaScript files a scanned page loaded, each with its fingerprint: hashes (SHA-256, SHA-1, MD5, normalized and fuzzy), size metrics, detected library and bundler. The include_* options add function lists, HTTP headers or ML vector details. Useful for collecting script hashes to search for elsewhere. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Fingerprints
  • get_js_library_inventoryList the JavaScript libraries and versions detected across the archive, with how many scans used each; library filters to one library and min_count drops rare versions.No findings

    Why it is in this group

    • The name "get_js_library_inventory" says "get": a word for reading.
    Description, as the server wrote it
    List the JavaScript libraries and versions detected across the archive, with how many scans used each; library filters to one library and min_count drops rare versions. Identifiers are lowercase names such as 'react', 'jquery' or 'nextjs'.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Library Inventory
  • get_js_runtime_behaviourGet the runtime JavaScript behaviour recorded for one scan: overall risk, risk scores, number of scripts, eval and Function-constructor calls and high-risk events, with a behaviour…No findings

    Why it is in this group

    • The name "get_js_runtime_behaviour" says "get": a word for reading.
    Description, as the server wrote it
    Get the runtime JavaScript behaviour recorded for one scan: overall risk, risk scores, number of scripts, eval and Function-constructor calls and high-risk events, with a behavioural signature and composite hash. include_detailed_events adds the individual events. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Runtime JS Behaviour
  • get_js_runtime_coverageGet how many scans have runtime JavaScript fingerprints: coverage percentage and the number of unique composite hashes and signatures.No findings

    Why it is in this group

    • The name "get_js_runtime_coverage" says "get": a word for reading.
    Description, as the server wrote it
    Get how many scans have runtime JavaScript fingerprints: coverage percentage and the number of unique composite hashes and signatures. Describes the service, not a scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Runtime JS Analysis Coverage
  • get_js_runtime_healthCheck whether the runtime JavaScript analysis service is up, with its version.No findings

    Why it is in this group

    • The name "get_js_runtime_health" says "get": a word for reading.
    Description, as the server wrote it
    Check whether the runtime JavaScript analysis service is up, with its version.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Check Runtime JS Analysis Health
  • get_js_runtime_statsGet platform-wide statistics for runtime JavaScript analysis: risk distribution, averages and totals of eval calls and high-risk events.No findings

    Why it is in this group

    • The name "get_js_runtime_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get platform-wide statistics for runtime JavaScript analysis: risk distribution, averages and totals of eval calls and high-risk events. Describes the service, not a scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Runtime JS Behaviour Stats
  • get_js_segments_by_scanList the code segments (functions and blocks) extracted from one scan's JavaScript, each with location, length, snippet and hashes; script_url narrows to one file, paginated with l…No findings

    Why it is in this group

    • The name "get_js_segments_by_scan" says "get": a word for reading.
    Description, as the server wrote it
    List the code segments (functions and blocks) extracted from one scan's JavaScript, each with location, length, snippet and hashes; script_url narrows to one file, paginated with limit and offset. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Segments By Scan
  • get_js_segments_suspiciousList the JavaScript code segments from one scan scored as suspicious, above min_risk_score, with location, snippet and risk details; paginated with limit and offset.No findings

    Why it is in this group

    • The name "get_js_segments_suspicious" says "get": a word for reading.
    Description, as the server wrote it
    List the JavaScript code segments from one scan scored as suspicious, above min_risk_score, with location, snippet and risk details; paginated with limit and offset. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Segments Suspicious
  • get_js_segments_unknownList the JavaScript code segments from one scan that match no known library, at least min_code_length long; these are usually the page's own or a kit's code.No findings

    Why it is in this group

    • The name "get_js_segments_unknown" says "get": a word for reading.
    Description, as the server wrote it
    List the JavaScript code segments from one scan that match no known library, at least min_code_length long; these are usually the page's own or a kit's code. Paginated with limit and offset. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Segments Unknown
  • get_jsfingerprintGet one JavaScript fingerprint record by its numeric fingerprint_id: the script URL, scan, hashes, metrics and ML vector information; include_functions and include_http_headers add…No findings

    Why it is in this group

    • The name "get_jsfingerprint" says "get": a word for reading.
    Description, as the server wrote it
    Get one JavaScript fingerprint record by its numeric fingerprint_id: the script URL, scan, hashes, metrics and ML vector information; include_functions and include_http_headers add more detail.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Fingerprint
  • get_jsfingerprint_bundle_statsGet statistics on bundled JavaScript across the archive for a date range: share of bundled files and the breakdown by bundler (webpack, vite, rollup and so on) and module format.No findings

    Why it is in this group

    • The name "get_jsfingerprint_bundle_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get statistics on bundled JavaScript across the archive for a date range: share of bundled files and the breakdown by bundler (webpack, vite, rollup and so on) and module format.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Fingerprint Bundle Stats
  • get_jsfingerprint_hash_prevalenceFor each script in one scan, report how common its hash is across the archive, which separates widely used library files from rare, page-specific code.No findings

    Why it is in this group

    • The name "get_jsfingerprint_hash_prevalence" says "get": a word for reading.
    Description, as the server wrote it
    For each script in one scan, report how common its hash is across the archive, which separates widely used library files from rare, page-specific code. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Fingerprint Hash Prevalence
  • get_jsfingerprint_library_statsGet statistics on JavaScript library detection across the archive for a date range: total fingerprints, detection rate and the most common libraries.No findings

    Why it is in this group

    • The name "get_jsfingerprint_library_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get statistics on JavaScript library detection across the archive for a date range: total fingerprints, detection rate and the most common libraries.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Fingerprint Library Stats
  • get_jsfingerprint_similarFind JavaScript files whose fingerprint is similar to the one with this fingerprint_id, above threshold (0 to 1), paginated with limit and offset.No findings

    Why it is in this group

    • The name "get_jsfingerprint_similar" says "get": a word for reading.
    Description, as the server wrote it
    Find JavaScript files whose fingerprint is similar to the one with this fingerprint_id, above threshold (0 to 1), paginated with limit and offset. exclude_same_scan drops matches from the same scan. Useful for finding variants of one script.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Fingerprint Similar
  • get_jsfingerprint_similarity_countsCount how many archived JavaScript files are similar to the one with this fingerprint_id, per similarity model (composite, CodeBERT, GraphCodeBERT, AST and handcrafted features), c…No findings

