{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_9vy5stcbcuh9","handle":"ohey-research","url":"https://wellknown.network/agents/ohey-research","links":{"self":"https://wellknown.network/agents/ohey-research/record.json","html":"https://wellknown.network/agents/ohey-research","markdown":"https://wellknown.network/agents/ohey-research/record.md","api":"https://wellknown.network/api/v1/agents/ohey-research","status":"https://wellknown.network/api/v1/agents/ohey-research/status","claim":"https://wellknown.network/agents/ohey-research/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/ohey-research/claim.json","badge":"https://wellknown.network/agents/ohey-research/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/ohey-research/history","tools":"https://wellknown.network/api/v1/agents/ohey-research/tools"},"ard":{"identifier":"urn:air:ohey.ca:server:ohey-research","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"Ohey research","summary":"Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.","description":"Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.","publisher":{"name":"ca.ohey","url":null},"homepage":"https://ohey.ca/threats/","repository":"https://github.com/Oheyresearch/ohey-mcp","version":"1.0.0","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://ohey.ca/mcp/research","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-11-04T11:58:49.90103Z","publishedAt":"2026-11-04T11:58:49.90103Z","registryName":"ca.ohey/research"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","repoUrl":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"documents.contracts","name":"Contracts & Legal","confidence":0.938,"provenance":"derived"},{"slug":"content.writing","name":"Writing & Editing","confidence":0.51,"provenance":"derived"}],"categories":["content","documents"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 18m ago.","lastOkAt":"2026-11-05T17:26:42.229Z","lastProbedAt":"2026-11-05T17:26:42.229Z","statusComputedAt":"2026-11-05T17:30:00.304Z","reliability30d":{"probes":4,"successRate":1,"p50Ms":208,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":4,"ok":4,"authBoundaryOk":0,"serviceOk":4,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-11-05T17:26:42.229Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":91,"error":null,"detail":{"tools":[{"name":"list_threats","description":"Every technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits with names and site co"},{"name":"get_threat","description":"A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and"},{"name":"list_research_articles","description":"Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facts and indicators."},{"name":"get_article","description":"One research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defanged as published. Rea"},{"name":"search_etherhiding_contracts","description":"Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when "},{"name":"get_etherhiding_contract","description":"One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as an array, one entry "},{"name":"get_feed_stats","description":"The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed a"},{"name":"search_clickfix_commands","description":"Hosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kits credited with eac"}],"toolCount":8,"toolsHash":"ad477acc76b0b3b9e99d5bb77052324844461b052d5154616eedf30f43f80957","serverName":"ohey-research","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-11-05T08:26:47.417Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":556,"error":null,"detail":{"tools":[{"name":"list_threats","description":"Every technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits with names and site co"},{"name":"get_threat","description":"A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and"},{"name":"list_research_articles","description":"Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facts and indicators."},{"name":"get_article","description":"One research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defanged as published. Rea"},{"name":"search_etherhiding_contracts","description":"Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when "},{"name":"get_etherhiding_contract","description":"One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as an array, one entry "},{"name":"get_feed_stats","description":"The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed a"},{"name":"search_clickfix_commands","description":"Hosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kits credited with eac"}],"toolCount":8,"toolsHash":"73f2d1262451d17413f2aa3fcfb3e7efbe0054534962145f4412fdfe55f6f099","serverName":"ohey-research","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-11-05T00:26:20.594Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":324,"error":null,"detail":{"tools":[{"name":"list_threats","description":"Every technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits with names and site co"},{"name":"get_threat","description":"A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and"},{"name":"list_research_articles","description":"Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facts and indicators."},{"name":"get_article","description":"One research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defanged as published. Rea"},{"name":"search_etherhiding_contracts","description":"Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when "},{"name":"get_etherhiding_contract","description":"One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as an array, one entry "},{"name":"get_feed_stats","description":"The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed a"},{"name":"search_clickfix_commands","description":"Hosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kits credited with eac"}],"toolCount":8,"toolsHash":"73f2d1262451d17413f2aa3fcfb3e7efbe0054534962145f4412fdfe55f6f099","serverName":"ohey-research","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-11-04T16:24:49.386Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":68,"error":null,"detail":{"tools":[{"name":"list_threats","description":"Every technique Ohey publishes, with its page, a summary, site counts and its kits."},{"name":"get_threat","description":"A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and"},{"name":"list_research_articles","description":"Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators."},{"name":"search_etherhiding_contracts","description":"Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when "},{"name":"get_etherhiding_contract","description":"One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it."},{"name":"get_feed_stats","description":"The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed a"},{"name":"search_clickfix_commands","description":"Hosts that ClickFix lure commands download from, as the ClickFix command tracker lists them, busiest first: the kits credited with each, sites whose captured co"}],"toolCount":7,"toolsHash":"0d9a75c8901908db155471f5025831240161c89ddc12aaca0c24e6e205077b11","serverName":"ohey-research","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"list_threats","description":"Every technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits with names and site co"},{"name":"get_threat","description":"A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and"},{"name":"list_research_articles","description":"Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facts and indicators."},{"name":"get_article","description":"One research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defanged as published. Rea"},{"name":"search_etherhiding_contracts","description":"Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when "},{"name":"get_etherhiding_contract","description":"One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as an array, one entry "},{"name":"get_feed_stats","description":"The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed a"},{"name":"search_clickfix_commands","description":"Hosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kits credited with eac"}],"package":null,"toolSurface":{"id":"ts_6eszys5z7ema","endpointId":"ep_bwwabpjvu59m","hash":"ad477acc76b0b3b9e99d5bb77052324844461b052d5154616eedf30f43f80957","toolCount":8,"serverName":"ohey-research","serverVersion":"1.0.0","protocolVersion":"2025-06-18","firstSeenAt":"2026-11-05T17:26:42.226Z","lastSeenAt":"2026-11-05T17:26:42.226Z","observations":1,"toolNames":["list_threats","get_threat","list_research_articles","get_article","search_etherhiding_contracts","get_etherhiding_contract","get_feed_stats","search_clickfix_commands"],"distinctSurfaces":3},"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"ca.ohey/research","url":"https://registry.modelcontextprotocol.io/v0/servers/ca.ohey%2Fresearch","firstSeenAt":"2026-11-04T14:17:38.122Z","fetchedAt":"2026-11-04T14:17:38.122Z","normalizedAt":"2026-11-04T14:17:38.122Z"}]},"firstSeenAt":"2026-11-04T14:17:38.122Z","updatedAt":"2026-11-05T17:31:23.722Z"}