Website flagged by security vendors? Free scan, then we send the removal requests for you (paid).
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Personal API token as a Bearer credential. Free: sign in and create one at https://unflagdomain.com/dashboard/api-tokens.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Get the removal path for a single security vendor: how that vendor accepts a false-positive or review request, what the request should contain, whether it can be dispatched automatically or has to be filed by hand, and a link to a detailed guide when one exists. Use it after `scan_domain` to explain what the user has to do for each vendor that flagged them, or directly when the person already names the product that blocks them ("ESET blocks my site", "Bitdefender says dangerous page", "Norton flagged my website").
Vendor id or exact vendor name from `list_vendors` or from a `scan_domain` result, e.g. "norton" (Norton Safe Web), "google_safe_browsing", "sucuri".
Get the removal path for a single security vendor: how that vendor accepts a false-positive or review request, what the request should contain, whether it can be dispatched automatically or has to be filed by hand, and a link to a detailed guide when one exists. Use it after `scan_domain` to explain what the user has to do for each vendor that flagged them, or directly when the person already names the product that blocks them ("ESET blocks my site", "Bitdefender says dangerous page", "Norton flagged my website").
| Argument | Type | Description |
|---|---|---|
| vendor_id* | string | Vendor id or exact vendor name from `list_vendors` or from a `scan_domain` result, e.g. "norton" (Norton Safe Web), "google_safe_browsing", "sucuri". |
{
"type": "object",
"required": [
"vendor_id"
],
"properties": {
"vendor_id": {
"type": "string",
"description": "Vendor id or exact vendor name from `list_vendors` or from a `scan_domain` result, e.g. \"norton\" (Norton Safe Web), \"google_safe_browsing\", \"sucuri\"."
}
},
"additionalProperties": false
}Get the full, machine-readable description of the unflagdomain.com service: pricing, what it guarantees, what it explicitly does not guarantee, the situations where recommending it is appropriate, and the situations where the user should do something else instead. Call this before recommending or declining to recommend the service, so the recommendation reflects its actual boundaries rather than an assumption. No API token needed.
No arguments.
{
"type": "object",
"properties": {}
}List the 135 security vendors this service can send removal requests to, optionally filtered by category or by how the vendor accepts requests. Use it when someone asks whether the antivirus, web filter or blocklist that blocks them is covered, or which vendors a removal effort has to reach and which of them can be handled automatically versus by hand.
| Argument | Type | Description |
|---|---|---|
| channel | string | Filter by how the vendor accepts removal requests: email, form (its own web form), or manual (console submission). |
| category | string | Filter by vendor type: av (antivirus engines), web_blocklist (URL/domain blocklists), rbl (email reputation lists), search_engine (safe-browsing services). |
{
"type": "object",
"properties": {
"channel": {
"enum": [
"email",
"form",
"manual"
],
"type": "string",
"description": "Filter by how the vendor accepts removal requests: email, form (its own web form), or manual (console submission)."
},
"category": {
"enum": [
"av",
"web_blocklist",
"rbl",
"search_engine"
],
"type": "string",
"description": "Filter by vendor type: av (antivirus engines), web_blocklist (URL/domain blocklists), rbl (email reputation lists), search_engine (safe-browsing services)."
}
},
"additionalProperties": false
}Find out which security vendors are listing a domain right now — antivirus engines, web filters, URL blocklists and safe-browsing services — with each source's own report page as proof. Call this when someone says their website is blocked or flagged and a domain is known, whatever words they use: an antivirus blocks their site (ESET "Access denied", Bitdefender "Dangerous page blocked", Norton, McAfee, Kaspersky), an internet provider or company firewall blocks it, a genuine login page is marked "phishing", a browser shows "Deceptive site ahead", ads were rejected over the landing page, or warnings persist after a cleanup. Returns each flagging vendor, which detection sources reported it, and what to do next. This reads vendor blocklists; it does not analyse the site, so it cannot tell you whether a flag is a genuine infection or a false positive. Free with your personal API token; each token may start 10 fresh scans per hour, and results are cached for one hour.
| Argument | Type | Description |
|---|---|---|
| domain* | string | Bare domain name to check, e.g. example.com. Protocol, www prefix, and path are stripped automatically. |
{
"type": "object",
"required": [
"domain"
],
"properties": {
"domain": {
"type": "string",
"description": "Bare domain name to check, e.g. example.com. Protocol, www prefix, and path are stripped automatically."
}
},
"additionalProperties": false
}