    Why it is in this group

    • The name "get_jsfingerprint_similarity_counts" says "get": a word for reading.
    Description, as the server wrote it
    Count how many archived JavaScript files are similar to the one with this fingerprint_id, per similarity model (composite, CodeBERT, GraphCodeBERT, AST and handcrafted features), capped at max_count. This query can take up to 90 seconds by default.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Fingerprint Similarity Counts
  • get_jsfingerprint_sourceGet the stored source code of one JavaScript file by its numeric fingerprint_id, with its SHA-256, URL and length.No findings

    Why it is in this group

    • The name "get_jsfingerprint_source" says "get": a word for reading.
    Description, as the server wrote it
    Get the stored source code of one JavaScript file by its numeric fingerprint_id, with its SHA-256, URL and length. Source can be long.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get JS Fingerprint Source
  • get_latest_capabilitiesGet the current size of ScanMalware's detection content: indicator count, malware detection rules and ClamAV signatures.No findings

    Why it is in this group

    • The name "get_latest_capabilities" says "get": a word for reading.
    Description, as the server wrote it
    Get the current size of ScanMalware's detection content: indicator count, malware detection rules and ClamAV signatures.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Latest Capabilities
  • get_malware_by_scanGet the malware detections for files the scanned page delivered, with threat names, detection counts and the detection source.No findings

    Why it is in this group

    • The name "get_malware_by_scan" says "get": a word for reading.
    Description, as the server wrote it
    Get the malware detections for files the scanned page delivered, with threat names, detection counts and the detection source. Empty when nothing was detected. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Malware By Scan
  • get_malware_statsGet malware detection statistics across the archive: overall and last-24-hour counts, top threats and hourly trend.No findings

    Why it is in this group

    • The name "get_malware_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get malware detection statistics across the archive: overall and last-24-hour counts, top threats and hourly trend.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Malware Stats
  • get_netlogDescribe the network log (Chrome NetLog) for a scan_id: whether one exists, its size, and its encoding.No findings

    Why it is in this group

    • The name "get_netlog" says "get": a word for reading.
    Description, as the server wrote it
    Describe the network log (Chrome NetLog) for a scan_id: whether one exists, its size, and its encoding. The log itself is not returned - these are routinely tens of megabytes gzipped.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Network Log Info
  • get_ocr_by_scanGet the text read by OCR from the scan's screenshot, with language, confidence, word and character counts and any regions flagged as suspicious.No findings

    Why it is in this group

    • The name "get_ocr_by_scan" says "get": a word for reading.
    Description, as the server wrote it
    Get the text read by OCR from the scan's screenshot, with language, confidence, word and character counts and any regions flagged as suspicious. Useful when page text is drawn as images. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get OCR By Scan
  • get_ocr_statsGet OCR statistics across the archive: scans with OCR text, average confidence and length, language distribution and daily counts.No findings

    Why it is in this group

    • The name "get_ocr_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get OCR statistics across the archive: scans with OCR text, average confidence and length, language distribution and daily counts.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get OCR Stats
  • get_open_graphGet the Open Graph and Twitter card metadata the scanned page declared (title, description, image, site name).No findings

    Why it is in this group

    • The name "get_open_graph" says "get": a word for reading.
    Description, as the server wrote it
    Get the Open Graph and Twitter card metadata the scanned page declared (title, description, image, site name). Phishing pages often copy a brand's metadata. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Open Graph
  • get_pastejackingGet pastejacking findings for one scan: attempts by the page to replace what a visitor copies, a common trick for making victims paste malicious commands.No findings

    Why it is in this group

    • The name "get_pastejacking" says "get": a word for reading.
    Description, as the server wrote it
    Get pastejacking findings for one scan: attempts by the page to replace what a visitor copies, a common trick for making victims paste malicious commands. Includes a detected flag and a note. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Pastejacking
  • get_pcap_metadataDescribe the packet capture (PCAP) recorded during one scan: whether it exists, its size, compression and content type.No findings

    Why it is in this group

    • The name "get_pcap_metadata" says "get": a word for reading.
    Description, as the server wrote it
    Describe the packet capture (PCAP) recorded during one scan: whether it exists, its size, compression and content type. The capture itself is not returned. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get PCAP Metadata
  • get_platform_statsGet the current scan queue length, running scans and scans completed in the last 24 hours by visibility.No findings

    Why it is in this group

    • The name "get_platform_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get the current scan queue length, running scans and scans completed in the last 24 hours by visibility.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Platform Stats
  • get_rdapGet registration data (RDAP) for the scanned domain and its IP addresses: registrar, registration and expiry dates, domain age, nameservers and status.No findings

    Why it is in this group

    • The name "get_rdap" says "get": a word for reading.
    Description, as the server wrote it
    Get registration data (RDAP) for the scanned domain and its IP addresses: registrar, registration and expiry dates, domain age, nameservers and status. A very young domain is a common phishing signal. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get RDAP
  • get_recent_scansList the most recent public scans, newest first (paginated with page and limit).No findings

    Why it is in this group

    • The name "get_recent_scans" says "get": a word for reading.
    Description, as the server wrote it
    List the most recent public scans, newest first (paginated with page and limit). Each row has the scan ID, URL, status, visibility and submission time. Unlisted and private scans are never included.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Recent Scans
  • get_recent_threatsList malware threats detected in scans during the last hours (default window set by the API), with totals and grouping by threat.No findings

    Why it is in this group

    • The name "get_recent_threats" says "get": a word for reading.
    Description, as the server wrote it
    List malware threats detected in scans during the last hours (default window set by the API), with totals and grouping by threat.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Recent Threats
  • get_recent_yara_threatsList YARA rule matches from scans in the last hours, each with the scan, URL, rule, category, severity and confidence.No findings

    Why it is in this group

    • The name "get_recent_yara_threats" says "get": a word for reading.
    Description, as the server wrote it
    List YARA rule matches from scans in the last hours, each with the scan, URL, rule, category, severity and confidence.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Recent YARA Threats
  • get_safe_browsingGet Google Safe Browsing threats found for the URLs in one scan, with a has_threats flag.No findings

    Why it is in this group

    • The name "get_safe_browsing" says "get": a word for reading.
    Description, as the server wrote it
    Get Google Safe Browsing threats found for the URLs in one scan, with a has_threats flag. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Safe Browsing
  • get_safe_browsing_statsGet Google Safe Browsing statistics across the archive: total threats, threats in the last 7 days, scans with threats and threat types.No findings

