Integration

ScanMalware integration

ScanMalware is a free URL security scanner: it opens a URL in an isolated browser and records what the page loads and does. Submit a URL, follow its progress, then read the rule-engine and AI verdicts, antivirus, Safe Browsing, threat-intelligence, IDS and hunting-rule findings, technologies, TLS certificate and screenshot; search the public scan archive (text, SMQL, IP, AS number, domain), look up a domain's Certificate Transparency and DNS history, and browse brand impersonation data. Public scans are published on the website and in ScanMalware's social posts, verdicts are automated and can be wrong, and archived URLs are shown as their submitters wrote them. Private scans and the account, hunt, API key, statistics, raw capture (PCAP, network transactions, cookies) and JavaScript or WebAssembly research routes are left out. Limit: 12,000 requests per minute per IP address. No authentication: the API is keyless.

Connect ScanMalware How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in ScanMalware.Built from the 27 ScanMalware tools below, on the connection you add once.

What you can do with ScanMalware

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Each badge shows the default agent permission of an endpoint (allowed: an agent calls it without asking; ask first: you are asked before an agent calls it, when the agent or chat asks permission for sensitive actions; never: no agent may call it), which every user can change endpoint by endpoint in their credential settings.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Scan, 7 operations

list_domain_scansList domain scansGETAgents: ask firstLists public scans of a domain or its subdomains, matched on the entry host or the final host after redirects (matched_on says which). Filter by status; limit up to 100.
list_recent_scansList recent scansGETAgents: ask firstLists the most recent public scans, newest first, with scan_id, URL, status and title. Page with page and limit (at most 100).
search_scansSearch scansGETAgents: ask firstSearches public scans by URL, domain, title, technology, yara or all fields (type), with a query of at least 3 characters. For filters and boolean logic use search_scans_smql.
search_scans_by_asnSearch scans by asnGETAgents: ask firstLists public scans that used an autonomous system, by AS number, with the network's organization, scan totals and first and last seen dates. limit goes up to 500.
search_scans_by_ipSearch scans by ipGETAgents: ask firstLists public scans that contacted an IP address, with each scan's main address and every address it contacted. Page with page and limit (at most 100).
search_scans_smqlSearch scans smqlGETAgents: ask firstSearches public scans with an SMQL query such as domain:paypal.com AND submitted:last7d, or has:malware (list_smql_filters lists every filter). count_only=true returns only the count.
submit_scanSubmit scanPOSTAgents: ask firstSubmits a URL for ScanMalware's sandbox browser to visit (the site gets a real visit) and returns scan_id. Poll get_scan_progress until status is completed or failed, then read get_scan_summary. Public scans are published to everyone.

Brand, 2 operations

get_brandGet brandGETAgents: ask firstReturns a brand by slug or id with the hosts caught impersonating it, most recently seen first, each with its newest scan_id, verdict and risk tier. Page with limit and cursor.
list_brandsList brandsGETAgents: ask firstLists brands ScanMalware watches for impersonation, with official domains and counts of impersonating hosts. Filter by q, sector or has_sightings; sort; page with limit and offset.

Malware detection, 2 operations

get_malware_resultsGet malware resultsGETAgents: ask firstReturns antivirus (ClamAV) detections for a scan by scan_id: flagged files with signature names and SHA-256 hashes, and the files the page made the browser download with their analysis.
list_recent_malware_threatsList recent malware threatsGETAgents: ask firstLists antivirus detections across all public scans in the last hours (1 to 168, default 24), newest first, with URL, signature name and scan_id. limit goes up to 1000.

Ai analysis, 1 operation

get_ai_analysisGet ai analysisGETAgents: ask firstReturns the AI analysis of a scan by scan_id: classification, scam type, verdict, risk score, confidence, evidence, risk and safety factors, impersonated brand and recommended action.

