Ohey research

ca.oheyPublished by ohey.caOfficial publisherv1.0.0Updated Nov 4, 2026

Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.

The publisher's own server: Ohey

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Ohey's public research server: browse web-malware techniques, kits, EtherHiding contracts and ClickFix hosts from Ohey's website scans.

What you can do
  • List and inspect malware techniques and kits, with site counts, monthly matches, CMS shares, common plugins and related kits
  • Read Ohey research articles, newest first, including incident timelines and indicators
  • Search and inspect EtherHiding smart contracts by kit, chain or destination host, with destination history
  • Search ClickFix command hosts, busiest first, with credited kits, first and last seen, and defanged URLs and commands
  • Read feed statistics: current host count, delisted hosts, and the last seven full UTC days of additions
When to use it
Useful when an assistant needs to explain or triage web-injection campaigns such as ClickFix, EtherHiding, skimmers or phishing kits, or to cite Ohey's published figures and articles. It is read-only research data, not a live per-host lookup or scanning service.
Requirements
A remote Streamable HTTP endpoint at ohey.ca/mcp/research; no sign-in, API key or local runtime is needed. Per-host lookups, feed search and URL scanning live on a separate Ohey server that requires an Ohey account with API access.
Before you install
Contract destinations and ClickFix command hosts are live malware infrastructure, defanged with [.] and hxxp; do not open, refang or run them. Counts are site matches since recordsBegin, so cite the page URL with any figure. The separate feed server creates an API key on sign-in and counts tool calls against it.

Installation

In SourceWeft

  1. Open Ohey research in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/ca.ohey%2Fresearch/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "ohey-research": {
      "type": "http",
      "url": "https://ohey.ca/mcp/research"
    }
  }
}

README

Ohey MCP servers

Ohey scans websites for injected malware: ClickFix and fake update lures, skimmers, phishing kits, EtherHiding loaders, and the C2 and distribution servers behind them. There are two remote MCP servers (Streamable HTTP).

ServerURLSign-in
Researchhttps://ohey.ca/mcp/researchNone
Feed and APIhttps://ohey.ca/mcpOhey account with API access

Research server

The research Ohey publishes on ohey.ca/threats, as tools. Anyone can connect.

ToolWhat it does
list_threatsEvery technique, with its page, a summary, site counts and its kits.
get_threatA technique or kit: sites matched by month, how many were still infected when rescanned, WordPress and Joomla shares, common plugins, kits seen on the same sites, its EtherHiding contracts and articles.
list_research_articlesResearch articles, newest first.
search_etherhiding_contractsContracts that compromised sites read their next stage from, by kit, chain or destination host.
get_etherhiding_contractOne contract's destinations over time.
get_feed_statsFeed size, last week's additions and removals, and the capture archive.

Counts update daily from Ohey's scans.

Claude Code:

bash
claude mcp add --transport http ohey-research https://ohey.ca/mcp/research

Feed and API server

Ohey's API as tools: look up any host, search the feed, read CVEs and scan URLs. You sign in with your Ohey account, so there is no API key to copy. Ask for an account with API access at ohey.ca/contact.

Connect

Claude: Settings, Connectors, Add custom connector, then paste the URL.

Claude Code:

bash
claude mcp add --transport http ohey https://ohey.ca/mcp

Other clients: add https://ohey.ca/mcp as a remote MCP server. The client finds the sign-in pages from the server's OAuth metadata and registers itself.

Signing in opens ohey.ca. Approve the connection there and the client gets access.

Tools

ToolWhat it does
search_indicatorsHosts in the feed, filtered by tag or family, with roles, families, tags and the reason each was admitted.
get_hostA host's feed entry, vulnerable software from its latest capture, its captures summary and DNS records.
get_host_capturesEach time the scanner loaded the host: when, what it returned and what matched.
list_delistedHosts that review excluded or took out of the feed, with the reason and who decided.
get_vulnerabilityOne CVE with its NVD, EPSS, KEV, GitHub and OSV data.
list_vulnerabilitiesPublished CVEs in order, or only WordPress plugin, theme and core CVEs.
start_scanLoads a URL in Ohey's scanner and records what it finds.
get_scanThe scan result: whether the page is malicious, what matched, commands and clipboard writes it tried to plant, and suspected C2.

The scan tools appear only when you tick "Scan URLs" while approving. Scans count against your account.

Access and revoking it

Approving a client creates an API key named after it, under Account in the Ohey portal. Tool calls are rate limited and counted against that key like any API request. Revoke the key to disconnect the client.

The full API, with every response field, is documented at ohey.ca/docs.

Security

Report security issues to [email protected]. See security.txt.

Source: README.md at commit 0990eda

Tools

7

list_threats

List techniques

Every technique Ohey publishes, with its page, a summary, site counts and its kits.

Takes no parameters.

get_threat

Get a technique or kit

A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and core versions, kits seen together on the same sites, its EtherHiding contracts, the hosts its ClickFix commands download from (the 20 on the most sites) and the articles about it.

Parametersslugrequired

list_research_articles

List research articles

Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators.

Parametersthreat

search_etherhiding_contracts

Search EtherHiding contracts

Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when Ohey last read each one. Set destination to find the contracts that point, or pointed, at a host.

Parameterskitchainlimitdestination

get_etherhiding_contract

Get an EtherHiding contract

One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it.

Parametersaddressrequired

get_feed_stats

Get feed statistics

The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed as legitimate services and kept out. week.added (and daily): hosts that entered the feed. week.entered: website tips that reached review. week.accepted: of those, the ones accepted into the feed. week.removed: tips an analyst rejected at review. week.denied: hosts confirmed legitimate that week. archive: the scanner's captures, the responses in them, host IP observations, response bodies judged malicious or clean, and feed status changes.

Takes no parameters.

search_clickfix_commands

Search ClickFix command hosts

Hosts that ClickFix lure commands download from, as the ClickFix command tracker lists them, busiest first: the kits credited with each, sites whose captured command used it, first and last seen, and the latest URL and command, defanged. command is empty when the command assembles its host while it runs. For research purposes only: the commands are real and their hosts may serve live malware, so pass on the notice field with any command you quote. Set host to check one host or URL; *[.]domain rows cover a domain that hands out a subdomain per visit.

Parameterskithostlimit

Version history

1
  1. v1.0.0LatestNov 4, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Ohey integrations

Ohey

ca.oheyOfficial publisher

Ohey's remote MCP server for looking up hosts in its web malware feed, reading CVEs and research, and scanning URLs.

Streamable HTTPWeb executableAuth
Web Search & ScrapingCredential requiredNov 4, 2026