    Why it is in this group

    • The name "get_safe_browsing_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get Google Safe Browsing statistics across the archive: total threats, threats in the last 7 days, scans with threats and threat types.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Safe Browsing Stats
  • get_scan_iocCheck one scan against threat-intelligence indicator feeds: matching IP addresses and domains the page contacted, the threat types, and a summary of total and unique matches.No findings

    Why it is in this group

    • The name "get_scan_ioc" says "get": a word for reading.
    Description, as the server wrote it
    Check one scan against threat-intelligence indicator feeds: matching IP addresses and domains the page contacted, the threat types, and a summary of total and unique matches. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Scan IOC
  • get_scan_progressGet the progress of a running scan: current step, total steps, step name, percentage and status.No findings

    Why it is in this group

    • The name "get_scan_progress" says "get": a word for reading.
    Description, as the server wrote it
    Get the progress of a running scan: current step, total steps, step name, percentage and status. Useful for checking whether a scan has finished before reading its results. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Scan Progress
  • get_scan_reportsList the user reports and votes filed about one scan (for example marked safe or malicious), with the total count; report_type filters by kind.No findings

    Why it is in this group

    • The name "get_scan_reports" says "get": a word for reading.
    Description, as the server wrote it
    List the user reports and votes filed about one scan (for example marked safe or malicious), with the total count; report_type filters by kind. Empty when nobody has reported the scan. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Scan Reports
  • get_scan_resultGet the full result document of one scan: URLs and redirects, page title, load times, links, network requests, IP addresses, JavaScript files, TLS, fuzzy hashes, screenshot hashes,…No findings

    Why it is in this group

    • The name "get_scan_result" says "get": a word for reading.
    Description, as the server wrote it
    Get the full result document of one scan: URLs and redirects, page title, load times, links, network requests, IP addresses, JavaScript files, TLS, fuzzy hashes, screenshot hashes, favicon and the security verdict. The response is large; the compact summary is enough for a verdict. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Scan Result
  • get_scan_summaryGet a compact summary of one scan: submitted URL, final URL after redirects, status, completion time and the security verdict (verdict text, risk level, confidence and risk factors…No findings

    Why it is in this group

    • The name "get_scan_summary" says "get": a word for reading.
    Description, as the server wrote it
    Get a compact summary of one scan: submitted URL, final URL after redirects, status, completion time and the security verdict (verdict text, risk level, confidence and risk factors). Useful as the first look at a scan; the verdict is empty for a few seconds after a scan completes. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Scan Summary
  • get_screenshot_statsGet screenshot statistics across the archive: total screenshots, hash coverage and the distribution of perceptual hash types.No findings

    Why it is in this group

    • The name "get_screenshot_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get screenshot statistics across the archive: total screenshots, hash coverage and the distribution of perceptual hash types.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Screenshot Stats
  • get_technologies_by_scanList the web technologies detected on a scanned page (frameworks, CMS, CDN, analytics and so on), with versions where known.No findings

    Why it is in this group

    • The name "get_technologies_by_scan" says "get": a word for reading.
    Description, as the server wrote it
    List the web technologies detected on a scanned page (frameworks, CMS, CDN, analytics and so on), with versions where known. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Technologies By Scan
  • get_technology_combinationsList the technologies most often detected together with a given technology, with counts; min_occurrences drops rare pairs; paginated.No findings

    Why it is in this group

    • The name "get_technology_combinations" says "get": a word for reading.
    Description, as the server wrote it
    List the technologies most often detected together with a given technology, with counts; min_occurrences drops rare pairs; paginated.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Technology Combinations
  • get_technology_statsGet technology detection statistics across the archive: unique technologies, total detections and counts per category.No findings

    Why it is in this group

    • The name "get_technology_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get technology detection statistics across the archive: unique technologies, total detections and counts per category. This aggregate query can take up to 90 seconds by default.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Technology Stats
  • get_tls_asn1Get the raw ASN.1 structure of the TLS certificate from one scan, for detailed certificate inspection.No findings

    Why it is in this group

    • The name "get_tls_asn1" says "get": a word for reading.
    Description, as the server wrote it
    Get the raw ASN.1 structure of the TLS certificate from one scan, for detailed certificate inspection. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get TLS ASN1
  • get_tls_detailsGet the TLS certificate the scanned site presented: subject, issuer, validity dates, whether it was valid or expired, and related details.No findings

    Why it is in this group

    • The name "get_tls_details" says "get": a word for reading.
    Description, as the server wrote it
    Get the TLS certificate the scanned site presented: subject, issuer, validity dates, whether it was valid or expired, and related details. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get TLS Details
  • get_top_tracking_keysList the tracking and site keys seen on the most sites (analytics IDs, CAPTCHA keys and so on), with the tracker name, category and site count; tracker_type filters by kind.No findings

    Why it is in this group

    • The name "get_top_tracking_keys" says "get": a word for reading.
    Description, as the server wrote it
    List the tracking and site keys seen on the most sites (analytics IDs, CAPTCHA keys and so on), with the tracker name, category and site count; tracker_type filters by kind.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get Top Tracking Keys
  • get_yara_by_scanGet YARA rule matches for one scan, with a summary by severity (critical, high, medium, low) and category.No findings

    Why it is in this group

    • The name "get_yara_by_scan" says "get": a word for reading.
    Description, as the server wrote it
    Get YARA rule matches for one scan, with a summary by severity (critical, high, medium, low) and category. Empty when no rule matched. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get YARA By Scan
  • get_yara_matchesGet the YARA rule matches recorded for one scan, with the matching rules and a summary by severity and category.No findings

    Why it is in this group

    • The name "get_yara_matches" says "get": a word for reading.
    Description, as the server wrote it
    Get the YARA rule matches recorded for one scan, with the matching rules and a summary by severity and category. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get YARA Matches
  • get_yara_statsGet YARA statistics across the archive: overall and last-24-hour matches, severity and category distribution and top threats.No findings

    Why it is in this group

    • The name "get_yara_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get YARA statistics across the archive: overall and last-24-hour matches, severity and category distribution and top threats.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Get YARA Stats
  • search_ai_classificationList scans whose AI analysis gave a specific classification: LEGITIMATE, LOW_RISK, MODERATE_RISK, HIGH_RISK or CONFIRMED_SCAM.No findings

