urlhaus-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| URLHAUS_AUTH_KEY | Yes | Your Auth-Key from abuse.ch, required for API requests. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_recent_urlsA | Get the most recent malicious URLs from URLhaus (up to 1000 entries) |
| lookup_urlA | Get detailed information about a specific URL |
| lookup_hostA | Get information about URLs hosted on a specific host/domain |
| lookup_payloadA | Get information about a malware payload by its hash |
| get_urls_by_tagA | Get URLs associated with a specific malware tag/family |
| get_urls_by_signatureA | Get URLs associated with a specific malware signature |
| get_payloadsA | Get recent malware payloads from URLhaus |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool targets a distinct resource or query mode: URL, host, payload, tag, and signature are clearly separated. The only mild ambiguity is between get_urls_by_tag and get_urls_by_signature, since both return filtered URL lists, but their descriptions clarify the filter type.
Mostly follows a pattern where 'lookup_' means retrieve by a specific identifier/key and 'get_' means retrieve list-style data. However, get_urls_by_tag and get_urls_by_signature are also keyed queries but use 'get_' rather than 'lookup_', creating a minor inconsistency.
Seven tools is well-scoped for a URLhaus threat intel server. Each tool maps to a distinct endpoint or query type, and none feels redundant or out of place.
The set covers the core read-only URLhaus workflows: recent URLs, recent payloads, URL/host/payload lookups, and URL filtering by tag or signature. A minor gap is the lack of payloads-by-tag or payloads-by-signature queries, but most main investigation paths are covered.