Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it.
The contract address.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
Run in a terminal
claude mcp add --transport http research https://ohey.ca/mcp/research
One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it.
| Argument | Type | Description |
|---|---|---|
| address* | string | The contract address. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"address"
],
"properties": {
"address": {
"type": "string",
"pattern": "^0x[a-fA-F0-9]{40}$",
"description": "The contract address."
}
}
}The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed as legitimate services and kept out. week.added (and daily): hosts that entered the feed. week.entered: website tips that reached review. week.accepted: of those, the ones accepted into the feed. week.removed: tips an analyst rejected at review. week.denied: hosts confirmed legitimate that week. archive: the scanner's captures, the responses in them, host IP observations, response bodies judged malicious or clean, and feed status changes.
No arguments.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {}
}A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and core versions, kits seen together on the same sites, its EtherHiding contracts and the articles about it.
| Argument | Type | Description |
|---|---|---|
| slug* | string | A slug from list_threats, such as clickfix, etherhiding or socgholish. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"slug"
],
"properties": {
"slug": {
"type": "string",
"pattern": "^[a-z0-9-]{1,60}$",
"description": "A slug from list_threats, such as clickfix, etherhiding or socgholish."
}
}
}Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators.
| Argument | Type | Description |
|---|---|---|
| threat | string | Only articles about this technique or kit. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"threat": {
"type": "string",
"pattern": "^[a-z0-9-]{1,60}$",
"description": "Only articles about this technique or kit."
}
}
}Every technique Ohey publishes, with its page, a summary, site counts and its kits.
No arguments.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {}
}Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when Ohey last read each one. Set destination to find the contracts that point, or pointed, at a host.
| Argument | Type | Description |
|---|---|---|
| kit | string | A kit slug, such as clearshort. |
| chain | string | A chain name, such as Polygon or BNB Smart Chain. |
| limit | integer | |
| destination | string | A host or URL, fanged or defanged. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"kit": {
"type": "string",
"pattern": "^[a-z0-9-]{1,60}$",
"description": "A kit slug, such as clearshort."
},
"chain": {
"type": "string",
"maxLength": 40,
"description": "A chain name, such as Polygon or BNB Smart Chain."
},
"limit": {
"type": "integer",
"default": 50,
"maximum": 200,
"minimum": 1
},
"destination": {
"type": "string",
"maxLength": 253,
"description": "A host or URL, fanged or defanged."
}
}
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 4, 2026.