    Why it is in this group

    • The name "search_ai_classification" says "search": a word for reading.
    Description, as the server wrote it
    List scans whose AI analysis gave a specific classification: LEGITIMATE, LOW_RISK, MODERATE_RISK, HIGH_RISK or CONFIRMED_SCAM. Each result has the URL, title, submission time and the analysis.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search AI Classification
  • search_ai_high_riskList scans that the AI analysis rated high risk, optionally above min_risk_score and min_confidence, each with URL, title and the analysis.No findings

    Why it is in this group

    • The name "search_ai_high_risk" says "search": a word for reading.
    Description, as the server wrote it
    List scans that the AI analysis rated high risk, optionally above min_risk_score and min_confidence, each with URL, title and the analysis. min_risk_score is on the AI's 0-10 risk scale (default 7) and min_confidence is a 0-100 percentage (default 70).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search AI High Risk
  • search_ai_scam_typeList scans whose AI analysis named a given scam type, such as 'Phishing', each with URL, title, submission time and the analysis (verdict, classification, risk score).No findings

    Why it is in this group

    • The name "search_ai_scam_type" says "search": a word for reading.
    Description, as the server wrote it
    List scans whose AI analysis named a given scam type, such as 'Phishing', each with URL, title, submission time and the analysis (verdict, classification, risk score). The match is on the scam type text the analysis produced.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search AI Scam Type
  • search_analyzer_high_riskList scans that the security analyzer scored as high risk, highest first (paginated), each with URL, risk score, verdict, confidence and analysis time.No findings

    Why it is in this group

    • The name "search_analyzer_high_risk" says "search": a word for reading.
    Description, as the server wrote it
    List scans that the security analyzer scored as high risk, highest first (paginated), each with URL, risk score, verdict, confidence and analysis time. min_risk_score raises the threshold.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search Analyzer High Risk
  • search_by_asnGet what the archive knows about an autonomous system (ASN number, without 'AS'): organisation, total scans, unique URLs, first and last seen and BGP prefixes; paginated.No findings

    Why it is in this group

    • The name "search_by_asn" says "search": a word for reading.
    Description, as the server wrote it
    Get what the archive knows about an autonomous system (ASN number, without 'AS'): organisation, total scans, unique URLs, first and last seen and BGP prefixes; paginated.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search By ASN
  • search_by_faviconSearch scans by favicon hash (paginated): a mmh3 hash by default, or the favicon's MD5 with hash_type='md5'.No findings

    Why it is in this group

    • The name "search_by_favicon" says "search": a word for reading.
    Description, as the server wrote it
    Search scans by favicon hash (paginated): a mmh3 hash by default, or the favicon's MD5 with hash_type='md5'.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search By Favicon
  • search_by_fuzzy_hashList scans whose page content has a similar fuzzy hash (hash_type tlsh, ssdeep or sdhash; the value comes from a scan result), each with URL, title and time; paginated.No findings

    Why it is in this group

    • The name "search_by_fuzzy_hash" says "search": a word for reading.
    Description, as the server wrote it
    List scans whose page content has a similar fuzzy hash (hash_type tlsh, ssdeep or sdhash; the value comes from a scan result), each with URL, title and time; paginated. Useful for finding near-identical copies of a page.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search By Fuzzy Hash
  • search_by_ipList scans of pages served from an IP address (paginated), each with scan ID, URL and time.No findings

    Why it is in this group

    • The name "search_by_ip" says "search": a word for reading.
    Description, as the server wrote it
    List scans of pages served from an IP address (paginated), each with scan ID, URL and time. On shared hosting and CDNs an IP serves many unrelated sites, so a match is not evidence of a connection.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search By IP
  • search_by_jarmList scans whose server presented this JARM TLS fingerprint (paginated).No findings

    Why it is in this group

    • The name "search_by_jarm" says "search": a word for reading.
    Description, as the server wrote it
    List scans whose server presented this JARM TLS fingerprint (paginated). Large hosting platforms share JARMs across many unrelated sites, so check what the matches have in common.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search By JARM
  • search_by_nameserverList the scanned domains that use a given nameserver, with totals and counts per top-level domain.No findings

    Why it is in this group

    • The name "search_by_nameserver" says "search": a word for reading.
    Description, as the server wrote it
    List the scanned domains that use a given nameserver, with totals and counts per top-level domain. Useful for finding domains registered together.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search By Nameserver
  • search_by_registrarList scans of domains registered through a given registrar (paginated), with the total.No findings

    Why it is in this group

    • The name "search_by_registrar" says "search": a word for reading.
    Description, as the server wrote it
    List scans of domains registered through a given registrar (paginated), with the total. Common registrars match very many domains.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search By Registrar
  • search_by_screenshot_hashList scans whose screenshot has this perceptual hash (hash_type ahash, phash, dhash, whash, color_hash or crop_resistant), optionally within similarity_threshold, each with URL, ti…No findings

    Why it is in this group

    • The name "search_by_screenshot_hash" says "search": a word for reading.
    Description, as the server wrote it
    List scans whose screenshot has this perceptual hash (hash_type ahash, phash, dhash, whash, color_hash or crop_resistant), optionally within similarity_threshold, each with URL, title and time; paginated. Useful for finding pages that look the same.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search By Screenshot Hash
  • search_cpeFind scans with a CPE identifier matching a pattern such as 'cpe:2.3:a:facebook:react' (paginated).No findings

    Why it is in this group

    • The name "search_cpe" says "search": a word for reading.
    Description, as the server wrote it
    Find scans with a CPE identifier matching a pattern such as 'cpe:2.3:a:facebook:react' (paginated). Useful for finding sites running a given product.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search CPE
  • search_favicon_mmh3List scans whose favicon has this mmh3 hash (the same convention as Shodan's http.favicon.hash), each with the page URL, title and favicon details; paginated.No findings

    Why it is in this group

    • The name "search_favicon_mmh3" says "search": a word for reading.
    Description, as the server wrote it
    List scans whose favicon has this mmh3 hash (the same convention as Shodan's http.favicon.hash), each with the page URL, title and favicon details; paginated. Phishing kits often reuse one favicon across many hosts.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search Favicon MMH3
  • search_js_fingerprint_by_bundlerFind JavaScript bundles built with a given bundler (webpack, vite, rollup, esbuild and so on), optionally by bundle format and detection confidence, with totals, format breakdown a…No findings

