`lookup_url`

Pack: urlhaus · Endpoint: https://gateway.pipeworx.io/urlhaus/mcp

Look up a URL in the URLhaus malware database to check if it is known to host or distribute malware. Returns threat category, status, blacklist status, and tags.

Parameters

Name	Type	Required	Description
`url`	string	yes	The full URL to look up (e.g. “http://example.com/malware.exe”).

Example call

Arguments

{
  "url": "http://malicious-site.com/payload.exe"
}

curl

curl -X POST https://gateway.pipeworx.io/urlhaus/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"lookup_url","arguments":{"url":"http://malicious-site.com/payload.exe"}}}'

TypeScript (@pipeworx/sdk)

import { Pipeworx } from '@pipeworx/sdk';
const pipeworx = new Pipeworx();

const result = await pipeworx.call('lookup_url', {
  "url": "http://malicious-site.com/payload.exe"
});

More examples

{
  "url": "https://phishing-domain.net/fake-login.html"
}

Response shape

Always returns: query_status, id, url_status, date_added, threat, tags, blacklists

Field	Type	Description
`query_status`	string	Status of the query (e.g. ‘ok’, ‘no_results’)
`id`	string \| null	URLhaus ID for this URL
`url_status`	string \| null	Status of the URL (e.g. ‘online’, ‘offline’)
`date_added`	string \| null	Date when URL was added to database
`threat`	string \| null	Threat category (e.g. ‘malware’, ‘phishing’)
`tags`	array \| null	Associated tags for the URL
`blacklists`	object \| null	Blacklist detection status by various services

Full JSON Schema

{
  "type": "object",
  "properties": {
    "query_status": {
      "type": "string",
      "description": "Status of the query (e.g. 'ok', 'no_results')"
    },
    "id": {
      "type": [
        "string",
        "null"
      ],
      "description": "URLhaus ID for this URL"
    },
    "url_status": {
      "type": [
        "string",
        "null"
      ],
      "description": "Status of the URL (e.g. 'online', 'offline')"
    },
    "date_added": {
      "type": [
        "string",
        "null"
      ],
      "description": "Date when URL was added to database"
    },
    "threat": {
      "type": [
        "string",
        "null"
      ],
      "description": "Threat category (e.g. 'malware', 'phishing')"
    },
    "tags": {
      "type": [
        "array",
        "null"
      ],
      "items": {
        "type": "string"
      },
      "description": "Associated tags for the URL"
    },
    "blacklists": {
      "type": [
        "object",
        "null"
      ],
      "description": "Blacklist detection status by various services"
    }
  },
  "required": [
    "query_status",
    "id",
    "url_status",
    "date_added",
    "threat",
    "tags",
    "blacklists"
  ]
}

Connect

Add this to your MCP client config, or use one-click install buttons:

{
  "mcpServers": {
    "urlhaus": {
      "url": "https://gateway.pipeworx.io/urlhaus/mcp"
    }
  }
}

See Getting Started for client-specific install steps.

lookup_url