maltiverse-mcp

Overview Schema Source Related Servers Discussions Admin

Check hostname/domain reputation (Maltiverse)

maltiverse_check_hostname

Read-onlyIdempotent

Look up a domain or hostname's reputation in Maltiverse to identify phishing, malware distribution, or C2 activity; provide the bare hostname without scheme or path.

Instructions

Look up the reputation of a hostname or domain in Maltiverse.

Use for domains/FQDNs (phishing, malware distribution, C2). Pass the bare hostname without a scheme or path — for a full URL use maltiverse_check_url.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "hostname": "<hostname>"
    },
    "name": "maltiverse_check_hostname"
  }
}

Input Schema

Name	Required	Description	Default
`hostname`	Yes	A domain or hostname, e.g. 'example.com' (no scheme, no path).
`response_format`	No		concise

Output Schema

Name	Required	Description
`tags`	No
`type`	Yes
`value`	Yes	The indicator that was looked up.
`as_name`	No
`sources`	No	Distinct feeds that reported this indicator.
`summary`	Yes	One-line human-readable summary of the verdict.
`av_ratio`	No
`filetype`	No
`hostname`	No
`blacklist`	No	Full per-feed attributions (detailed mode only).
`last_seen`	No
`first_seen`	No
`active_flags`	No	Behaviour flags that are true, e.g. 'is_cnc', 'is_tor_node'.
`country_code`	No
`is_malicious`	Yes	True when classification is 'malicious'.
`threat_names`	No	Distinct threat/campaign names across all feeds.
`classification`	Yes	Maltiverse verdict: malicious, suspicious, neutral, whitelist, or unknown.

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Nov 10, 2026

TDQS

A3.9/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint and destructiveHint=false, so the safety profile is fully covered without description text. The description adds only the input-format constraint and the categories of evidence to expect; it says nothing about rate limits, authentication, or what a "reputation" result contains at a high level.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, purpose first, then the input-format rule and the alternative tool — well front-loaded with no filler. Minor redundancy: the bare-hostname rule is restated from the schema's hostname description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-parameter lookup with an output schema and full annotation coverage, the description supplies the essential callability facts (input shape, sibling routing). The only real gap is the undocumented response_format parameter, which the description ignores entirely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%: hostname is documented in the schema (with the same no-scheme/no-path example echoed in the description), while response_format is described nowhere and its concise/detailed tradeoff is left unexplained. The description adds no meaning beyond the schema, so this is a baseline 3 at best.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb + resource: "Look up the reputation of a hostname or domain in Maltiverse." It scopes the input type (domain/FQDN) and enumerates concrete threat categories (phishing, malware distribution, C2), so an agent can tell it apart from a URL or IP lookup without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the URL case to maltiverse_check_url and states the selection condition ("for a full URL use..."), plus a format constraint ("bare hostname without a scheme or path"). Guidance for other sibling tools (IP, indicator, sample) is absent, but the definition itself gives clear context for the main ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server