    Why it is in this group

    • The name "search_js_fingerprint_by_bundler" says "search": a word for reading.
    Description, as the server wrote it
    Find JavaScript bundles built with a given bundler (webpack, vite, rollup, esbuild and so on), optionally by bundle format and detection confidence, with totals, format breakdown and average size; paginated with page and per_page.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint By Bundler
  • search_js_fingerprint_by_cdnFind JavaScript served from a given CDN (for example 'cloudflare' or 'jsdelivr'), with totals, the top serving domains and cache status; unpinned_only keeps scripts loaded without …No findings

    Why it is in this group

    • The name "search_js_fingerprint_by_cdn" says "search": a word for reading.
    Description, as the server wrote it
    Find JavaScript served from a given CDN (for example 'cloudflare' or 'jsdelivr'), with totals, the top serving domains and cache status; unpinned_only keeps scripts loaded without a fixed version.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint By CDN
  • search_js_fingerprint_by_fuzzy_hashFind JavaScript files whose fuzzy hash is close to this one, above min_similarity, up to limit results.No findings

    Why it is in this group

    • The name "search_js_fingerprint_by_fuzzy_hash" says "search": a word for reading.
    Description, as the server wrote it
    Find JavaScript files whose fuzzy hash is close to this one, above min_similarity, up to limit results. Fuzzy hashes match files that differ in small parts, such as a kit with a changed configuration.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint By Fuzzy Hash
  • search_js_fingerprint_by_libraryFind scanned JavaScript detected as a given library (for example 'react', 'jquery' or 'nextjs'; 'Next.js' is accepted for 'nextjs'), optionally one version or a version pattern, wi…No findings

    Why it is in this group

    • The name "search_js_fingerprint_by_library" says "search": a word for reading.
    Description, as the server wrote it
    Find scanned JavaScript detected as a given library (for example 'react', 'jquery' or 'nextjs'; 'Next.js' is accepted for 'nextjs'), optionally one version or a version pattern, with a version breakdown and CDN distribution; paginated with page and per_page.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint By Library
  • search_js_fingerprint_by_library_versionFind scanned JavaScript detected as one exact library version, with the total and the matching scripts; include_deprecated and group_by_url adjust the results.No findings

    Why it is in this group

    • The name "search_js_fingerprint_by_library_version" says "search": a word for reading.
    Description, as the server wrote it
    Find scanned JavaScript detected as one exact library version, with the total and the matching scripts; include_deprecated and group_by_url adjust the results. Useful for finding sites running a vulnerable version.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint By Library Version
  • search_js_fingerprint_by_md5Look up a JavaScript file by MD5 across the archive and report its prevalence: total matches, unique scans, first and last seen, a prevalence label and the matching scripts; includ…No findings

    Why it is in this group

    • The name "search_js_fingerprint_by_md5" says "search": a word for reading.
    Description, as the server wrote it
    Look up a JavaScript file by MD5 across the archive and report its prevalence: total matches, unique scans, first and last seen, a prevalence label and the matching scripts; include_scans adds the scans, from_date and to_date limit the period.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint By MD5
  • search_js_fingerprint_by_normalized_hashLook up JavaScript by normalized hash (computed after whitespace and formatting are removed, so reformatted copies still match) and report prevalence: total matches, unique scans, …No findings

    Why it is in this group

    • The name "search_js_fingerprint_by_normalized_hash" says "search": a word for reading.
    Description, as the server wrote it
    Look up JavaScript by normalized hash (computed after whitespace and formatting are removed, so reformatted copies still match) and report prevalence: total matches, unique scans, first and last seen and the matching scripts.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint By Normalized Hash
  • search_js_fingerprint_by_serverFind JavaScript by the type of web server that served it (for example 'nginx' or 'microsoft'), with the matching scripts; include_headers adds the HTTP headers.No findings

    Why it is in this group

    • The name "search_js_fingerprint_by_server" says "search": a word for reading.
    Description, as the server wrote it
    Find JavaScript by the type of web server that served it (for example 'nginx' or 'microsoft'), with the matching scripts; include_headers adds the HTTP headers. The total can be a lower bound.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint By Server
  • search_js_fingerprint_by_sha1Look up a JavaScript file by SHA-1 across the archive and report its prevalence: total matches, unique scans, first and last seen, a prevalence label and the matching scripts; incl…No findings

    Why it is in this group

    • The name "search_js_fingerprint_by_sha1" says "search": a word for reading.
    Description, as the server wrote it
    Look up a JavaScript file by SHA-1 across the archive and report its prevalence: total matches, unique scans, first and last seen, a prevalence label and the matching scripts; include_scans adds the scans, from_date and to_date limit the period.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint By SHA1
  • search_js_fingerprint_by_sha256Look up a JavaScript file by SHA-256 across the archive and report its prevalence: total matches, unique scans, first and last seen, a prevalence label and the matching scripts; in…No findings

    Why it is in this group

    • The name "search_js_fingerprint_by_sha256" says "search": a word for reading.
    Description, as the server wrote it
    Look up a JavaScript file by SHA-256 across the archive and report its prevalence: total matches, unique scans, first and last seen, a prevalence label and the matching scripts; include_scans adds the scans, from_date and to_date limit the period. A rare hash shared by several phishing pages usually means one kit.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint By SHA256
  • search_js_fingerprint_obfuscatedList scanned JavaScript scored as obfuscated, filtered by score range, classification and minimum code length; exclude_libraries drops known library code.No findings

    Why it is in this group

    • The name "search_js_fingerprint_obfuscated" says "search": a word for reading.
    Description, as the server wrote it
    List scanned JavaScript scored as obfuscated, filtered by score range, classification and minimum code length; exclude_libraries drops known library code. min_score and max_score are obfuscation scores from 0 to 1 (defaults 0.7 and 1.0). Paginated with page and per_page.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint Obfuscated
  • search_js_fingerprint_patternsList scanned JavaScript files that match code-pattern filters: has_eval, has_crypto, high_entropy, no_library and cdn_mismatch, where false selects files without the pattern and fi…No findings

    Why it is in this group

    • The name "search_js_fingerprint_patterns" says "search": a word for reading.
    Description, as the server wrote it
    List scanned JavaScript files that match code-pattern filters: has_eval, has_crypto, high_entropy, no_library and cdn_mismatch, where false selects files without the pattern and filters can be combined. With no filter given, has_eval=true is applied. Each result has the fingerprint ID, scan, script URL, code length, obfuscation score and the patterns detected.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprint Patterns
  • search_js_malware_familiesList groups of scans whose runtime JavaScript behaves alike (possible malware families), with clusters of at least min_cluster_size scans (default 2) at similarity_threshold or abo…No findings

