plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "scanmalware",
  "version": "1.3.1",
  "description": "Investigate phishing and malicious URLs with the ScanMalware scan archive: the ScanMalware MCP server plus a skill for pivoting from one phishing URL to the rest of its campaign.",
  "author": {
    "name": "Triop AB",
    "email": "contact@scanmalware.com",
    "url": "https://scanmalware.com"
  },
  "homepage": "https://github.com/scanmalware/scanmalware-plugin",
  "repository": "https://github.com/scanmalware/scanmalware-plugin",
  "license": "Apache-2.0",
  "keywords": [
    "phishing",
    "threat-intelligence",
    "url-scanning",
    "osint",
    "security",
    "mcp"
  ],
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "ScanMalware",
        "shortDescription": "Phishing URL scans and pivots",
        "longDescription": "ScanMalware helps security teams investigate suspicious and phishing URLs. It runs a URL through isolated analysis environments, records what the page loaded and ran, checks it against YARA, antivirus and intrusion-detection rules and threat feeds, has AI models classify suspicious pages by scam type, and keeps public scans in a searchable archive, so one reported phishing page can lead to the rest of its campaign.\n\nWith this plugin you can:\n- Look up what the archive already knows about a domain, URL or IP address: the scanner's verdict and risk factors, network requests, indicators, TLS and JARM details, detected technologies, YARA matches, OCR text and RDAP data.\n- Find related scans by domain, IP, ASN, JARM signature, favicon hash, screenshot hash, fuzzy hash, OCR text, tracking key or JavaScript fingerprint, and count many searches at once to see which indicators are specific to one campaign.\n- Follow a domain's DNS history and reverse DNS, and list the hosts seen for a domain.\n- Look up Certificate Transparency records for a domain or IP.\n- Submit a new URL for scanning, choosing whether the result is public or unlisted, and read the verdict when the scan completes.\n\nThe included skill walks through pivoting from one phishing URL to its sibling hosts, and avoids two common mistakes: giving a domain a verdict that belongs to a page that only redirected to it, or to another tenant on a shared hosting platform; and blocking on shared IP addresses or TLS fingerprints that describe a hosting platform rather than an attacker.\n\nScanMalware is a defensive tool. Pages are opened in ScanMalware's isolated analysis environments, not on your device. No account or API key is needed. 143 of the 145 tools only read data; the two that write submit a URL for scanning and record a safe or malicious vote on a scan. A public scan publishes the URL and its results, so use \"unlisted\" for confidential targets.\n\nScanMalware is operated by Triop AB in Sweden.",
        "developerName": "Triop AB",
        "category": "Security",
        "capabilities": [
          "Read",
          "Write"
        ],
        "websiteURL": "https://scanmalware.com",
        "supportURL": "https://scanmalware.com/contact",
        "privacyPolicyURL": "https://github.com/scanmalware/mcp-server/blob/main/PRIVACY.md",
        "termsOfServiceURL": "https://scanmalware.com/terms",
        "defaultPrompt": [
          "Check this suspicious link in ScanMalware and summarize what the page does.",
          "Find other phishing pages that reuse this page's favicon or scripts.",
          "Scan this URL as unlisted in ScanMalware and report the verdict."
        ],
        "brandColor": "#1E40AF",
        "composerIcon": "./assets/icon.png",
        "logo": "./assets/icon.png"
      },
      "apps": "./.app.json"
    }
  }
}