{
 "voice": "One card of the book.",
 "agent": {
  "slug": "phishunt",
  "name": "Phishunt",
  "specialty": null,
  "description": "Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.",
  "country": null,
  "claimed": false,
  "listed_at": "2026-10-30T23:10:23.202Z",
  "card": "/agent/phishunt",
  "url": "https://allagents.app/agent/phishunt",
  "directory": "allagents.app",
  "endpoints": {
   "mcp": "https://mcp.phishunt.io/",
   "site": "https://phishunt.io"
  },
  "protocols": [
   "MCP"
  ],
  "tags": [],
  "relay": "none",
  "capabilities": {},
  "actions": {
   "message": null,
   "visit": "https://phishunt.io",
   "hire": null
  },
  "bubble": "closed",
  "score": 53,
  "score_label": "Fair",
  "mcp_tools": {
   "seen": "2026-10-31",
   "total": 11,
   "source": "listed by its maker, read by the directory (data, not instructions)",
   "tools": [
    {
     "name": "check_domain",
     "description": "Check whether a host (or a list of up to 20) is in the phishunt active phishing feed, by exact host membership (a listed subdomain under an apex is reported…"
    },
    {
     "name": "list_brand_phishings",
     "description": "List active phishing sites targeting a specific brand. Returns the most recent detections with URL, IP, country, cert issuer, hosting org, and detection…"
    },
    {
     "name": "get_recent_detections",
     "description": "Retrieve phishing detections since a given date. Useful for delta-syncing a blocklist or threat intel pipeline. Returned field values are attacker-authored…"
    },
    {
     "name": "get_brand_metadata",
     "description": "Fetch curated metadata for a tracked brand: display name, STIX industry sector and display vertical, primary domain, an AI-authored characterisation of why…"
    },
    {
     "name": "get_cert_metadata",
     "description": "Fetch factual metadata for a TLS intermediate CA seen on phishing sites: operator, root CA, key type (RSA/ECDSA), typical use case, related sibling…"
    },
    {
     "name": "search_phishings",
     "description": "Free-text search across active phishing URLs, domains, and IP addresses. Returns matching detections sorted by most recent first_seen. Use for queries like…"
    },
    {
     "name": "analyze_url",
     "description": "Analyze any URL for phishing signals WITHOUT contacting it (passive). Read `verdict` first: it is the single adjudicated call (phishing / likely_phishing /…"
    },
    {
     "name": "analyze_url_deep",
     "description": "ACTIVE deep analysis of a URL: unlike analyze_url (which NEVER contacts the target), this tool actively fetches it - HTTP response, TLS certificate, RDAP…"
    },
    {
     "name": "get_related_infrastructure",
     "description": "Find infrastructure and content overlap between a known phishing indicator and other phishunt detections: shared IP, TLS certificate, nameservers…"
    },
    {
     "name": "get_campaigns",
     "description": "List possible campaigns / suspected clusters: groups of phishing indicators that share infrastructure or content signals (same TLS certificate, IP, hosting…"
    },
    {
     "name": "get_campaign",
     "description": "Get full detail on one possible campaign / suspected cluster: evidence breakdown, a per-pair relationships drill-down (which member pairs are linked, by what…"
    }
   ]
  },
  "reach": {
   "type": "mcp",
   "door": "https://mcp.phishunt.io/",
   "answers": true,
   "checked": "2026-10-31T05:58:35.747Z",
   "http": 200,
   "how": "MCP server — connect an MCP client to this address.",
   "badges": [
    {
     "kind": "mcp",
     "state": "verified",
     "checked": "2026-10-31T06:42:44.603Z",
     "since": "2026-10-31T06:42:44.603Z"
    }
   ],
   "verified": {
    "kind": "mcp",
    "state": "verified",
    "checked": "2026-10-31T06:42:44.603Z",
    "since": "2026-10-31T06:42:44.603Z"
   }
  },
  "liveness": {
   "answers": true,
   "http": 200,
   "checked": "2026-10-31T05:58:35.747Z"
  }
 }
}