    Why it is in this group

    • The name "search_js_malware_families" says "search": a word for reading.
    Description, as the server wrote it
    List groups of scans whose runtime JavaScript behaves alike (possible malware families), with clusters of at least min_cluster_size scans (default 2) at similarity_threshold or above (0 to 1, default 0.95). When the service has clustering switched off, status is 'disabled' and no families are returned.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Malware Families
  • search_js_obfuscationList scans by the obfuscation signals their runtime JavaScript showed, newest analysis first: overall risk, maximum and average risk score, eval and Function constructor calls and …No findings

    Why it is in this group

    • The name "search_js_obfuscation" says "search": a word for reading.
    Description, as the server wrote it
    List scans by the obfuscation signals their runtime JavaScript showed, newest analysis first: overall risk, maximum and average risk score, eval and Function constructor calls and high-risk events. Optional filters are risk_level (such as 'high' or 'critical'), min_risk_score (0-100) and has_eval; with none, the most recently analysed scans are listed.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Obfuscation
  • search_js_runtime_by_composite_hashFind scans whose runtime JavaScript behaviour has this composite hash, each with the target URL, overall risk and time.No findings

    Why it is in this group

    • The name "search_js_runtime_by_composite_hash" says "search": a word for reading.
    Description, as the server wrote it
    Find scans whose runtime JavaScript behaviour has this composite hash, each with the target URL, overall risk and time. The same composite hash across hosts usually means the same kit.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search Runtime JS Behaviour by Composite Hash
  • search_js_runtime_by_signatureFind scans with this behavioural signature (for example 'setTimeout:30|fetch:4|complex'), each with the target URL, overall risk and time.No findings

    Why it is in this group

    • The name "search_js_runtime_by_signature" says "search": a word for reading.
    Description, as the server wrote it
    Find scans with this behavioural signature (for example 'setTimeout:30|fetch:4|complex'), each with the target URL, overall risk and time. An uncached query can take up to 90 seconds by default.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search Runtime JS Behaviour by Signature
  • search_js_runtime_similarFind scans whose runtime JavaScript behaviour is similar to this scan's, above min_similarity; include_self keeps the scan itself.No findings

    Why it is in this group

    • The name "search_js_runtime_similar" says "search": a word for reading.
    Description, as the server wrote it
    Find scans whose runtime JavaScript behaviour is similar to this scan's, above min_similarity; include_self keeps the scan itself. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Find Similar Runtime JS Behaviour
  • search_js_segments_by_hashFind code segments with this exact code hash across the archive, with the scans and scripts they appear in; paginated with limit and offset.No findings

    Why it is in this group

    • The name "search_js_segments_by_hash" says "search": a word for reading.
    Description, as the server wrote it
    Find code segments with this exact code hash across the archive, with the scans and scripts they appear in; paginated with limit and offset.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Segments By Hash
  • search_js_segments_by_normalized_hashFind code segments with this normalized hash (formatting-independent) across the archive, with the scans and scripts they appear in; paginated with limit and offset.No findings

    Why it is in this group

    • The name "search_js_segments_by_normalized_hash" says "search": a word for reading.
    Description, as the server wrote it
    Find code segments with this normalized hash (formatting-independent) across the archive, with the scans and scripts they appear in; paginated with limit and offset.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Segments By Normalized Hash
  • search_jsfingerprints_by_bundlerPaginated list (limit and offset) of archived script fingerprints built with a given bundler, each with scan, page URL and script URL.No findings

    Why it is in this group

    • The name "search_jsfingerprints_by_bundler" says "search": a word for reading.
    Description, as the server wrote it
    Paginated list (limit and offset) of archived script fingerprints built with a given bundler, each with scan, page URL and script URL.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprints By Bundler
  • search_jsfingerprints_by_fuzzy_hashPaginated list (limit and offset) of archived script fingerprints whose fuzzy hash matches this value, each with scan, page URL and script URL.No findings

    Why it is in this group

    • The name "search_jsfingerprints_by_fuzzy_hash" says "search": a word for reading.
    Description, as the server wrote it
    Paginated list (limit and offset) of archived script fingerprints whose fuzzy hash matches this value, each with scan, page URL and script URL. An empty list means no close match.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprints By Fuzzy Hash
  • search_jsfingerprints_by_libraryPaginated list (limit and offset) of archived script fingerprints detected as a given library, each with scan, page URL, script URL and version.No findings

    Why it is in this group

    • The name "search_jsfingerprints_by_library" says "search": a word for reading.
    Description, as the server wrote it
    Paginated list (limit and offset) of archived script fingerprints detected as a given library, each with scan, page URL, script URL and version.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprints By Library
  • search_jsfingerprints_by_library_versionPaginated list (limit and offset) of archived script fingerprints detected as one library version, each with scan, page URL and script URL.No findings

    Why it is in this group

    • The name "search_jsfingerprints_by_library_version" says "search": a word for reading.
    Description, as the server wrote it
    Paginated list (limit and offset) of archived script fingerprints detected as one library version, each with scan, page URL and script URL.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprints By Library Version
  • search_jsfingerprints_by_md5Paginated list (limit and offset) of archived script fingerprints with this MD5, each with scan, page URL, scan time, script URL and hashes.No findings

    Why it is in this group

    • The name "search_jsfingerprints_by_md5" says "search": a word for reading.
    Description, as the server wrote it
    Paginated list (limit and offset) of archived script fingerprints with this MD5, each with scan, page URL, scan time, script URL and hashes.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprints By MD5
  • search_jsfingerprints_by_normalized_hashPaginated list (limit and offset) of archived script fingerprints with this normalized hash (formatting-independent), each with scan, page URL and script URL.No findings

    Why it is in this group

    • The name "search_jsfingerprints_by_normalized_hash" says "search": a word for reading.
    Description, as the server wrote it
    Paginated list (limit and offset) of archived script fingerprints with this normalized hash (formatting-independent), each with scan, page URL and script URL.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprints By Normalized Hash
  • search_jsfingerprints_by_sha1Paginated list (limit and offset) of archived script fingerprints with this SHA-1, each with scan, page URL, scan time, script URL and hashes.No findings

    Why it is in this group

    • The name "search_jsfingerprints_by_sha1" says "search": a word for reading.
    Description, as the server wrote it
    Paginated list (limit and offset) of archived script fingerprints with this SHA-1, each with scan, page URL, scan time, script URL and hashes.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprints By SHA1
  • search_jsfingerprints_by_sha256Paginated list (limit and offset) of archived script fingerprints with this SHA-256, each with scan, page URL, scan time, script URL and hashes.No findings

