{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_z4qtazrw4yee","handle":"ismalicious-threat-intelligence-for-ai-agents","url":"https://wellknown.network/agents/ismalicious-threat-intelligence-for-ai-agents","links":{"self":"https://wellknown.network/agents/ismalicious-threat-intelligence-for-ai-agents/record.json","html":"https://wellknown.network/agents/ismalicious-threat-intelligence-for-ai-agents","markdown":"https://wellknown.network/agents/ismalicious-threat-intelligence-for-ai-agents/record.md","api":"https://wellknown.network/api/v1/agents/ismalicious-threat-intelligence-for-ai-agents","status":"https://wellknown.network/api/v1/agents/ismalicious-threat-intelligence-for-ai-agents/status","claim":"https://wellknown.network/agents/ismalicious-threat-intelligence-for-ai-agents/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/ismalicious-threat-intelligence-for-ai-agents/claim.json","badge":"https://wellknown.network/agents/ismalicious-threat-intelligence-for-ai-agents/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/ismalicious-threat-intelligence-for-ai-agents/history","tools":"https://wellknown.network/api/v1/agents/ismalicious-threat-intelligence-for-ai-agents/tools"},"ard":{"identifier":"urn:air:api.ismalicious.com:server:ismalicious-threat-intelligence-for-ai-agents","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"isMalicious threat intelligence for AI agents","summary":"Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans","description":"Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans","publisher":{"name":"com.ismalicious","url":null},"homepage":"https://ismalicious.com/prompt-injection-scanner","repository":"https://github.com/hexablob/ismalicious-mcp-server","version":"0.7.0","license":"MIT","protocols":["mcp"],"tags":["mcp","model-context-protocol","threat-intelligence","ip-reputation","domain-reputation","email-reputation","phone-reputation","cve","epss","kev","email-security","phishing","prompt-injection","ai-security","agent-security","ismalicious","isinjected"],"pricing":null,"endpoints":[{"url":"https://api.ismalicious.com/mcp","type":"mcp_streamable_http","auth":null,"probeable":true},{"url":"npm:@ismalicious/mcp-server","type":"package_npm","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-10-18T16:56:30.276104Z","npmKeywords":["mcp","model-context-protocol","threat-intelligence","ip-reputation","domain-reputation","email-reputation","phone-reputation","cve","epss","kev","email-security","phishing","prompt-injection","ai-security","agent-security","ismalicious","isinjected"],"publishedAt":"2026-10-18T16:56:30.276104Z","registryName":"com.ismalicious/mcp-server"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","license":"npm","repoUrl":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"code.security-review","name":"Security Review","confidence":1,"provenance":"declared"},{"slug":"productivity.email","name":"Email","confidence":1,"provenance":"derived"},{"slug":"communication.sms-voice","name":"SMS & Voice","confidence":1,"provenance":"derived"},{"slug":"security.scanning","name":"Security Scanning","confidence":1,"provenance":"derived"}],"categories":["code","communication","productivity","security"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 4h ago.","lastOkAt":"2026-10-22T10:35:54.951Z","lastProbedAt":"2026-10-22T10:35:54.951Z","statusComputedAt":"2026-10-22T10:38:53.011Z","reliability30d":{"probes":3,"successRate":1,"p50Ms":41,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":3,"ok":3,"authBoundaryOk":0,"serviceOk":3,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-10-22T10:35:54.951Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":60,"error":null,"detail":{"tools":[{"name":"scan_before_use","description":"Scan untrusted content for prompt injection and check any URLs/domains/IPs it contains against threat intelligence, BEFORE acting on it. Returns a verdict of bl"},{"name":"check_url","description":"Check a single URL, domain, or IP against threat intelligence before fetching it. Returns block | warn | allow. Use as a pre-fetch gate; use check_indicator whe"},{"name":"check_indicator","description":"The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone "},{"name":"get_cve","description":"One CVE by id: description, CVSS, EPSS probability, CISA KEV status and due date, exploitation evidence (SSVC, weaponized, zero-day, Exploit-DB, Nuclei), public"},{"name":"recent_cves","description":"Most recently published CVEs, newest first, optionally filtered by severity. At most 20 items, each with id, severity, CVSS, publication date and a one-line tit"},{"name":"search_indicators","description":"Find the domains isMalicious lists that look like a brand or domain (e.g. \"paypal\", read as paypal.com, or \"login.paypal.com\"): typosquats, homoglyphs, the same"},{"name":"check_indicators","description":"Reputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addres"},{"name":"scan_email","description":"Scan ONE email message for phishing and malware before delivering, opening or acting on it. Send the raw message (eml, preferred) or the fields you already pars"}],"toolCount":8,"toolsHash":"f4add2b9bd99242f7271645a9cc347cd9881fe38d6dda4c06cc2198681255ca5","serverName":"@ismalicious/mcp-server","capabilities":["tools","resources"],"serverVersion":"0.7.