{
  "$schema": "https://raw.githubusercontent.com/modelcontextprotocol/modelcontextprotocol/main/schema/2025-06/server-card.schema.json",
  "serverInfo": {
    "name": "phishdestroy-cti",
    "version": "1.0.0",
    "description": "PhishDestroy public CTI — query active phishing-domain intelligence. Covers 134K+ tracked domains, registrar accountability, campaign clustering, hosting geography.",
    "homepage": "https://phishdestroy.io",
    "documentation": "https://phishdestroy.io/llms-full.txt",
    "license": "CC-BY-4.0",
    "vendor": {
      "name": "PhishDestroy",
      "url": "https://phishdestroy.io",
      "email": "abuse@phishdestroy.io"
    }
  },
  "transport": {
    "type": "http",
    "endpoint": "https://phishdestroy.io/api/probe.php",
    "auth": { "type": "none" }
  },
  "capabilities": {
    "tools": {
      "listChanged": false
    },
    "resources": {
      "subscribe": false,
      "listChanged": false
    },
    "prompts": { "listChanged": false }
  },
  "tools": [
    {
      "name": "probe_domain",
      "description": "Live-probe a domain to determine if it is serving content. Returns HTTP status, response method, and liveness flag. Cached 15 min.",
      "inputSchema": {
        "type": "object",
        "properties": {
          "domain": { "type": "string", "description": "Domain to probe (e.g. example.com). No protocol, no path." },
          "type": { "type": "string", "enum": ["liveping", "redirect", "cdnbypass"], "default": "liveping" }
        },
        "required": ["domain"]
      },
      "endpoint": "https://phishdestroy.io/api/probe.php"
    },
    {
      "name": "get_platform_stats",
      "description": "Get aggregate platform counters: total tracked domains, alive, dead, recent additions.",
      "inputSchema": { "type": "object", "properties": {} },
      "endpoint": "https://phishdestroy.io/api/stats.php"
    },
    {
      "name": "get_domain_report",
      "description": "Retrieve the full threat-intelligence report for a domain as markdown. Includes VT detections, registrar, hosting geo, AI-generated summary, evidence, blocklists.",
      "inputSchema": {
        "type": "object",
        "properties": {
          "domain": { "type": "string", "description": "Domain to look up" }
        },
        "required": ["domain"]
      },
      "endpoint": "https://phishdestroy.io/domain/{domain}/llm.txt"
    }
  ],
  "resources": [
    {
      "uri": "https://phishdestroy.io/llms.txt",
      "name": "PhishDestroy LLM index",
      "mimeType": "text/plain",
      "description": "Top-level LLM-readable index of the platform"
    },
    {
      "uri": "https://phishdestroy.io/llms-full.txt",
      "name": "PhishDestroy LLM full documentation",
      "mimeType": "text/plain",
      "description": "Full LLM-readable documentation"
    },
    {
      "uri": "https://phishdestroy.io/feed-threats.xml",
      "name": "Live threat detection feed",
      "mimeType": "application/atom+xml",
      "description": "Atom feed of newly detected phishing domains"
    }
  ],
  "sampling": { "supported": false }
}