    Why it is in this group

    • The name "search_jsfingerprints_by_sha256" says "search": a word for reading.
    Description, as the server wrote it
    Paginated list (limit and offset) of archived script fingerprints with this SHA-256, each with scan, page URL, scan time, script URL and hashes.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search JS Fingerprints By SHA256
  • search_ocrSearch OCR text (paginated).No findings

    Why it is in this group

    • The name "search_ocr" says "search": a word for reading.
    Description, as the server wrote it
    Search OCR text (paginated). q must contain at least 3 characters after trimming. This query can take up to 90 seconds by default.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search OCR
  • search_ocr_patternSearch the text read by OCR from scan screenshots for a pattern (paginated); case_sensitive controls matching.No findings

    Why it is in this group

    • The name "search_ocr_pattern" says "search": a word for reading.
    Description, as the server wrote it
    Search the text read by OCR from scan screenshots for a pattern (paginated); case_sensitive controls matching. Useful for finding pages that show the same lure text as an image.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search OCR Pattern
  • search_scansSearch the archive of public scans by text in the URL, domain or page title (paginated); q needs at least 3 characters and search_type narrows the match (default 'all').No findings

    Why it is in this group

    • The name "search_scans" says "search": a word for reading.
    Description, as the server wrote it
    Search the archive of public scans by text in the URL, domain or page title (paginated); q needs at least 3 characters and search_type narrows the match (default 'all'). Each result has the scan ID, URL, status, title, submission time and hosting ASN.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search Scans
  • search_semanticSearch scans by meaning rather than exact words, comparing the query with scanned page content (for example 'bank login page asking for card details').No findings

    Why it is in this group

    • The name "search_semantic" says "search": a word for reading.
    Description, as the server wrote it
    Search scans by meaning rather than exact words, comparing the query with scanned page content (for example 'bank login page asking for card details'). threshold (default 0.7) is the minimum similarity; an empty result means nothing was similar enough.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search Semantic
  • search_similar_scansFind scans that look like this one by screenshot similarity, favicon or fuzzy page hash (methods, default screenshot), each with URL, final URL, title and what it matched by; pagin…No findings

    Why it is in this group

    • The name "search_similar_scans" says "search": a word for reading.
    Description, as the server wrote it
    Find scans that look like this one by screenshot similarity, favicon or fuzzy page hash (methods, default screenshot), each with URL, final URL, title and what it matched by; paginated. Useful for finding copies of a phishing page on other hosts. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search Similar Scans
  • search_similar_screenshotsFind screenshots within max_distance (Hamming distance, default 3) of an integer perceptual hash (hash_type, default phash), each with scan, URL, title, distance and similarity sco…No findings

    Why it is in this group

    • The name "search_similar_screenshots" says "search": a word for reading.
    Description, as the server wrote it
    Find screenshots within max_distance (Hamming distance, default 3) of an integer perceptual hash (hash_type, default phash), each with scan, URL, title, distance and similarity score.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search Similar Screenshots
  • search_suspicious_clipboardList scans where the page wrote suspicious content to the clipboard (for example PowerShell commands), each with URL, event count, reason and time; pattern filters the content; pag…No findings

    Why it is in this group

    • The name "search_suspicious_clipboard" says "search": a word for reading.
    Description, as the server wrote it
    List scans where the page wrote suspicious content to the clipboard (for example PowerShell commands), each with URL, event count, reason and time; pattern filters the content; paginated.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search Suspicious Clipboard
  • search_technologiesSearch the web technologies detected across the archive by name (q) or category, each with how many scans used it and when it was last seen; paginated.No findings

    Why it is in this group

    • The name "search_technologies" says "search": a word for reading.
    Description, as the server wrote it
    Search the web technologies detected across the archive by name (q) or category, each with how many scans used it and when it was last seen; paginated.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search Technologies
  • search_tracking_keyFind scans that embed a given tracking or site key, such as an analytics ID or a CAPTCHA site key (tracker_type and key), sorted latest or oldest; paginated.No findings

    Why it is in this group

    • The name "search_tracking_key" says "search": a word for reading.
    Description, as the server wrote it
    Find scans that embed a given tracking or site key, such as an analytics ID or a CAPTCHA site key (tracker_type and key), sorted latest or oldest; paginated. A shared key often ties sites to one operator.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Search Tracking Key
  • wait_for_scanWait for a submitted scan to finish by polling its status every poll_interval_s seconds, up to timeout_s seconds (default 180).No findings

    Why it is in this group

    • The name "wait_for_scan" says "wait": a word for reading.
    Description, as the server wrote it
    Wait for a submitted scan to finish by polling its status every poll_interval_s seconds, up to timeout_s seconds (default 180). Returns the final compact summary (URL, final URL, status, completion time and the security verdict), or the last known status with timeout set to true if the scan is still running. The security verdict is computed after the scan completes, usually within about a minute: until then verdict_pending is true and the verdict fields are empty, so a risk score of 0 is not yet a verdict. scan_id is the UUID of a ScanMalware scan.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Wait For Scan

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.1.6. Values in angle brackets are yours to fill in.

