Malwarebytes

Check a link, phone number or email against Malwarebytes threat intelligence before you click, call or reply.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Malwarebytes connector does

The Malwarebytes MCP server lets Claude check a link, phone number, email address or domain against Malwarebytes threat intelligence before you click, call or reply. It exposes 6 tools, needs no account and no sign-in, and returns one of four verdicts. Five tools only read. The sixth submits a report to Malwarebytes and is annotated destructive.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Malwarebytes tools (6)

  • reputation-check_linkRead-only

    Use this when you need to check if a link or URL is safe, suspicious, or malicious. Provides reputation verdict based on threat intelligence database. Returns one of: - malicious: Confirmed harmful link - suspicious: Potentially dangerous link - safe: Verified safe link - unknown: No threat intelligence available Cross-tool workflow: - For unknown or suspicious verdicts, consider using reputation-whois to check domain registration details (age, registrar, abuse contact). - If the URL redirects to a different domain, consider scanning the destination URL separately. - If the URL came from an email or text message, consider checking the sender with reputation-check_email or reputation-check_phone. Do not use this for general web searches, content fetching, or webpage analysis.

  • reputation-check_phoneRead-only

    Use this when you need to check if a phone number is associated with scams or suspicious activity. Provides reputation verdict and additional phone information. Returns one of: - malicious: Confirmed scam or spam phone number - suspicious: Potentially dangerous number - safe: Verified legitimate number - unknown: No threat intelligence available Also provides optional details like carrier, location, and phone type when available. Cross-tool workflow: - If the caller provided links, consider scanning them with reputation-check_link. - If the caller provided email addresses, consider scanning them with reputation-check_email. Do not use this for phone number lookups, caller ID services, or general phone directory searches.

  • reputation-check_emailRead-only

    Use this when you need to check if an email address is associated with phishing, scams, or malicious activity. Checks the email domain against threat intelligence database. Returns one of: - malicious: Confirmed phishing or malicious email domain - suspicious: Potentially dangerous email domain - safe: Verified legitimate email domain - unknown: No threat intelligence available Cross-tool workflow: - If the email contains URLs, consider scanning them with reputation-check_link. - If the email contains phone numbers, consider scanning them with reputation-check_phone. - For unknown or suspicious verdicts, consider using reputation-whois to check domain registration details (age, registrar, abuse contact). Do not use this for email validation, mailbox verification, or general email lookup services.

  • reputation-reportDestructive

    Use this when a user wants to report a suspicious link, email address, or phone number. Submits the indicator to the threat intelligence system for analysis. Only use when explicitly requested by the user. Do not use this to automatically report every checked item.

  • reputation-whoisRead-only

    Use this when you need to look up domain registration information to verify legitimacy or identify suspicious patterns. Provides WHOIS/RDAP data including registrar, registration dates, name servers, and abuse contacts. Particularly useful for identifying newly registered domains (common in phishing and scams). Returns the registrar's abuse contact email when available, which can be used for filing complaints about fraudulent domains. Cross-tool workflow: - Consider using reputation-check_link to check the domain's threat reputation alongside WHOIS registration data. Do not use this for general domain availability checks or bulk domain searches.

  • reputation-scan_allRead-only

    Use this when you need to check multiple links, emails, or phone numbers at once. Scans all indicators concurrently and returns a unified result. Each indicator needs: - type: 'url', 'email', or 'phone' - value: the URL, email address, or phone number (E.164 format for phones) Returns a summary with counts per verdict and individual results for each indicator. Prefer this over individual scan tools when 3 or more indicators are present. Maximum 10 indicators per request. Cross-tool workflow: - For unknown URL or email verdicts, consider using reputation-whois on the associated domains for additional registration context and abuse contact information.

Read from the server on 2026-08-16, including each tool's own safety annotations.

Limits

  • It is not device protection. No tool scans a machine, removes malware or monitors anything. Six indicator lookups and one report submission are the whole surface.
  • One tool writes outward. reputation-report is annotated destructive because it submits an indicator to Malwarebytes, which its Scam Guard documentation says may be added to the protection database. There is no tool that withdraws a submission.
  • "Unknown" is not "safe." Malwarebytes states plainly that an unknown verdict means no information is available and warns readers to remain careful. Four verdicts, and only one of them is reassuring.
  • An email check tests the domain. reputation-check_email checks the sender's domain, so a clean verdict does not vouch for the individual address.
  • Ten indicators per call. reputation-scan_all caps a single request at 10, per its own tool description.
  • Phone numbers need E.164 format. reputation-check_phone requires the international form, such as a leading + and country code.
  • No published rate limits or error codes. Malwarebytes' connector article has no troubleshooting or rate-limit section; it directs problems to Malwarebytes Support and connector questions to Claude Support.
  • The 6 resources are UI, not more data. resources/list on 2026-08-19 returned six ui:// widget templates mirroring the six tools, plus zero prompts. They are rendering surfaces for a supporting client, so nothing about them widens what this connector can look up. We listed them without reading their contents.
  • We did not exercise any tool. Our check was a read-only tools/list handshake. We deliberately did not call reputation-report, because doing so would have submitted a real indicator to a live threat intelligence system.

Frequently asked questions

Why is reputation-report annotated destructive when it only files a report?

Because it writes to Malwarebytes rather than to you. The tool submits an indicator to the threat intelligence team, and Malwarebytes says a submitted item can be added to its protection database. The submission cannot be recalled from the conversation, so the vendor flags an outbound, irreversible write even though nothing on your side changes.

Does the Malwarebytes connector scan my computer for malware?

No. All six tools take a URL, phone number, email address or domain as text and return a verdict from threat intelligence. Malwarebytes describes the connector as checking items you share in the conversation. Nothing reads your files, monitors your device or removes anything, so it does not replace antivirus software.

Do you need a Malwarebytes subscription to use the MCP server?

No. Malwarebytes states that no subscription or account is needed and that it works for both paid and free Claude users. Its April 2026 announcement calls the connector free with no Malwarebytes account required. We confirmed the endpoint completes an anonymous handshake on 2026-08-16.

What do the malicious, suspicious, safe and unknown verdicts mean?

They rank confidence, not severity. Malwarebytes defines malicious as a confirmed threat, suspicious as risky context without a confirmed threat, and safe as known and legitimate. Unknown means the database holds no information — and Malwarebytes warns explicitly that unknown does not mean safe, which is the verdict most likely to be misread.

What data does Malwarebytes receive from my conversation?

Only the indicators you share. Malwarebytes states that just the specific items sent — links, phone numbers or email addresses — reach its threat intelligence service, and that conversation messages and personal information are not stored. For a report it says only the indicator and its type are submitted, with no conversation content included.

Sources

More Productivity connectors

  • 6sense

    Ask an AI agent about 6sense account insights, buying signals and keyword trends.

  • Adobe Workfront

    Find, create, update and delete Workfront work items from an AI agent.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Malwarebytes to work.

Connect Malwarebytes once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio
Call (650) 285-1019Our AI receptionist answers.