isMalicious threat intelligence for AI agents MCP server

What it does

Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans

Description as published by the publisher in the official MCP Registry, read 14 Nov 2026. Not written or verified by Few Servers.

Facts

Install

• Remote endpoint (streamable-http), as published: https://api.ismalicious.com/mcp
• npm package, as published: @ismalicious/mcp-server · version 0.8.0 · transport stdio

  npx -y @ismalicious/mcp-server

  Standard run command for npm packages. The registry publishes the package name, not a command; check the repository for required arguments.

Install details read from the registry record on 11 Nov 2026. We have not run this server.

Keys and settings

Needs a key or token: the registry record marks a secret value as required. Declared by the publisher:

• Authorization (header, secret, required): Bearer <apiKey>:<apiSecret>, the key pair from https://ismalicious.com/app/account. Every tool but check_password_exposure (local only) and bootstrap_key.
• ISMALICIOUS_API_KEY (environment variable, secret, not marked required): API key from https://ismalicious.com/app/account. Optional: without it the server starts in bootstrap mode and offers bootstrap_key.
• ISMALICIOUS_API_SECRET (environment variable, secret, not marked required): API secret paired with the key
• ISMALICIOUS_API_BASE (environment variable, not marked required): API base URL (defaults to https://ismalicious.com/api; https://api.ismalicious.com reaches the API host directly)
• ISMALICIOUS_TIMEOUT_MS (environment variable, not marked required): Replaces every tool's timeout, in milliseconds (defaults: gate 15000, check_indicator 25000, CVE and exploited_cves 10000, search_indicators 20000, check_indica
• ISMALICIOUS_WEB_BASE (environment variable, not marked required): Base URL for bootstrap_key, a route only https://ismalicious.com/api serves (defaults to ISMALICIOUS_API_BASE, or https://ismalicious.com/api when that is api.i
• ISMALICIOUS_CACHE_TTL_S (environment variable, not marked required): Result cache: 0 turns it off; N caps every tool's cache lifetime at N seconds (never raises one)
• ISMALICIOUS_PREWARM (environment variable, not marked required): 0 (or false, off, no) skips the one unauthenticated GET /health sent after initialize to open the connection

Links

RepositoryWebsiteRegistry record (JSON)npm package

Being listed is not a safety check. Read the repository and check what a server asks for before you connect it. How the directory works.