ScanMalware.com URL Scanner
com.scanmalware.mcp/scanmalware-mcp
MCP server for ScanMalware.com URL scanning, malware detection, and analysis.
— the operator's own registry description reported
Publisher com.scanmalware.mcp · first seen
2026-08-12 · endpoint https://mcp.scanmalware.com/mcp
Dependency rating derived
allow — rich-solo — safe to depend on
Cluster rich-solo · distinctiveness 0.755 (unusual). Every figure is a percentile or class within the 11,094-server census — see the whole spectrum.
Reach — can an agent get to it?
answersalive_tools
latency314 ms
vs populationtypical
protocolcurrent
authopen
Use — can it use it?
tools128
vs populationhigh
capabilities4
harnessC
Trust — can it rely on it?
identitysolo
servers on its host1
verifiabilityunassessed
duplicate inventoryno
drift events0
answers trueno primary
🔏 Signed receipt rr_1d32bc844dbce4891e2c38ae · ed25519 · key rs-rcpt-2026-08 — this rating is tamper-evident; an agent gets the full signature from check_server and can verify it against the published key.
Tools last seen
find_js_fingerprint_similar_by_hash get_ai_analysis get_analyzer_results get_analyzer_stats get_api_root get_bot_protection get_capabilities_by_date get_clipboard_events get_clipboard_stats get_cpe_by_scan get_cpe_stats get_ct_certificates get_ct_dns_records get_ct_domains_by_ip get_ct_similar_domains get_ct_timeline get_domain_history get_domain_scans get_domain_stats get_favicon get_favicon_stats get_health get_ids_alerts get_ip_stats get_jarm_signatures get_jarm_stats get_js_fingerprinter2 get_js_fingerprinter2_coverage get_js_fingerprinter2_health get_js_fingerprinter2_stats get_js_fingerprints get_js_library_inventory get_js_segments_by_scan get_js_segments_suspicious get_js_segments_unknown get_jsfingerprint get_jsfingerprint_bundle_stats get_jsfingerprint_hash_prevalence get_jsfingerprint_library_stats get_jsfingerprint_similar get_jsfingerprint_similarity_counts get_jsfingerprint_source get_latest_capabilities get_malware_by_scan get_malware_stats get_netlog get_ocr_by_scan get_ocr_stats get_open_graph get_pastejacking get_pcap_metadata get_platform_stats get_popular_technologies get_rdap get_recent_scans get_recent_threats get_recent_yara_threats get_safe_browsing get_safe_browsing_stats get_scan_ioc get_scan_progress get_scan_reports get_scan_result get_scan_summary get_screenshot_stats get_technologies_by_scan get_technology_combinations get_technology_stats get_tls_asn1 get_tls_details get_top_tracking_keys get_yara_by_scan get_yara_matches get_yara_stats run_js_differential_analysis search_ai_classification search_ai_high_risk search_ai_scam_type search_analyzer_high_risk search_by_asn search_by_favicon search_by_fuzzy_hash search_by_ip search_by_jarm search_by_nameserver search_by_registrar search_by_screenshot_hash search_cpe search_favicon_mmh3 search_js_fingerprint_by_bundler search_js_fingerprint_by_cdn search_js_fingerprint_by_fuzzy_hash search_js_fingerprint_by_library search_js_fingerprint_by_library_version search_js_fingerprint_by_md5 search_js_fingerprint_by_normalized_hash search_js_fingerprint_by_server search_js_fingerprint_by_sha1 search_js_fingerprint_by_sha256 search_js_fingerprint_obfuscated search_js_fingerprint_patterns search_js_fingerprinter2_composite_hash search_js_fingerprinter2_signature search_js_fingerprinter2_similar search_js_malware_families search_js_obfuscation search_js_segments_by_hash search_js_segments_by_normalized_hash search_jsfingerprints_by_bundler search_jsfingerprints_by_fuzzy_hash search_jsfingerprints_by_library search_jsfingerprints_by_library_version search_jsfingerprints_by_md5 search_jsfingerprints_by_normalized_hash search_jsfingerprints_by_sha1 search_jsfingerprints_by_sha256 search_ocr search_ocr_pattern search_scans search_semantic search_similar_scans search_similar_screenshots search_suspicious_clipboard search_technologies search_tracking_key submit_scan submit_scan_report wait_for_scan
Harness readiness observed
Can an agent's harness pick this tool and call it correctly? Graded on the three things an agent reads — name, description, typed parameters. Band C — callable but under-described.
128 of 128 tools graded · 128 with a captured input schema. RS-008, Tier-1 — no domain knowledge, applies to any tool. “Alive” is not the same as “usable”.
Truth checks observed
Not in the Tier-2 trade lane, or not yet checked. Tier-2 re-derives a server's answers against published primary sources — see truth checks.
Protocol conformance observed
2025-06-18
protocol version
1.25.0
server version ScanMalware MCP
Capabilities: experimental prompts resources tools
Drift
No confirmed drift on record. Baseline set 2026-08-14; changes appear here after human review.
History observed
Every probe we made, oldest → newest
(2 shown, 2026-08-12 → 2026-08-14). Green answered · amber answered-but-walled ·
red no useful answer. A gap in our cadence is a gap in coverage, not evidence about the server.
changelog
(1 events)
raw probe
records
Watch or embed this verdict
Operators: put the live verdict in your README —
it updates with every census, links back here, and is a dated observation, never a warranty:
[](https://robinsaige.com/s/com.scanmalware.mcp/scanmalware-mcp)
Depend on it? Subscribe to its
change feed — outcome changes and confirmed drift, no account needed. Building on it?
The full dossier as JSON — verdict, rating, truth checks,
history — stable enough to gate CI on.
← overview