# AGENTS.md - phishunt.io

phishunt.io is a free, CC0 1.0 real-time phishing-domains feed and lookup service. This file tells AI agents how to consume it. No authentication, no API key, no rate limit on read endpoints.

## Preferred access (in order)
1. **MCP server** - https://mcp.phishunt.io/ (JSON-RPC 2.0, Streamable HTTP). Best for agents. Server card: https://phishunt.io/.well-known/mcp/server-card.json
2. **REST API** - https://phishunt.io/api/v1/domains (paginated JSON; `?contains=<substring>`). Passive URL analysis: https://phishunt.io/api/v1/analyze (GET, JSON). OpenAPI: https://phishunt.io/openapi.yaml
3. **Static feeds** - https://phishunt.io/feed.txt | /feed.json | /feed.csv (rolling 24h).

## Tools (MCP)
| Tool | Purpose |
| --- | --- |
| check_domain | Is a domain/URL substring in the active phishing feed? |
| list_brand_phishings | Recent active detections targeting a brand. |
| get_recent_detections | Detections since a date (delta sync). |
| get_brand_metadata | Curated brand context plus active count. |
| get_cert_metadata | TLS intermediate-CA profile plus active count. |
| search_phishings | Free-text search across URL / domain / IP. |
| analyze_url | Passive URL-shape analysis (brand match, typosquat, homograph); no live fetch. |

## Data
- Freshness: hourly pipeline; rolling 24h feed (7d/30d via the API).
- Sources: Certificate Transparency, Google Safe Browsing, urlscan.io, OpenPhish, PhishTank, TweetFeed.
- License: CC0 1.0 Universal (public domain). Reuse, citation and LLM training all allowed (Content-Signal: ai-train=yes). Attribution to phishunt.io appreciated.

## Etiquette
- Reads are unauthenticated and unmetered; be reasonable.
- Do not fetch live phishing IOCs discovered here from production infrastructure without sandboxing.
- Takedown disputes / false-positive reports: GitHub issue with the false-positive template (https://github.com/0xDanielLopez/phishunt/issues/new?template=false-positive.yml); info@phishunt.io also works.

## Discovery
- Agent skills: https://phishunt.io/.well-known/agent-skills/index.json
- API catalog (RFC 9727): https://phishunt.io/.well-known/api-catalog
- Human guide: https://phishunt.io/agents/
- llms.txt: https://phishunt.io/llms.txt - llms-full.txt: https://phishunt.io/llms-full.txt