Ohey

ca.oheyPublished by ohey.caOfficial publisherv1.0.0Updated Nov 4, 2026

Look up hosts in the Ohey web malware feed, read CVEs and scan URLs with Ohey's scanner.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Ohey's remote MCP server for looking up hosts in its web malware feed, reading CVEs and research, and scanning URLs.

What you can do
  • Search the malware feed for hosts by tag or family, and read a host's entry, captures, DNS records and delisted status
  • Look up CVEs individually or list published ones, including WordPress plugin, theme and core CVEs, with NVD, EPSS, KEV, GitHub and OSV data
  • Start a URL scan in Ohey's scanner and read the result, including matches, planted commands and clipboard writes, and suspected C2
  • Browse Ohey's published threat research: techniques and kits, site counts, EtherHiding contracts and research articles
  • Read feed statistics such as size, recent additions and removals, and the capture archive
When to use it
Useful for security analysts, incident responders or site owners who want an assistant to check whether a host is in a malware feed, pull CVE context, or scan a suspicious URL without leaving the chat.
Requirements
A remote Streamable HTTP endpoint; no local install. The feed and API server requires signing in with an Ohey account that has API access, granted through OAuth in the client. A separate research server is described as open to anyone. Network access to ohey.ca is needed.
Before you install
Signing in creates an API key named after the client under the Ohey account; tool calls are rate limited and counted against that key, and revoking the key disconnects the client. Scan tools only appear if you tick "Scan URLs" while approving, and scans count against your account. Queried host names and URLs are sent to Ohey.

Installation

In SourceWeft

  1. Open Ohey in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/ca.ohey%2Fohey/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "ohey": {
      "type": "http",
      "url": "https://ohey.ca/mcp"
    }
  }
}

README

Ohey MCP servers

Ohey scans websites for injected malware: ClickFix and fake update lures, skimmers, phishing kits, EtherHiding loaders, and the C2 and distribution servers behind them. There are two remote MCP servers (Streamable HTTP).

ServerURLSign-in
Researchhttps://ohey.ca/mcp/researchNone
Feed and APIhttps://ohey.ca/mcpOhey account with API access

Research server

The research Ohey publishes on ohey.ca/threats, as tools. Anyone can connect.

ToolWhat it does
list_threatsEvery technique, with its page, a summary, site counts and its kits.
get_threatA technique or kit: sites matched by month, how many were still infected when rescanned, WordPress and Joomla shares, common plugins, kits seen on the same sites, its EtherHiding contracts and articles.
list_research_articlesResearch articles, newest first.
search_etherhiding_contractsContracts that compromised sites read their next stage from, by kit, chain or destination host.
get_etherhiding_contractOne contract's destinations over time.
get_feed_statsFeed size, last week's additions and removals, and the capture archive.

Counts update daily from Ohey's scans.

Claude Code:

bash
claude mcp add --transport http ohey-research https://ohey.ca/mcp/research

Feed and API server

Ohey's API as tools: look up any host, search the feed, read CVEs and scan URLs. You sign in with your Ohey account, so there is no API key to copy. Ask for an account with API access at ohey.ca/contact.

Connect

Claude: Settings, Connectors, Add custom connector, then paste the URL.

Claude Code:

bash
claude mcp add --transport http ohey https://ohey.ca/mcp

Other clients: add https://ohey.ca/mcp as a remote MCP server. The client finds the sign-in pages from the server's OAuth metadata and registers itself.

Signing in opens ohey.ca. Approve the connection there and the client gets access.

Tools

ToolWhat it does
search_indicatorsHosts in the feed, filtered by tag or family, with roles, families, tags and the reason each was admitted.
get_hostA host's feed entry, vulnerable software from its latest capture, its captures summary and DNS records.
get_host_capturesEach time the scanner loaded the host: when, what it returned and what matched.
list_delistedHosts that review excluded or took out of the feed, with the reason and who decided.
get_vulnerabilityOne CVE with its NVD, EPSS, KEV, GitHub and OSV data.
list_vulnerabilitiesPublished CVEs in order, or only WordPress plugin, theme and core CVEs.
start_scanLoads a URL in Ohey's scanner and records what it finds.
get_scanThe scan result: whether the page is malicious, what matched, commands and clipboard writes it tried to plant, and suspected C2.

The scan tools appear only when you tick "Scan URLs" while approving. Scans count against your account.

Access and revoking it

Approving a client creates an API key named after it, under Account in the Ohey portal. Tool calls are rate limited and counted against that key like any API request. Revoke the key to disconnect the client.

The full API, with every response field, is documented at ohey.ca/docs.

Security

Report security issues to [email protected]. See security.txt.

Source: README.md at commit 0990eda

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v1.0.0LatestNov 4, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Ohey integrations

Ohey research

ca.oheyOfficial publisher

Ohey's public research server: browse web-malware techniques, kits, EtherHiding contracts and ClickFix hosts from Ohey's website scans.

Streamable HTTPWeb executable
Web Search & Scraping7 toolsNov 4, 2026