Search / io.github.pipeworx-io/urlhaus
Urlhaus
R0· no sign-inURLhaus MCP — wraps abuse.ch URLhaus malware URL database (free, no auth)
v0.1.2 · active · repository · website · descriptor JSON · versions
Search / io.github.pipeworx-io/urlhaus
R0· no sign-inURLhaus MCP — wraps abuse.ch URLhaus malware URL database (free, no auth)
v0.1.2 · active · repository · website · descriptor JSON · versions
{
"mcpServers": {
"urlhaus": {
"type": "http",
"url": "https://gateway.pipeworx.io/urlhaus/mcp"
}
}
}claude mcp add --transport http urlhaus https://gateway.pipeworx.io/urlhaus/mcp[mcp_servers.urlhaus]
url = "https://gateway.pipeworx.io/urlhaus/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"urlhaus": {
"type": "remote",
"url": "https://gateway.pipeworx.io/urlhaus/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"urlhaus": {
"type": "http",
"url": "https://gateway.pipeworx.io/urlhaus/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=urlhaus&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vZ2F0ZXdheS5waXBld29yeC5pby91cmxoYXVzL21jcCJ9"
}{
"servers": {
"urlhaus": {
"type": "http",
"url": "https://gateway.pipeworx.io/urlhaus/mcp"
}
}
}{
"mcpServers": {
"urlhaus": {
"httpUrl": "https://gateway.pipeworx.io/urlhaus/mcp"
}
}
}extensions:
"urlhaus":
enabled: true
name: "urlhaus"
type: streamable_http
uri: "https://gateway.pipeworx.io/urlhaus/mcp"
timeout: 300
Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.
protocol.modernnewest supported version is 2025-03-26; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)stability.changes, stability.rug_pulltool list unknowndeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageresolution_auditremovedExtract the settlement clause of a single Polymarket or Kalshi market: who publishes the settling number (source), the clock time + timezone it is taken at, the precision of the computation (e.g. "1-minute candle close" vs "60-second trailing average" vs "election outcome"), the evidence standard (official_source | consensus_reporting | any_credible_report | unspecified), and void_handling (cancellation/postponement settlement — reused verbatim from bet_research's cancellation_rule detector, not re-derived). Parses Polymarket's `description` field (fetched via polymarket_market) or Kalshi's `rules_primary` + `rules_secondary` fields (fetched via kalshi_market) with regex + a small vocabulary — no LLM pass, so an unusual clause reports confidence:"low" rather than a guess. Pass `market` as a Polymarket slug/URL or a Kalshi market ticker (e.g. "KXBTCD-26SEP1317-T66999.99"); a Kalshi EVENT ticker (e.g. "KXBTCD-26SEP1317") also works — it picks one representative market under that event, since the settlement mechanism is normally shared across all strikes/legs in one event. Use this before treating a polymarket_kalshi_spread row as a real arbitrage: two ladders that look alike can settle on different sources, at different times, with different precision — this tool is how you check. Pair with resolution_diff to compare two markets directly. KNOWN GAP: idiosyncratic phrasing that doesn't match the vocabulary returns confidence:"low" and evidence_standard:"unspecified" rather than an LLM-guessed answer.
lookup_payloadremovedLook up a malware payload file by its MD5 or SHA256 hash in the URLhaus database. Returns file type, size, first/last seen dates, and associated delivery URLs.
get_recentremovedGet a list of recently submitted malware URLs from URLhaus. Useful for monitoring the latest threats.
lookup_hostremovedLook up a hostname or IP address in the URLhaus database to find associated malware URLs. Returns all known malicious URLs hosted on that host.
lookup_urlremovedLook up a URL in the URLhaus malware database to check if it is known to host or distribute malware. Returns threat category, status, blacklist status, and tags.
recallremovedRetrieve a value previously saved via remember, or list all saved keys (omit the key argument). Use to look up context the agent stored earlier — the user's target ticker, an address, prior research notes — without re-deriving it from scratch. Scoped to your identifier (anonymous IP, BYO key hash, or account ID). Pair with remember to save, forget to delete.
rememberremovedSave data the agent will need to reuse later — across this conversation or across sessions. Use when you discover something worth carrying forward (a resolved ticker, a target address, a user preference, a research subject) so you don't have to look it up again. Stored as a key-value pair scoped by your identifier. Authenticated users get persistent memory; anonymous sessions retain memory for 24 hours. Pair with recall to retrieve later, forget to delete.
scan_competitor_ai_presenceremovedCompare AI visibility across multiple entities side-by-side. Probes each entity (your brand + N competitors) with ai_visibility_check, ranks by score, surfaces which is most/least recognized. Useful for competitive AI-marketing audits: "does Claude know about us as well as our competitors?". Returns ranked list with score, confidence, signal density per entity.
pipeworx_trendingremovedWhat other AI agents are calling on Pipeworx right now. Returns the top tools, top packs, and total call volume over a recent window (24h, 7d, or 30d). Useful for: (1) discovering what data sources are hot for current events, (2) confirming a popular tool is the canonical choice before asking your own question, (3) seeing whether your use case aligns with what most agents need. Self-aggregating signal — derived from CF analytics-engine, no PII, just (pack, tool, count). Cached 5min-1h depending on window.
classify_rowremovedCheap categorization: given a company and a list of candidate labels, decide which labels apply — the most common GTM/AI usage shape (tagging a list by industry, ICP fit, etc.), one small model call. Same evidence contract as research_row: each label comes back {label, applies, evidence_url, quote, status: found|inferred|not_established} — "found" only when the model's quote is independently verified as a verbatim substring of the text used. Pass text directly (cheapest — no fetch) or entity.domain to fetch the homepage once as a fallback. No text and no domain means every label is not_established with no model call made.
Showing the latest 10. Full history: list_changes · trend: quality JSON.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +website +reachable +uptime-98% +updated-24d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://gateway.pipeworx.io/urlhaus/mcp streamable-http | none | yes | 98% | 33 ms | 2025-03-26 | 2026-10-20 |
No tools observed. Tools appear once a credential-free probe can list them.
Schemas: list_tools.
And 1,855 more from this publisher.
{
"name": "io.github.pipeworx-io/urlhaus",
"title": "Urlhaus",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://gateway.pipeworx.io/urlhaus/mcp",
"type": "streamable-http"
}
],
"version": "0.1.2",
"repository": {
"url": "https://github.com/pipeworx-io/mcp-urlhaus",
"source": "github"
},
"websiteUrl": "https://pipeworx.io/packs/urlhaus",
"description": "URLhaus MCP — wraps abuse.ch URLhaus malware URL database (free, no auth)"
}