@ismalicious/mcp-server

@ismalicious/mcp-server

A zero-dependency Model Context Protocol server that gives an AI agent isMalicious threat intelligence: reputation verdicts for indicators, the CVE catalog, and the isinjected gate that scans untrusted content for prompt injection before the agent acts on it.

Install

{
  "mcpServers": {
    "ismalicious": {
      "command": "npx",
      "args": ["-y", "@ismalicious/mcp-server"],
      "env": {
        "ISMALICIOUS_API_KEY": "your-api-key",
        "ISMALICIOUS_API_SECRET": "your-api-secret"
      }
    }
  }
}

Keys: https://ismalicious.com/app/account. Free keys exist. Without the two variables the server still starts, offering only bootstrap_key, which mints a free key from an email address and uses it for the session (see below).

Registry name: com.ismalicious/mcp-server (https://registry.modelcontextprotocol.io/v0/servers?search=ismalicious).

Tools

Tool	What it answers	Cost
scan_before_use	Prompt-injection scan plus link reputation over a block of untrusted text. block | warn | allow.	1 scan
check_url	Reputation of one URL, domain or IP before fetching it. block | warn | allow.	1 scan
check_indicator	Full reputation picture of an IP, domain, URL or hash: verdict (malicious/suspicious/clean/unknown), a headline you can relay verbatim, recommendedAction (block/review/allow/unverified), risk 0-100, citing blocklists, first/last seen, network, registration, known CVEs. Under 4 KB.	1 request
get_cve	One CVE by id: description, CVSS, EPSS, CISA KEV status and due date, exploitation evidence, references. The only CVE path.	1 request
recent_cves	Latest CVEs, optional severity, at most 20.	1 request
bootstrap_key	Only without a configured key: mint a free key from an email, one per IP per day.	—

Scans and requests are two meters: https://ismalicious.com/api-docs.

check_indicator example

{
  "indicator": "45.148.10.242",
  "type": "ip",
  "verdict": "malicious",
  "headline": "45.148.10.242 is flagged malicious by 7 sources (scanner); risk 78/100; seen from 2026-06-02 to 2026-09-01.",
  "recommendedAction": "block",
  "malicious": true,
  "risk": { "score": 78, "level": "high" },
  "reputation": {
    "malicious": 7,
    "suspicious": 0,
    "harmless": 0,
    "undetected": 0
  },
  "blocklist": {
    "hits": 7,
    "listed": true,
    "sources": [{ "name": "…", "category": "ip" }]
  },
  "network": { "countryCode": "NL", "asn": "AS…", "org": "…" },
  "flags": {
    "delisted": false,
    "knownGood": false,
    "microsoftTenant": false,
    "ransomware": false,
    "relatedInfrastructure": true
  },
  "reportUrl": "https://ismalicious.com/report?query=45.148.10.242"
}

Errors

Every failure is a result with isError: true and this body:

{
  "error": "rate_limited",
  "status": 429,
  "message": "Rate limit exceeded",
  "quota": {
    "kind": "burst",
    "limit": 60,
    "remaining": 0,
    "plan": "FREE",
    "retry_after": 30,
    "resets_at": "…"
  },
  "hint": "Wait 30s before retrying."
}

error is one of rate_limited, unauthorized, forbidden, not_found, bad_request, upstream_error, timeout, network_error, invalid_params. quota.kind is burst, monthly, daily, scans or issuance. A 401 says whether no key is configured or the configured one was refused.

Timeouts and cancellation

Gate tools 15 s, check_indicator 25 s, CVE tools 10 s, bootstrap_key 15 s. ISMALICIOUS_TIMEOUT_MS replaces all of them. A notifications/cancelled from the client aborts the HTTP call; the cancelled request gets no response.

Resource

ismalicious://quota (application/json): the scan meter from GET /gate/quota and the request-quota headers seen on the last billed call of this session.

Environment

Variable	Meaning
ISMALICIOUS_API_KEY, ISMALICIOUS_API_SECRET	Key pair; optional (bootstrap mode without them).
ISMALICIOUS_API_BASE	Defaults to https://ismalicious.com/api.
ISMALICIOUS_TIMEOUT_MS	Overrides every tool timeout.

Development

pnpm --filter @ismalicious/mcp-server typecheck test build
node packages/mcp-server/scripts/check-version.mjs   # versions and server.json shape
node packages/mcp-server/scripts/smoke.mjs           # stdio end-to-end against a stub API

The version is declared once in src/version.ts. See PUBLISHING.md for npm and the MCP registry; CHANGELOG.md for what changed.