phishclean-mcp

MCP server for PhishClean security analysis tools. Works with Claude Desktop, Claude Code, Gemini CLI, and any MCP-compatible client.

Quick Start

npx phishclean-mcp

Or add it to Claude Code in one line:

claude mcp add phishclean -- npx -y phishclean-mcp

Related MCP server: agentguard

Claude Desktop Setup

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "phishclean": {
      "command": "npx",
      "args": ["-y", "phishclean-mcp"]
    }
  }
}

Config file location:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

• Windows: %APPDATA%\Claude\claude_desktop_config.json

Tools

Examples

Once configured, ask Claude:

• "Check if this URL is safe: https://paypal-secure.xyz/login"

• "How strong is the password Summer2024!?"

• "Is this email phishing? Dear customer, verify your account..."

• "Scan this code for leaked secrets: const key = AKIA..."

• "Decode this JWT: eyJhbGci..."

API Key (Optional)

Free tier: 30 requests/hour (no key needed).

For higher limits, get an API key at phishclean.com/developers:

Set your API key via environment variable:

{
  "mcpServers": {
    "phishclean": {
      "command": "npx",
      "args": ["-y", "phishclean-mcp"],
      "env": {
        "PHISHCLEAN_API_KEY": "pk_live_your_key_here"
      }
    }
  }
}

Or via shell:

PHISHCLEAN_API_KEY=pk_live_your_key_here npx phishclean-mcp

API

All tools call the PhishClean API at https://www.phishclean.com/api/v1/.

Override the base URL with:

PHISHCLEAN_API_URL=http://localhost:3000 npx phishclean-mcp

What this server sends, and where

This is a thin stdio client: each tool call is one HTTPS POST to https://www.phishclean.com/api/v1/<tool> carrying only the argument you passed (the URL, password, email text, headers, token, or source). Nothing is stored or logged server-side beyond rate limiting; passwords are analysed and discarded. The whole server is one file — read it before trusting it.

The PhishClean browser extension is a separate, fully local product whose source is also public: phishclean-extension.

Links

• PhishClean Website

• Developer Portal & API Keys

• API Documentation

• Chrome Extension

• Firefox Add-on

• Edge Add-on

• Extension source

License

MIT — see LICENSE.