PhishTank MCP Server

An MCP (Model Context Protocol) server that provides access to PhishTank, a collaborative clearing house for data and information about phishing on the Internet. PhishTank is operated by Cisco Talos Intelligence Group and provides real-time phishing URL verification and comprehensive phishing databases.

The server also offers optional Google Safe Browsing lookups as a second, complementary threat source. See Why a second source? below.

Features

URL Verification: Check if URLs are in PhishTank's phishing database
Batch Processing: Check multiple URLs with intelligent rate limiting
Database Access: Access to comprehensive phishing URL database
Search & Filter: Search phishing URLs by target, date, or verification status
Statistics: Get phishing trends and target analysis
Caching: Smart caching to reduce API calls and improve performance
Rate Limiting: Respects PhishTank's rate limits with automatic throttling
Google Safe Browsing (optional): Cross-check URLs against Google's malware/phishing/unwanted-software database
Multi-Source Verdicts: Combine PhishTank and Safe Browsing into a single verdict with clear per-source attribution

Why a second source?

PhishTank has been showing signs of decline as a standalone data source:

New user registration has been closed since 2020, limiting who can submit and verify phish.
The service has been reported to be undergoing a ground-up rebuild, with uncertain timelines.
PhishTank's own API surface (checkurl plus the bulk database download) is already fully covered by this server's original 7 tools — there isn't more PhishTank-specific ground to add.

Rather than add more tools against a shrinking data source, this server adds Google Safe Browsing (v4 Lookup API): a broad-coverage, real-time, industry-standard threat database with a free tier. The two sources use independent detection pipelines, so checking both gives more reliable cross-verification than either alone. PhishTank-only tools are unaffected and keep working exactly as before, with or without Safe Browsing configured.

Available Tools

1. `check_url`

Check if a single URL is in PhishTank's phishing database.

Parameters:

url (required): The URL to check (must include protocol)
format (optional): Response format ('json', 'xml', 'php', default: 'json')

Example:

{
  "url": "https://suspicious-site.com/login",
  "format": "json"
}

2. `check_multiple_urls`

Check multiple URLs with intelligent rate limiting.

Parameters:

urls (required): Array of URLs to check (max 50)
delay (optional): Delay between requests in milliseconds (500-10000, default: 1000)

Example:

{
  "urls": [
    "https://example1.com",
    "https://example2.com"
  ],
  "delay": 1500
}

3. `get_recent_phish`

Get recent verified phishing URLs from the database.

Parameters:

limit (optional): Number of entries to return (1-1000, default: 100)
include_offline (optional): Include offline phishing URLs (default: false)

4. `search_phish_by_target`

Search phishing URLs by target company/brand.

Parameters:

target (required): Target company or brand name (e.g., "PayPal", "Apple")
limit (optional): Number of results (1-500, default: 50)
verified_only (optional): Only return verified phishing URLs (default: true)

5. `get_phish_details`

Get detailed information about a specific phish by ID.

Parameters:

phish_id (required): PhishTank phish ID number

6. `get_phish_stats`

Get statistics about phishing trends and top targets.

Parameters:

days (optional): Number of days to analyze (1-30, default: 7)
top_targets_limit (optional): Number of top targets to include (default: 10)

7. `search_phish_by_date`

Search phishing URLs by submission date range.

Parameters:

start_date (required): Start date in YYYY-MM-DD format
end_date (required): End date in YYYY-MM-DD format
limit (optional): Number of results (1-500, default: 100)

8. `check_url_safe_browsing` (requires `GOOGLE_SAFE_BROWSING_API_KEY`)

Check a single URL against Google Safe Browsing for malware, social engineering (phishing), unwanted software, and potentially harmful application threats.

Parameters:

url (required): The URL to check (must include protocol)

Example:

{
  "url": "https://suspicious-site.com/login"
}

If GOOGLE_SAFE_BROWSING_API_KEY is not set, this tool returns a clear error explaining how to get one; it does not affect any other tool.

9. `check_url_multi_source`

Check a URL against both PhishTank and Google Safe Browsing in a single call, and return a combined verdict (malicious, likely_safe, inconclusive, or unknown) with the contribution of each source clearly labeled under sources.phishtank and sources.safeBrowsing.