Ct certificate, 1 operation

list_ct_certificatesList ct certificatesGETAgents: ask firstLists Certificate Transparency log entries for a domain and its subdomains: name, SHA-1 fingerprint, log time (Unix milliseconds) and the addresses the name resolved to.

Dns record, 1 operation

get_domain_dnsGet domain dnsGETAgents: ask firstReturns DNS observations for a domain: records, apex and www addresses, and its subdomains (resolved and unresolved). If degraded is true no data could be read: retry rather than trust the zeros.

Domain stats, 1 operation

get_domain_scan_statsGet domain scan statsGETAgents: ask firstReturns scan counts for a domain or IP address: total, completed and failed scans, first and latest scan, and scans in the last 24 hours, 7 days and 30 days.

Hunting rule match, 1 operation

get_hunting_rule_matchesGet hunting rule matchesGETAgents: ask firstReturns the hunting rules that matched a scan (page, frames or scripts), by scan_id: rule, category, severity, threat names, CVE and MITRE ATT&CK ids and matched strings.

Ids alert, 1 operation

get_ids_alertsGet ids alertsGETAgents: ask firstReturns the Suricata intrusion-detection alerts raised while a scan ran, by scan_id: signature, category, severity level, protocol, addresses and ports, with counts per severity.

Ioc match, 1 operation

get_ioc_matchesGet ioc matchesGETAgents: ask firstReturns threat-intelligence indicator (IoC) matches for a scan by scan_id: the IP addresses and domains the page contacted that appear in threat feeds, with threat type and source.

Safe browsing threat, 1 operation

get_safe_browsing_threatsGet safe browsing threatsGETAgents: ask firstReturns the Google Safe Browsing threats recorded for a scan by scan_id (threat type and platform), with has_threats true or false.

Scan progress, 1 operation

get_scan_progressGet scan progressGETAgents: ask firstReturns the progress of a scan by scan_id: status (queued, processing, completed or failed), current step and percentage. Call it again after submit_scan until status is completed or failed.

Scan result, 1 operation

get_scan_resultGet scan resultGETAgents: ask firstReturns the main fields of a scan record by scan_id: final URL, title, domains, IP addresses, countries, networks, links, scripts, technologies, and the rule-engine and AI verdicts.

Scan summary, 1 operation

get_scan_summaryGet scan summaryGETAgents: ask firstReturns the condensed verdict of a scan by scan_id: rule-engine verdict, risk level, risk factors and score, counts of technologies, trackers and redirects, and whether the TLS certificate was valid.

Screenshot, 1 operation

get_scan_screenshotGet scan screenshotGETAgents: ask firstReturns the screenshot of a scan by scan_id as an image file (PNG by default, or WebP). Optional width or height resizes it, keeping the aspect ratio.

Similar domain, 1 operation

find_similar_ct_domainsFind similar ct domainsGETAgents: ask firstFinds look-alike domains of a domain in Certificate Transparency logs: wildcard subdomains, names containing the domain and fuzzy (typosquatting) matches, each with its certificate count.

Smql filter, 1 operation

list_smql_filtersList smql filtersGETAgents: ask firstLists every SMQL filter grouped by category, with type, description and examples, plus the has: existence checks and syntax reminders. Read it before writing a search_scans_smql query.

Technology, 1 operation

get_scan_technologiesGet scan technologiesGETAgents: ask firstReturns the technologies detected in a scan by scan_id (for example frameworks, CDNs and servers) with version and detection confidence.

Tls certificate, 1 operation

get_tls_certificateGet tls certificateGETAgents: ask firstReturns the TLS certificate analysis of a scan by scan_id: subject, issuer, validity dates, fingerprints, key, SANs, chain checks, CAA records and Certificate Transparency data.

Use ScanMalware from Claude Code, Cursor or Codex

Connect ScanMalware in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its ScanMalware operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect ScanMalware

Create your workspace
Sign up free. Nothing to install.
Connect ScanMalware once
ScanMalware needs no credential, so its tools work immediately.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.