URLhaus

liveSecurity

Check URLs, hosts, and file hashes against the abuse.ch malware URL database

4tools
0msauth
free tier50 calls/day

Tools

urlhaus_lookup_url

Look up a URL in the URLhaus malware database to check if it is known to host or distribute malware. Returns threat category, status, blacklist status, and tags.

No parameters required.

▶Try it
lookup_hostrequired: host

Look up a hostname or IP address in the URLhaus database to find associated malware URLs. Returns all known malicious URLs hosted on that host.

Parameters
NameTypeDescription
hostreqstringHostname or IP address to look up (e.g. "example.com" or "192.168.1.1").
▶Try it
urlhaus_get_recent

Get a list of recently submitted malware URLs from URLhaus. Useful for monitoring the latest threats.

No parameters required.

▶Try it
lookup_payload

Look up a malware payload file by its MD5 or SHA256 hash in the URLhaus database. Returns file type, size, first/last seen dates, and associated delivery URLs.

Parameters
NameTypeDescription
md5_hashoptstringMD5 hash of the payload to look up (32 hex characters).
sha256_hashoptstringSHA256 hash of the payload to look up (64 hex characters).
▶Try it

Test with curl

The gateway speaks JSON-RPC 2.0 over HTTP POST. You can test any pack directly from the terminal.

List available tools
bash
curl -X POST https://gateway.pipeworx.io/urlhaus/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Call a tool
bash
curl -X POST https://gateway.pipeworx.io/urlhaus/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"urlhaus_lookup_url","arguments":{}}}'

Use with the SDK

Install @pipeworx/sdk to call tools from any TypeScript/Node project.

TypeScript
import { Pipeworx } from '@pipeworx/sdk';
const px = new Pipeworx();
const result = await px.call("urlhaus_lookup_url", {});
ask_pipeworx
// Or ask in plain English:
const answer = await px.ask("check urls, hosts, and file hashes against the abuse");