isMalicious threat intelligence for AI agents
Runs locallyNo credentials listedUpdated 2026-09-04
com.ismalicious/mcp-server · Registry status: active
At a glance
Indicator reputation verdicts, CVE lookups (CVSS, EPSS, KEV) and prompt-injection scans for agents
Vendor's own description, untranslated and unverified
- Execution location
- Runs locally
- Required secrets declared
- No credentials listed
- Declared version and change
0.2.0· Source-reported change date 2026-09-04- Configuration
- can be built from the disclosed start template
- Runs
- Runs locally
- Credentials
- No credentials listed
- Registry record changed
- 2026-09-04
- Setup
- Template available
- Registry name
com.ismalicious/mcp-server- Package coordinate
npm:@ismalicious/mcp-server- Declared version
0.2.0- Source-reported listing date
- 2026-09-04
- Source-reported change date
- 2026-09-04
- First seen by tracevero
- 2026-09-05
- Vendor's website
- https://ismalicious.com/prompt-injection-scanner
Evidence for this page · Source: MCP-Register · collected on 2026-09-05
Every value below comes from it. Where one differs, its origin is stated on its row. What the confidence levels mean
Measured values
| Required secrets declared | No credentials listed no Original data – Required secret variables (raw): confirmed absent Original data – Required secret headers (raw): confirmed absent Source: MCP-Register · collected on 2026-09-05 · derived |
|---|---|
| Execution location | Runs locally local Original data – Transports (raw): stdio Source: MCP-Register · collected on 2026-09-05 · derived |
| Path argument present | no Original data – Path arguments (raw): confirmed absent Original data – Path environment variables (raw): confirmed absent Source: MCP-Register · collected on 2026-09-05 · derived |
| Repository URL listed | No repository declared no Original data – Repository (raw): confirmed absent Source: MCP-Register · collected on 2026-09-05 · derived |
| Field of use, derived from the vendor description | Security Original data – Description (raw): Indicator reputation verdicts, CVE lookups (CVSS, EPSS, KEV) and prompt-injection scans for agents Source: MCP-Register · collected on 2026-09-05 · derived |
| Declared version | 0.2.0 Source: MCP-Register · collected on 2026-09-05 · self-declared |
What is measured is what a manifest declares, not what a piece of software does. This registry fetches no repository URL, no endpoint and no package index; nothing here is verified. Which value comes from which source, and by which rule it was formed, is set out in the Methodology.
Related categories
- MCP servers for security534
- MCP servers without declared required secrets22,553
- Locally executed MCP servers13,073
- MCP servers without a repository URL6,528
- Local MCP servers without declared required secrets9,909
- MCP servers over stdio only10,587
6 of 11 categories. All categories in the segment catalogue
Source data24
All 24 values in this block: self-declared.
| Description (raw) | Indicator reputation verdicts, CVE lookups (CVSS, EPSS, KEV) and prompt-injection scans for agents |
|---|---|
| Environment variables (raw) | ISMALICIOUS_API_KEY, ISMALICIOUS_API_SECRET, ISMALICIOUS_API_BASE, ISMALICIOUS_TIMEOUT_MS |
| Required secret variables (raw) | confirmed absent |
| Transports (raw) | stdio |
| Path arguments (raw) | confirmed absent |
| Repository (raw) | confirmed absent |
| Package registries (raw) | npm |
| Required secret headers (raw) | confirmed absent |
| Path environment variables (raw) | confirmed absent |
| Remote URLs (raw) | confirmed absent |
| Remote hosts (raw) | confirmed absent |
| Registry status message (raw) | confirmed absent |
| First listed in the registry (raw) | 2026-09-04 |
| Last changed in the registry (raw) | 2026-09-04 |
| Schema version of the raw record (raw) | https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json |
| Delivery form (raw) | package |
| Repository platform (raw) | confirmed absent |
| Repository subfolder (raw) | confirmed absent |
| Package identifiers (raw) | @ismalicious/mcp-server |
| Package versions (raw) | 0.2.0 |
| Runtime hints (raw) | confirmed absent |
| Environment variable formats (raw) | confirmed absent |
| Environment variable descriptions (raw) | ISMALICIOUS_API_BASE=API base URL (defaults to https://ismalicious.com/api) · ISMALICIOUS_API_KEY=API key from https://ismalicious.com/app/account. Optional: without it the server starts in bootstrap mode and offers bootstrap_key. · ISMALICIOUS_API_SECRET=API secret paired with the key · ISMALICIOUS_TIMEOUT_MS=Replaces every tool's timeout, in milliseconds (defaults: gate 15000, check_indicator 25000, CVE 10000) |
| Icon formats (raw) | confirmed absent |
Embed this badge
Paste this line into a README of your own. The badge states how many values the registry holds for the entry and when it last looked, and it links back to this page.
[](https://tracevero.com/mcp/com-ismalicious-mcp-server)
The image is drawn again on every request, so it always reports the current state while the pasted line stays as it is. It carries no rating and no traffic light – only the two measured figures.
Changes
| 2026-09-05 | Declared version: – → 0.2.0 |
|---|---|
| 2026-09-05 | Field of use, derived from the vendor description: – → Security |
| 2026-09-05 | Repository URL listed: – → false |
These are the 3 most recent changes to this entry. Full history
tracevero · https://tracevero.com/mcp/com-ismalicious-mcp-server