For scripts, scanners & AI agents

You hit a rate limit. Here is the sanctioned path.

Report pages are metered for people; anonymous automation stops after a small burst. Use a supported route instead.

curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant

50 free requests/month · instant API key · no signup form

Supported routes

Four supported ways in, three of them free.

A monthly lookup allowance on the documented, versioned REST API. JSON responses, no HTML parsing.

check_indicator, get_cve and scan_before_use return verdicts, CVE data and prompt-injection checks.

The official client handles auth, retries and typing for the whole REST API.

Pro and Enterprise poll STIX/TAXII collections of malicious IPs, domains and URLs, outside the request quota.

MCP

Six tools over the same API for Claude Desktop, Cursor, Windsurf or your own agent, with typed errors.

npx -y @ismalicious/mcp-server

scan_before_usePrompt-injection scan plus link reputation over untrusted content; block, warn or allow.
check_urlReputation of one URL, domain or IP before fetching it.
check_indicatorVerdict for an IP, domain, URL or hash: risk score, citing blocklists, timeline, network and a recommended action.
get_cveOne CVE with CVSS, EPSS, CISA KEV status and due date, exploitation evidence and references.
recent_cvesLatest CVEs, optionally by severity.
search_indicatorsSearch the corpus by pattern, source or threat class; paginated.
check_indicatorsBulk check up to 100 indicators in one call; one request charged per indicator.
check_password_exposureWhether a password, or its SHA-1 or NTLM hash, is in known breach dumps and how often; the password is hashed locally and only a 5-character prefix is sent.
scan_emailScan one email message for phishing and malware: verdict, recommended action and reasons, from the sender, links and attachment hashes; one scan per message.
bootstrap_keyWithout a configured key: mint a free one from an email address.

Limits

Anonymous report streams without a page token are served from cache; a cold miss returns 429.
Declared crawlers keep the report pages and cached verdicts, but never trigger live enrichment.
The anonymous API burst is 10 requests an hour per IP. A free key raises it to 60 requests a minute, within 50 a month, and makes your usage attributable, which is what lets us keep the anonymous tier open.
Without a key, an address also gets 50 requests a month on the routes a key pays for - the Free key's own quota, one month shared across those routes and both of our APIs, reset on the 1st at 00:00 UTC. Report pages opened in a browser do not count toward it.