Parameters:

url (required): The URL to check (must include protocol)

Example:

{
  "url": "https://suspicious-site.com/login"
}

If GOOGLE_SAFE_BROWSING_API_KEY is not configured, this tool still runs PhishTank's check; the sources.safeBrowsing field reports checked: false with an explanatory error instead of failing the whole call. This is the recommended tool when you want the most reliable single answer.

Installation

Prerequisites

Node.js 18 or higher
npm or yarn

Install Dependencies

npm install

Build the Server

npm run build

Install Globally (Optional)

npm install -g .

Configuration

The server can be configured using environment variables. Copy .env.example to .env and customize:

cp .env.example .env

Environment Variables

PHISHTANK_API_KEY: Optional API key for higher rate limits and database downloads
PHISHTANK_USER_AGENT: Custom User-Agent string (recommended format: phishtank/username)
GOOGLE_SAFE_BROWSING_API_KEY: Optional API key that enables check_url_safe_browsing and the Safe-Browsing half of check_url_multi_source. All PhishTank tools work without it.

Getting a PhishTank API Key

Visit PhishTank API Registration
Create an account or log in
Register your application to get an API key
Add the key to your .env file

Benefits of API Key:

Higher rate limits (100 vs 10 requests per minute)
Access to database downloads
More reliable service

Note: as of this writing, PhishTank registration for new accounts has been closed since 2020, so this key may not be obtainable for new users — see Why a second source?.

Getting a Google Safe Browsing API Key

Create or select a project in the Google Cloud Console
Enable the Safe Browsing API for that project
Create an API key (Credentials) and restrict it to the Safe Browsing API
Set it as GOOGLE_SAFE_BROWSING_API_KEY in your environment (or .env file)

The Safe Browsing API has a free tier and is documented at developers.google.com/safe-browsing. It is for non-commercial use; see Google's terms for commercial use cases (Web Risk API).

Usage

Running the Server

# Run directly
npm start

# Or if installed globally
phishtank-mcp-server

# Run with MCP Inspector for testing
npm run inspector

Integration with MCP Clients

Add to your MCP client configuration:

{
  "name": "phishtank",
  "command": "node",
  "args": ["path/to/phishtank-mcp-server/build/index.js"]
}

Example Usage

Check a Suspicious URL

// Using MCP client
const result = await client.use_tool('check_url', {
  url: 'https://suspicious-site.com/login'
});

Search for PayPal Phishing

const phishingUrls = await client.use_tool('search_phish_by_target', {
  target: 'PayPal',
  limit: 20,
  verified_only: true
});

Get Recent Phishing Statistics

const stats = await client.use_tool('get_phish_stats', {
  days: 7,
  top_targets_limit: 15
});

Cross-Check a URL Against Both Sources

const verdict = await client.use_tool('check_url_multi_source', {
  url: 'https://suspicious-site.com/login'
});
// verdict.verdict: "malicious" | "likely_safe" | "inconclusive" | "unknown"
// verdict.sources.phishtank / verdict.sources.safeBrowsing: per-source detail

Rate Limiting

The server automatically handles rate limiting:

Without API Key: 10 requests per minute
With API Key: 100 requests per minute
Automatic Throttling: Requests are queued and spaced appropriately
Caching: Results are cached to reduce API calls

Caching

URL Checks: Cached for 5 minutes (both PhishTank's check_url and Safe Browsing's check_url_safe_browsing)
Database Downloads: Cached for 1 hour
Automatic Cleanup: Cache is cleaned up automatically

Error Handling

The server provides comprehensive error handling:

Rate Limit Exceeded: Automatic retry with backoff
Invalid URLs: Validation before API calls
Network Errors: Proper error messages and recovery
API Errors: Detailed error information from PhishTank or Google Safe Browsing, labeled by source
Missing Safe Browsing Key: check_url_safe_browsing returns a clear, actionable error; check_url_multi_source instead skips that source and still returns the PhishTank result

API Response Format

All tools return structured JSON responses (also exposed as MCP structuredContent matching each tool's outputSchema).