claude mcp add --transport http scanmalware https://mcp.scanmalware.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__scanmalware__get_recent_scans",
      "mcp__scanmalware__get_scan_summary",
      "mcp__scanmalware__wait_for_scan",
      "mcp__scanmalware__get_scan_result",
      "mcp__scanmalware__search_scans",
      "mcp__scanmalware__get_ai_analysis",
      "mcp__scanmalware__get_scan_progress",
      "mcp__scanmalware__get_scan_ioc",
      "mcp__scanmalware__get_tls_details",
      "mcp__scanmalware__get_tls_asn1",
      "mcp__scanmalware__get_technologies_by_scan",
      "mcp__scanmalware__get_bot_protection",
      "mcp__scanmalware__get_yara_matches",
      "mcp__scanmalware__get_jarm_signatures",
      "mcp__scanmalware__get_analyzer_results",
      "mcp__scanmalware__get_clipboard_events",
      "mcp__scanmalware__get_js_fingerprints",
      "mcp__scanmalware__get_scan_reports",
      "mcp__scanmalware__get_domain_scans",
      "mcp__scanmalware__get_domain_history",
      "mcp__scanmalware__get_domain_stats",
      "mcp__scanmalware__search_by_ip",
      "mcp__scanmalware__get_ip_stats",
      "mcp__scanmalware__search_by_asn",
      "mcp__scanmalware__search_similar_scans",
      "mcp__scanmalware__search_semantic",
      "mcp__scanmalware__search_by_favicon",
      "mcp__scanmalware__search_ai_high_risk",
      "mcp__scanmalware__search_ai_scam_type",
      "mcp__scanmalware__search_ai_classification",
      "mcp__scanmalware__get_analyzer_stats",
      "mcp__scanmalware__search_analyzer_high_risk",
      "mcp__scanmalware__get_favicon",
      "mcp__scanmalware__get_favicon_stats",
      "mcp__scanmalware__get_screenshot_stats",
      "mcp__scanmalware__search_similar_screenshots",
      "mcp__scanmalware__search_ocr",
      "mcp__scanmalware__search_ocr_pattern",
      "mcp__scanmalware__search_by_jarm",
      "mcp__scanmalware__search_by_fuzzy_hash",
      "mcp__scanmalware__search_by_screenshot_hash",
      "mcp__scanmalware__search_suspicious_clipboard",
      "mcp__scanmalware__get_recent_threats",
      "mcp__scanmalware__get_recent_yara_threats",
      "mcp__scanmalware__get_ct_certificates",
      "mcp__scanmalware__get_ct_dns_records",
      "mcp__scanmalware__get_ct_domains_by_ip",
      "mcp__scanmalware__get_ct_similar_domains",
      "mcp__scanmalware__get_ct_timeline",
      "mcp__scanmalware__get_api_root",
      "mcp__scanmalware__get_health",
      "mcp__scanmalware__get_platform_stats",
      "mcp__scanmalware__get_latest_capabilities",
      "mcp__scanmalware__get_capabilities_by_date",
      "mcp__scanmalware__get_clipboard_stats",
      "mcp__scanmalware__get_cpe_stats",
      "mcp__scanmalware__get_cpe_by_scan",
      "mcp__scanmalware__search_cpe",
      "mcp__scanmalware__get_ids_alerts",
      "mcp__scanmalware__get_jarm_stats",
      "mcp__scanmalware__get_malware_stats",
      "mcp__scanmalware__get_malware_by_scan",
      "mcp__scanmalware__get_yara_stats",
      "mcp__scanmalware__get_yara_by_scan",
      "mcp__scanmalware__get_safe_browsing_stats",
      "mcp__scanmalware__get_safe_browsing",
      "mcp__scanmalware__get_top_tracking_keys",
      "mcp__scanmalware__search_tracking_key",
      "mcp__scanmalware__search_technologies",
      "mcp__scanmalware__get_technology_combinations",
      "mcp__scanmalware__get_popular_technologies",
      "mcp__scanmalware__get_technology_stats",
      "mcp__scanmalware__search_by_nameserver",
      "mcp__scanmalware__get_rdap",
      "mcp__scanmalware__search_by_registrar",
      "mcp__scanmalware__get_ocr_stats",
      "mcp__scanmalware__get_ocr_by_scan",
      "mcp__scanmalware__get_open_graph",
      "mcp__scanmalware__get_pastejacking",
      "mcp__scanmalware__get_netlog",
      "mcp__scanmalware__get_pcap_metadata",
      "mcp__scanmalware__search_favicon_mmh3",
      "mcp__scanmalware__get_js_runtime_behaviour",
      "mcp__scanmalware__get_js_runtime_stats",
      "mcp__scanmalware__get_js_runtime_health",
      "mcp__scanmalware__get_js_runtime_coverage",
      "mcp__scanmalware__search_js_obfuscation",
      "mcp__scanmalware__search_js_malware_families",
      "mcp__scanmalware__search_js_runtime_by_composite_hash",
      "mcp__scanmalware__search_js_runtime_by_signature",
      "mcp__scanmalware__search_js_runtime_similar",
      "mcp__scanmalware__get_js_segments_by_scan",
      "mcp__scanmalware__search_js_segments_by_hash",
      "mcp__scanmalware__search_js_segments_by_normalized_hash",
      "mcp__scanmalware__get_js_segments_suspicious",
      "mcp__scanmalware__get_js_segments_unknown",
      "mcp__scanmalware__get_js_library_inventory",
      "mcp__scanmalware__search_js_fingerprint_patterns",
      "mcp__scanmalware__search_js_fingerprint_obfuscated",
      "mcp__scanmalware__search_js_fingerprint_by_server",
      "mcp__scanmalware__search_js_fingerprint_by_bundler",
      "mcp__scanmalware__search_js_fingerprint_by_cdn",
      "mcp__scanmalware__search_js_fingerprint_by_library",
      "mcp__scanmalware__search_js_fingerprint_by_library_version",
      "mcp__scanmalware__search_js_fingerprint_by_fuzzy_hash",
      "mcp__scanmalware__search_js_fingerprint_by_md5",
      "mcp__scanmalware__search_js_fingerprint_by_normalized_hash",
      "mcp__scanmalware__search_js_fingerprint_by_sha1",
      "mcp__scanmalware__search_js_fingerprint_by_sha256",
      "mcp__scanmalware__find_js_fingerprint_similar_by_hash",
      "mcp__scanmalware__search_jsfingerprints_by_bundler",
      "mcp__scanmalware__search_jsfingerprints_by_library",
      "mcp__scanmalware__search_jsfingerprints_by_library_version",
      "mcp__scanmalware__search_jsfingerprints_by_fuzzy_hash",
      "mcp__scanmalware__search_jsfingerprints_by_md5",
      "mcp__scanmalware__search_jsfingerprints_by_normalized_hash",
      "mcp__scanmalware__search_jsfingerprints_by_sha1",
      "mcp__scanmalware__search_jsfingerprints_by_sha256",
      "mcp__scanmalware__get_jsfingerprint",
      "mcp__scanmalware__get_jsfingerprint_similar",
      "mcp__scanmalware__get_jsfingerprint_similarity_counts",
      "mcp__scanmalware__get_jsfingerprint_source",
      "mcp__scanmalware__get_jsfingerprint_bundle_stats",
      "mcp__scanmalware__get_jsfingerprint_library_stats",
      "mcp__scanmalware__get_jsfingerprint_hash_prevalence"
    ],
    "ask": [
      "mcp__scanmalware__submit_scan",
      "mcp__scanmalware__submit_scan_report",
      "mcp__scanmalware__run_js_differential_analysis"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as scanmalware. Review it before you use it.