ScanMalware
Claude connectorCommunityScan URLs in a sandboxed browser and pivot across an archive of past scans by domain, IP, ASN, JARM, favicon hash or JavaScript fingerprint.
- Tools
- 128
exposed by this connector
Movement
From our daily snapshots over the last 30 days.
Rank by popularity
Rank by trending score
Popularity score
Trending score
In its categories
How this connector compares with others in the same category. Positions are counted within the category, not across the whole directory.
Data analytics1,565th of 1,936 by popularity · not ranked by trending score
This connector isn’t ranked by trending score, so the category’s top connectors are shown instead.
| # | Connector | Trending | Popularity | 7d |
|---|---|---|---|---|
| 1 | 6,048,830 | — | ||
| 2 |  TEXT TO QUANT | 5,128,156 | — | |
| 3 |  Etherscan | 3,037,347 | — | |
| 4 |  Keel | 2,221,248 | 21places up | |
| 5 | 2,079,337 | — | ||
| 6 |  Coinversa Pulse | 1,956,519 | 9places down | |
| 7 | 1,503,432 | 18places up |
Developer tools743rd of 934 by popularity · not ranked by trending score
| # | Connector | Popularity | Trending | 7d |
|---|---|---|---|---|
| 740 |  mcp.usenysa.com | 3,000 | 627places down | |
| 741 |  NetPilot | 3,000 | — | |
| 742 |  Offline Protocol | 3,000 | 424places down | |
| 743 | ScanMalwareThis page | 3,000 | — | |
| 744 | 3,000 | — | ||
| 745 |  StewAI | 3,000 | 560places down | |
| 746 |  TalktoWP | 3,000 | 424places down |
This connector isn’t ranked by trending score, so the category’s top connectors are shown instead.
| # | Connector | Trending | Popularity | 7d |
|---|---|---|---|---|
| 1 |  Namecheap | 8,217,214 | — | |
| 2 | TEXT TO QUANT | 5,128,156 | — | |
| 3 | Etherscan | 3,037,347 | — | |
| 4 |  Spaceship | 2,508,810 | — | |
| 5 | Coinversa Pulse | 1,956,519 | 9places down | |
| 6 |  Search1API | 1,271,178 | 1places down | |
| 7 |  allsvgicons | 914,345 | — |
ScanMalware renders URLs in a sandboxed headless browser and keeps every scan in a searchable archive. This connector lets Claude ask what the archive already knows about a domain, URL or IP address, and pivot from one suspicious page to related infrastructure.
What it can do:
- Read a scan's verdict and risk factors, network requests, IOCs, TLS and JARM details, detected technologies, YARA matches, OCR text and RDAP data.
- Find related scans by domain, IP, ASN, JARM signature, favicon hash, screenshot hash, TLSH/ssdeep/sdhash fuzzy hash, OCR text, tracking keys or JavaScript fingerprint.
- Look up Certificate Transparency records for a domain or IP.
- Submit a new URL for scanning and wait for the result.
126 of the 128 tools are read-only. The two write tools submit a URL for scanning and vote on a scan as safe or malicious. Every new scan must declare its visibility: "public" publishes the URL and its results in the public feed, while "unlisted" keeps them out of public listings.
No account or API key is needed. ScanMalware is operated by Triop AB in Sweden.
Tools
- find_js_fingerprint_similar_by_hash
- get_ai_analysis
- get_analyzer_results
- get_analyzer_stats
- get_api_root
- get_bot_protection
- get_capabilities_by_date
- get_clipboard_events
- get_clipboard_stats
- get_cpe_by_scan
- get_cpe_stats
- get_ct_certificates
- get_ct_dns_records
- get_ct_domains_by_ip
- get_ct_similar_domains
- get_ct_timeline
- get_domain_history
- get_domain_scans
Show all 128Show fewer
- get_domain_stats
- get_favicon
- get_favicon_stats
- get_health
- get_ids_alerts
- get_ip_stats
- get_jarm_signatures
- get_jarm_stats
- get_js_fingerprinter2
- get_js_fingerprinter2_coverage
- get_js_fingerprinter2_health
- get_js_fingerprinter2_stats
- get_js_fingerprints
- get_js_library_inventory
- get_js_segments_by_scan
- get_js_segments_suspicious
- get_js_segments_unknown
- get_jsfingerprint
- get_jsfingerprint_bundle_stats
- get_jsfingerprint_hash_prevalence
- get_jsfingerprint_library_stats
- get_jsfingerprint_similar
- get_jsfingerprint_similarity_counts
- get_jsfingerprint_source
- get_latest_capabilities
- get_malware_by_scan
- get_malware_stats
- get_netlog
- get_ocr_by_scan
- get_ocr_stats
- get_open_graph
- get_pastejacking
- get_pcap_metadata
- get_platform_stats
- get_popular_technologies
- get_rdap
- get_recent_scans
- get_recent_threats
- get_recent_yara_threats
- get_safe_browsing
- get_safe_browsing_stats
- get_scan_ioc
- get_scan_progress
- get_scan_reports
- get_scan_result
- get_scan_summary
- get_screenshot_stats
- get_technologies_by_scan
- get_technology_combinations
- get_technology_stats
- get_tls_asn1
- get_tls_details
- get_top_tracking_keys
- get_yara_by_scan
- get_yara_matches
- get_yara_stats
- run_js_differential_analysis
- search_ai_classification
- search_ai_high_risk
- search_ai_scam_type
- search_analyzer_high_risk
- search_by_asn
- search_by_favicon
- search_by_fuzzy_hash
- search_by_ip
- search_by_jarm
- search_by_nameserver
- search_by_registrar
- search_by_screenshot_hash
- search_cpe
- search_favicon_mmh3
- search_js_fingerprint_by_bundler
- search_js_fingerprint_by_cdn
- search_js_fingerprint_by_fuzzy_hash
- search_js_fingerprint_by_library
- search_js_fingerprint_by_library_version
- search_js_fingerprint_by_md5
- search_js_fingerprint_by_normalized_hash
- search_js_fingerprint_by_server
- search_js_fingerprint_by_sha1
- search_js_fingerprint_by_sha256
- search_js_fingerprint_obfuscated
- search_js_fingerprint_patterns
- search_js_fingerprinter2_composite_hash
- search_js_fingerprinter2_signature
- search_js_fingerprinter2_similar
- search_js_malware_families
- search_js_obfuscation
- search_js_segments_by_hash
- search_js_segments_by_normalized_hash
- search_jsfingerprints_by_bundler
- search_jsfingerprints_by_fuzzy_hash
- search_jsfingerprints_by_library
- search_jsfingerprints_by_library_version
- search_jsfingerprints_by_md5
- search_jsfingerprints_by_normalized_hash
- search_jsfingerprints_by_sha1
- search_jsfingerprints_by_sha256
- search_ocr
- search_ocr_pattern
- search_scans
- search_semantic
- search_similar_scans
- search_similar_screenshots
- search_suspicious_clipboard
- search_technologies
- search_tracking_key
- submit_scan
- submit_scan_report
- wait_for_scan
- Categories
- Sign-in
- Not required
- Connector URL
- https://mcp.scanmalware.com/mcp
- Transport
- Streamable HTTP
- Works with
- Claude, Claude API, Claude Code, Claude Desktop
- Added
- October 7, 2026
- More info