PhishTank-only tools, e.g. check_url:

{
  "result": { /* Tool-specific data */ },
  "rate_limit_info": {
    "interval": "300 Seconds",
    "limit": 100,
    "count": 5,
    "remaining": 95
  },
  "summary": "Human-readable summary of the result"
}

check_url_safe_browsing:

{
  "url": "https://suspicious-site.com/login",
  "threats_found": true,
  "matches": [
    { "threatType": "SOCIAL_ENGINEERING", "platformType": "ANY_PLATFORM", "threatEntryType": "URL", "threat": { "url": "https://suspicious-site.com/login" } }
  ],
  "checked_at": "2026-09-19T00:00:00.000Z",
  "summary": "⚠️ THREAT DETECTED by Google Safe Browsing - SOCIAL_ENGINEERING"
}

check_url_multi_source, with each source's contribution clearly attributed:

{
  "url": "https://suspicious-site.com/login",
  "sources": {
    "phishtank": { "checked": true, "available": true, "in_database": true, "verified": true, "phish_id": 12345 },
    "safeBrowsing": { "checked": true, "available": true, "threats_found": true, "matches": [ { "threatType": "SOCIAL_ENGINEERING", "..." : "..." } ] }
  },
  "verdict": "malicious",
  "summary": "⚠️ PHISHING/MALWARE DETECTED - flagged by: PhishTank (verified phish ID 12345) and Google Safe Browsing (SOCIAL_ENGINEERING)"
}

Security Considerations

No API Key Required: Basic PhishTank functionality works without any API key; Safe Browsing tools require GOOGLE_SAFE_BROWSING_API_KEY and fail cleanly (or are skipped, for the multi-source tool) without it
Rate Limiting: Respects PhishTank's service limits
URL Validation: All URLs are validated before processing
Error Handling: Prevents information leakage in error messages

Development

Scripts

npm run build: Compile TypeScript to JavaScript
npm run watch: Watch for changes and rebuild
npm run inspector: Run with MCP Inspector for testing

Project Structure

phishtank-mcp-server/
├── src/
│   ├── index.ts                  # Main server implementation
│   └── types/
│       ├── phishtank-types.ts    # PhishTank TypeScript type definitions
│       └── safebrowsing-types.ts # Google Safe Browsing + multi-source type definitions
├── build/                        # Compiled JavaScript (auto-generated)
├── package.json
├── tsconfig.json
└── README.md

Contributing

Fork the repository
Create a feature branch
Make your changes
Add tests if applicable
Submit a pull request

License

MIT License - see LICENSE file for details

Related Projects

URLhaus MCP Server - URLhaus malware URL database
OpenFDA MCP Server - FDA drug and device information
CIRCL CVE Search MCP Server - CVE vulnerability information

Support

Issues: GitHub Issues
Documentation: PhishTank API Documentation
Community: MCP Community

Acknowledgments

PhishTank by Cisco Talos Intelligence Group
Model Context Protocol by Anthropic
All contributors and the cybersecurity community

Name		Name	Last commit message	Last commit date
src		src
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
glama.json		glama.json
package-lock.json		package-lock.json
package.json		package.json
tsconfig.json		tsconfig.json

Latest commit

History

Folders and files

Repository files navigation

PhishTank MCP Server

Features

Why a second source?

Available Tools

1. check_url

2. check_multiple_urls

3. get_recent_phish

4. search_phish_by_target

5. get_phish_details

6. get_phish_stats

7. search_phish_by_date

8. check_url_safe_browsing (requires GOOGLE_SAFE_BROWSING_API_KEY)

9. check_url_multi_source

Installation

Prerequisites

Install Dependencies

Build the Server

Install Globally (Optional)

Configuration

Environment Variables

Getting a PhishTank API Key

Getting a Google Safe Browsing API Key

Usage

Running the Server

Integration with MCP Clients

Example Usage

Check a Suspicious URL

Search for PayPal Phishing

Get Recent Phishing Statistics

Cross-Check a URL Against Both Sources

Rate Limiting

Caching

Error Handling

API Response Format

Security Considerations

Development

Scripts

Project Structure

Contributing

License

Related Projects

Support

Acknowledgments

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

1. `check_url`

2. `check_multiple_urls`

3. `get_recent_phish`

4. `search_phish_by_target`

5. `get_phish_details`

6. `get_phish_stats`

7. `search_phish_by_date`

8. `check_url_safe_browsing` (requires `GOOGLE_SAFE_BROWSING_API_KEY`)

9. `check_url_multi_source`