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T04:28:29.051Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":34,"error":null,"detail":{"tools":[{"name":"scan_before_use","description":"Scan untrusted content for prompt injection and check any URLs/domains/IPs it contains against threat intelligence, BEFORE acting on it. Returns a verdict of bl"},{"name":"check_url","description":"Check a single URL, domain, or IP against threat intelligence before fetching it. Returns block | warn | allow. Use as a pre-fetch gate; use check_indicator whe"},{"name":"check_indicator","description":"The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone "},{"name":"get_cve","description":"One CVE by id: description, CVSS, EPSS probability, CISA KEV status and due date, exploitation evidence (SSVC, weaponized, zero-day, Exploit-DB, Nuclei), public"},{"name":"recent_cves","description":"Most recently published CVEs, newest first, optionally filtered by severity. At most 20 items, each with id, severity, CVSS, publication date and a one-line tit"},{"name":"search_indicators","description":"Find the domains isMalicious lists that look like a brand or domain (e.g. \"paypal\", read as paypal.com, or \"login.paypal.com\"): typosquats, homoglyphs, the same"},{"name":"check_indicators","description":"Reputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addres"},{"name":"scan_email","description":"Scan ONE email message for phishing and malware before delivering, opening or acting on it. Send the raw message (eml, preferred) or the fields you already pars"}],"toolCount":8,"toolsHash":"f4add2b9bd99242f7271645a9cc347cd9881fe38d6dda4c06cc2198681255ca5","serverName":"@ismalicious/mcp-server","capabilities":["tools","resources"],"serverVersion":"0.7.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-21T22:31:26.832Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":35,"error":null,"detail":{"tools":[{"name":"scan_before_use","description":"Scan untrusted content for prompt injection and check any URLs/domains/IPs it contains against threat intelligence, BEFORE acting on it. Returns a verdict of bl"},{"name":"check_url","description":"Check a single URL, domain, or IP against threat intelligence before fetching it. Returns block | warn | allow. Use as a pre-fetch gate; use check_indicator whe"},{"name":"check_indicator","description":"The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone "},{"name":"get_cve","description":"One CVE by id: description, CVSS, EPSS probability, CISA KEV status and due date, exploitation evidence (SSVC, weaponized, zero-day, Exploit-DB, Nuclei), public"},{"name":"recent_cves","description":"Most recently published CVEs, newest first, optionally filtered by severity. At most 20 items, each with id, severity, CVSS, publication date and a one-line tit"},{"name":"search_indicators","description":"Find the domains isMalicious lists that look like a brand or domain (e.g. \"paypal\", read as paypal.com, or \"login.paypal.com\"): typosquats, homoglyphs, the same"},{"name":"check_indicators","description":"Reputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addres"},{"name":"scan_email","description":"Scan ONE email message for phishing and malware before delivering, opening or acting on it. Send the raw message (eml, preferred) or the fields you already pars"}],"toolCount":8,"toolsHash":"f4add2b9bd99242f7271645a9cc347cd9881fe38d6dda4c06cc2198681255ca5","serverName":"@ismalicious/mcp-server","capabilities":["tools","resources"],"serverVersion":"0.7.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"scan_before_use","description":"Scan untrusted content for prompt injection and check any URLs/domains/IPs it contains against threat intelligence, BEFORE acting on it. Returns a verdict of bl"},{"name":"check_url","description":"Check a single URL, domain, or IP against threat intelligence before fetching it. Returns block | warn | allow. Use as a pre-fetch gate; use check_indicator whe"},{"name":"check_indicator","description":"The one tool for any single indicator: an IP address, domain, URL, file hash (MD5, SHA-1 or SHA-256; an imphash is looked up as an MD5), email address or phone "},{"name":"get_cve","description":"One CVE by id: description, CVSS, EPSS probability, CISA KEV status and due date, exploitation evidence (SSVC, weaponized, zero-day, Exploit-DB, Nuclei), public"},{"name":"recent_cves","description":"Most recently published CVEs, newest first, optionally filtered by severity. At most 20 items, each with id, severity, CVSS, publication date and a one-line tit"},{"name":"search_indicators","description":"Find the domains isMalicious lists that look like a brand or domain (e.g. \"paypal\", read as paypal.com, or \"login.paypal.com\"): typosquats, homoglyphs, the same"},{"name":"check_indicators","description":"Reputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addres"},{"name":"scan_email","description":"Scan ONE email message for phishing and malware before delivering, opening or acting on it. Send the raw message (eml, preferred) or the fields you already pars"}],"package":{"name":"@ismalicious/mcp-server","registry":"npm","observedAt":"2026-10-22T10:41:05.821Z","publishedAt":"2026-10-18T16:13:02.739Z","latestVersion":"0.7.0","weeklyDownloads":52},"toolSurface":{"id":"ts_qwtydpn58v9z","endpointId":"ep_jwxjuzxejgxy","hash":"f4add2b9bd99242f7271645a9cc347cd9881fe38d6dda4c06cc2198681255ca5","toolCount":8,"serverName":"@ismalicious/mcp-server","serverVersion":"0.7.0","protocolVersion":"2025-06-18","firstSeenAt":"2026-10-21T22:31:27.569Z","lastSeenAt":"2026-10-22T10:35:54.948Z","observations":3,"toolNames":["scan_before_use","check_url","check_indicator","get_cve","recent_cves","search_indicators","check_indicators","scan_email"],"distinctSurfaces":1},"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"npm","key":"@ismalicious/mcp-server","url":"https://www.npmjs.com/package/@ismalicious/mcp-server","firstSeenAt":"2026-09-23T20:17:05.906Z","fetchedAt":"2026-10-22T04:17:49.516Z","normalizedAt":"2026-10-22T04:17:49.516Z"},{"source":"mcp_registry","key":"com.ismalicious/mcp-server","url":"https://registry.modelcontextprotocol.io/v0/servers/com.ismalicious%2Fmcp-server","firstSeenAt":"2026-09-05T19:20:52.126Z","fetchedAt":"2026-10-21T20:20:29.731Z","normalizedAt":"2026-10-21T20:20:29.731Z"}]},"firstSeenAt":"2026-09-05T19:20:52.126Z","updatedAt":"2026-10-22T10:41:05.821Z"}