maltiverse-mcp

Overview Schema Source Related Servers Discussions Admin

Check URL reputation (Maltiverse)

maltiverse_check_url

Read-onlyIdempotent

Look up a URL's reputation in Maltiverse by automatically computing its SHA-256 checksum, so you can check full URLs without manual hashing.

Instructions

Look up the reputation of a specific URL in Maltiverse.

Maltiverse keys URLs by the SHA-256 of the raw URL string; this tool computes that checksum for you. Pass a full URL (with scheme). To check just the domain, use maltiverse_check_hostname instead.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "url": "<url>"
    },
    "name": "maltiverse_check_url"
  }
}

Input Schema

Name	Required	Description	Default
`url`	Yes	A full URL including scheme, e.g. 'http://example.com/path'. You may instead pass the 64-char SHA-256 'urlchecksum' Maltiverse assigns a URL.
`response_format`	No		concise

Output Schema

Name	Required	Description
`tags`	No
`type`	Yes
`value`	Yes	The indicator that was looked up.
`as_name`	No
`sources`	No	Distinct feeds that reported this indicator.
`summary`	Yes	One-line human-readable summary of the verdict.
`av_ratio`	No
`filetype`	No
`hostname`	No
`blacklist`	No	Full per-feed attributions (detailed mode only).
`last_seen`	No
`first_seen`	No
`active_flags`	No	Behaviour flags that are true, e.g. 'is_cnc', 'is_tor_node'.
`country_code`	No
`is_malicious`	Yes	True when classification is 'malicious'.
`threat_names`	No	Distinct threat/campaign names across all feeds.
`classification`	Yes	Maltiverse verdict: malicious, suspicious, neutral, whitelist, or unknown.

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Nov 10, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already provide the safety and idempotency profile, but the description adds meaningful behavior by explaining that Maltiverse keys URLs by the SHA-256 of the raw URL string and that the tool computes that checksum. It does not describe rate limits or failure behavior, but for a read-only reputation lookup with rich annotations and an output schema, that is a minor gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short, front-loaded with the core purpose, and then adds only the key operational detail and the alternative. Every sentence contributes useful information with no wasted wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple lookup tool with annotations and an output schema, the definition covers purpose, required URL format, checksum behavior, and the domain alternative well. The main remaining gap is that response_format is not described, which is minor but still leaves an incomplete parameter explanation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds useful meaning for the url parameter by clarifying the raw-URL SHA-256 keying and checksum computation, going beyond what the schema states. However, the response_format parameter is not explained in the description and its schema entry has no descriptive text, leaving one of the two parameters semantically thin.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource: looking up the reputation of a specific URL in Maltiverse. It also distinguishes the tool from maltiverse_check_hostname, so an agent can tell which sibling to choose without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the usage condition clearly by requiring a full URL with scheme and explicitly routes domain-only checks to maltiverse_check_hostname. This gives both the use case and the relevant alternative, which is exactly the guidance needed for this lookup tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server