ScanMalware plugin

Investigate phishing and malicious URLs with ScanMalware from Claude Code, Codex and Gemini CLI. ScanMalware renders URLs in a sandboxed browser and keeps every public scan in a searchable archive. This plugin connects your agent to that archive and teaches it how to turn one phishing URL into the rest of its campaign.

No account or API key is needed.

What it adds

• The ScanMalware MCP server (https://mcp.scanmalware.com/mcp, remote, no sign-in): 128 tools, 126 of them read-only. Read a scan's verdict, network requests, IOCs, TLS and JARM details, detected technologies, YARA matches, OCR text and RDAP data; find related scans by domain, IP, ASN, JARM, favicon hash, screenshot hash, TLSH/ssdeep/sdhash fuzzy hash, OCR text, tracking key or JavaScript fingerprint; look up Certificate Transparency records; submit a new URL for scanning. The two write tools submit a URL for scanning and vote on a scan as safe or malicious.

• The skill pivoting-phishing-infrastructure-with-scanmalware: a procedure for expanding one phishing URL into its sibling hosts, and for avoiding the two mistakes that produce wrong conclusions:

  • giving a domain a verdict that belongs to someone else: a lure that only redirected to it (common for the brands phishing kits imitate), or another tenant's subdomain on a shared platform such as github.io or pages.dev;
  • blocking on a pivot that describes a hosting platform rather than an actor (shared IPs, ASNs and JARM fingerprints).

  Besides kit artifacts (script hashes, inline scripts included, favicon, screenshot, title), it pivots on the operator's own account keys, such as an analytics ID or a live-chat license in the page source, which follow the operator across kit rebuilds and hosting platforms. It includes scripts/agent.py (Python standard library only), whose related subcommand turns the pivots into a host list, and a report template.

Install

Claude Code

/plugin marketplace add scanmalware/scanmalware-plugin
/plugin install scanmalware@scanmalware

The skill appears as scanmalware:pivoting-phishing-infrastructure-with-scanmalware.

Codex

codex plugin marketplace add scanmalware/scanmalware-plugin
codex plugin add scanmalware@scanmalware

Gemini CLI

gemini extensions install https://github.com/scanmalware/scanmalware-plugin

Only the MCP server

In Claude, ScanMalware is also listed in the connectors directory. Any MCP client can connect to https://mcp.scanmalware.com/mcp over streamable HTTP without credentials.

What this plugin sends, and where

• MCP tool calls go to mcp.scanmalware.com, run by Triop AB. Each call sends its arguments (URLs, domains, IP addresses, hashes, scan IDs) there, and the server forwards them to the ScanMalware API at scanmalware.com. Requests are logged as described in the MCP server privacy policy.
• The skill's commands and scripts/agent.py call the ScanMalware REST API at https://scanmalware.com/api/v1 directly, anonymously. They send the URLs, domains and hashes you investigate, and no credentials.
• Submitting a URL makes ScanMalware's scanner visit it, which the site's operator can see. A public scan lists the URL and its results in the public feed, visible to anyone and to search engines; an unlisted scan is reachable only through its link; a private scan needs a ScanMalware account. The MCP submit_scan tool requires you to choose; the REST API uses public when the choice is left out. Use unlisted for client targets and anything carrying a victim's email address or token.
• The plugin runs no hooks, installs no packages and reads no environment variables.

ScanMalware's own terms and privacy policy: https://scanmalware.com/terms, https://scanmalware.com/privacy.

Support

Questions and bug reports: GitHub issues or https://scanmalware.com/contact. The MCP server's source is at scanmalware/mcp-server.

License

Apache-2.0. ScanMalware is operated by Triop AB, Sweden.