{"service":"phishunt-mcp","protocol":"Model Context Protocol (MCP)","protocolVersion":"2025-11-25","transport":"HTTP JSON-RPC 2.0 (POST)","endpoint":"https://mcp.phishunt.io/","tools":[{"name":"check_domain","description":"Check whether a domain (or URL substring) appears in the phishunt active phishing feed. Returns matching entries with detection metadata if found, or a 'not found' note otherwise."},{"name":"list_brand_phishings","description":"List active phishing sites targeting a specific brand. Returns the most recent detections with URL, IP, country, cert issuer, hosting org, and detection source flags."},{"name":"get_recent_detections","description":"Retrieve phishing detections since a given date. Useful for delta-syncing a blocklist or threat intel pipeline."},{"name":"get_brand_metadata","description":"Fetch curated metadata for a tracked brand: display name, category, primary domain, an AI-authored characterisation of why the brand tends to be targeted by phishing, and the current count of active phishings. Useful for adding context to brand-specific responses."},{"name":"get_cert_metadata","description":"Fetch factual metadata for a TLS intermediate CA seen on phishing sites: operator, root CA, key type (RSA/ECDSA), typical use case, related sibling intermediates, and the count of active phishings using this intermediate. Helps answer 'I saw cert X in my browser, what is it?' for the most-abused intermediates."},{"name":"search_phishings","description":"Free-text search across active phishing URLs, domains, and IP addresses. Returns matching detections sorted by most recent first_seen. Use for queries like 'show me sites containing steamcommunity', 'phishing on 1.2.3.4', or 'sites with ingdirect in the URL'."},{"name":"analyze_url","description":"Analyze any URL for phishing signals WITHOUT contacting it (passive): live URL-shape heuristics (brand keyword match, typosquat distance, homograph, entropy, abused TLD), phishunt's stored score/verdict if the domain is already known, and historical detections on the same apex domain. Suspicious unknown domains are automatically queued for full pipeline analysis."},{"name":"get_related_infrastructure","description":"Find infrastructure and content overlap between a known phishing indicator and other phishunt detections: shared IP, TLS certificate, nameservers, favicon/screenshot, redirect target, or naming pattern. Surfaces a possible campaign or suspected cluster the indicator belongs to. This is observed technical overlap (related infrastructure), NOT an attribution claim about who operates the sites."},{"name":"get_campaigns","description":"List possible campaigns / suspected clusters: groups of phishing indicators that share infrastructure or content signals (same TLS certificate, IP, hosting, page content, etc.), computed by a daily correlation job. This is shared-infrastructure grouping of public detections, not an attribution claim - clusters are labeled 'possible campaign' or 'suspected cluster' only, never an actor or group."},{"name":"get_campaign","description":"Get full detail on one possible campaign / suspected cluster: evidence breakdown and every member indicator (domain, targeted brand, status, relationship score, detail page). Shared-infrastructure grouping of public detections, not an attribution claim."}],"docs":"https://phishunt.io/api/","license":"CC0-1.0 (data)","source":"https://github.com/0xDanielLopez/phishunt-mcp"}