Ohey research

Connect Remote server

claude mcp add --transport http research https://ohey.ca/mcp/research

{
  "mcpServers": {
    "research": {
      "url": "https://ohey.ca/mcp/research"
    }
  }
}

{
  "servers": {
    "research": {
      "type": "http",
      "url": "https://ohey.ca/mcp/research"
    }
  }
}

Settings > Connectors > Add custom connector
URL: https://ohey.ca/mcp/research

Tools 8 found in our last check

• list_threats

  Every technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits with names and site counts in one call.

• get_threat

  A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and core versions, kits seen together on the same sites, its EtherHiding contracts, the hosts its ClickFix commands fetch…

• list_research_articles

  Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facts and indicators.

• get_article

  One research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defanged as published. Read the page at url for the full write-up.

• search_etherhiding_contracts

  Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when Ohey last read each one. firstSeen is the day Ohey first read the contract, not when it was deployed; many contracts sh…

• get_etherhiding_contract

  One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as an array, one entry per chain the address is tracked on (usually one), each with history: its 20 most recent changes, and historyCapped is…

• get_feed_stats

  The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed as legitimate services and kept out. week.added (and daily): hosts that entered the feed. week.entered: website tips tha…

• search_clickfix_commands

  Hosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kits credited with each (a ClickFix kit is credited when it is on at least half the sites whose command used the host), sites whose captured…

Details

More security servers See all

• BlackVeil DNS & Email Security Scanner

  DNS and email security scanner with 82 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.

• Forwardsmith buyer desk (read-only)

  Read-only desk for buyers and assistants: offer, prices, fit check, readiness scan, intake draft.

• MakeItSay

  Change the words in a screenshot or photo and keep the original font and layout.

• Kestrova Solidity Security Scan

  Free Slither scan of Solidity contracts for AI coding agents; optional paid report (1 USDC, x402).

• Paragon Boxing & BJJ Gear Advisor

  Read-only boxing and BJJ gear guidance, sizing, product comparison, rules and identity checks.

• Spurvik EU AI Act

  Live URL scan, AI Act risk check, 24-EU-language Art. 50 badge, HMAC receipts & approval gates.