Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@webamon-mcp search scans for phishing pages targeting paypal.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP (Model Context Protocol) server for the Webamon threat intelligence platform. Lets AI assistants like Claude search scan databases, submit URLs for scanning, browse campaigns, and explore infrastructure clusters — all via Lucene-powered queries across multiple indexes.
Built for the community as part of the c0c0n 2026 course: "Threat Tradecraft: Infrastructure Hunting & Malware Analysis".
14 MCP tools covering all free-tier accessible endpoints
Lucene search across 8 indexes: scans, domains, servers, resources, detections, new_domains, infostealers, and Certificate Transparency Logs (CTL)
URL scanning — submit URLs and retrieve scan reports
Campaign & cluster intelligence — browse tracked phishing/malware campaigns and infrastructure clusters
Pro tier ready — set WEBAMON_PRO=true to switch to pro.webamon.com
Related MCP server: StealthMole MCP Server
Tool | Description |
| Search the scans index (domain names, tags, fingerprints, page titles, etc.) |
| Search the domains index |
| Search the servers index (IPs, ASNs, hosting, headers) |
| Search web resources collected during scans |
| Search threat detection records |
| Search newly registered domains (NRDs) |
| Search infostealer-related records |
| Search Certificate Transparency Log indexes by date |
| Simple keyword search (non-Lucene) |
| Submit a URL for scanning |
| Retrieve a completed scan report by report ID |
| Retrieve the screenshot for a scan report |
| List tracked phishing/malware campaigns |
| List infrastructure clusters |
git clone https://github.com/xelemental/webamon-mcp.git
cd webamon-mcp
python -m venv venv
# Windows
venv\Scripts\activate
# macOS/Linux
source venv/bin/activate
pip install -e .Add to your claude_desktop_config.json:
Windows (%APPDATA%\Claude\claude_desktop_config.json):
{
"mcpServers": {
"webamon": {
"command": "C:\\path\\to\\webamon-mcp\\venv\\Scripts\\python.exe",
"args": ["-m", "webamon_mcp"],
"env": {
"WEBAMON_API_KEY": "your-api-key-here"
}
}
}
}macOS (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"webamon": {
"command": "/path/to/webamon-mcp/venv/bin/python",
"args": ["-m", "webamon_mcp"],
"env": {
"WEBAMON_API_KEY": "your-api-key-here"
}
}
}
}If you have a Pro API key, add WEBAMON_PRO to switch to the pro base URL:
"env": {
"WEBAMON_API_KEY": "your-pro-api-key",
"WEBAMON_PRO": "true"
}Variable | Required | Description |
| Yes | Your Webamon API key |
| No | Set to |
| No | Transport mode — |
# Find scans of a specific domain
domain_name:example.com
# Find phishing pages tagged by OpenPhish
tag:openphish
# Find scans with a specific page title
page_title:"Account Verification"
# Find AI-flagged phishing pages
threat_ai:phishing
# Find scans by SSL fingerprint
fingerprint.ssl:"HASH_VALUE"
# Wildcard — all recent entries
*Feature | Free | Pro |
Base URL |
|
|
Auth | API key ( | API key ( |
Max results | 25 per query | 500 per query |
Pagination | No | Yes |
Rate limits | Standard | Higher |
Monitor API | No | Yes |
MIT
SOAR security playbooks for AI agents: fetch, full-text search, and count. Metered via Stripe.
Scam and phishing detection for AI agents: safe/warn/danger verdicts for URLs and messages.
The web capability layer for AI agents: render, extract, DNS, SSL, WHOIS & more via x402.
Web search, browser automation, scraping, crawling and CAPTCHA solving for AI agents.
