The Ohey research MCP server,
connected in one click.

list_threats — Every technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits wi

get_threat — A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares

list_research_articles — Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's fac

get_article — One research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defang

search_etherhiding_contracts — Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current de

get_etherhiding_contract — One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as

get_feed_stats — The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denie

search_clickfix_commands — Hosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the ki