Protect AI workflows with Malwarebytes security intelligence. Scan URLs, files, domains, and IP addresses for malware, phishing, scams, and other online threats using Malwarebytes threat detection capabilities.
Codex is OpenAI's coding agent for the terminal. It reads MCP servers from its config and signs in to remote ones with OAuth.
This guide connects Malwarebytes MCP to Codex through MewCP, so Codex can use Malwarebytes MCP's 6 tools, like reputation-check_link, reputation-check_phone and reputation-check_email.
Malwarebytes MCP needs no credentials, but every call still runs through MewCP: scoped, checked and logged like any other.
More apps
Clerk enables AI agents to manage application authentication, user accounts, organizations, sessions, and access permissions, including inspecting user profiles and configuring authentication workflows.
OnChainDiligence helps AI agents evaluate autonomous payment proposals against caller-defined policies, retrieve signed payment receipts, and independently verify receipt integrity and authenticity. Provides evidence for auditing agent payment decisions without holding funds, signing transactions, or executing payments.
iubenda automates website privacy compliance by creating and managing privacy policies, cookie policies, terms and conditions, consent banners, and third-party service disclosures. Scan websites for trackers and update legal documents to support GDPR, ePrivacy, and US privacy law compliance.
CourtListener provides searchable access to U.S. case law, court opinions, dockets, judicial decisions, and legal filings. Find cases by citation, keyword, court, or judge; retrieve opinion texts and docket records; and research legal precedents using data from federal and state courts.
Other clients
Malwarebytes MCP works the same way in every client below. Pick yours for its own guide.
Free to start.
Scope access to the exact Malwarebytes MCP tools and accounts you allow, work and personal side by side. Anything outside that scope is refused at call time, even when the model asks for it.
Each call is logged: what ran, on which account, and whether it worked. Failures come back structured, so the agent knows whether to retry instead of guessing.
Every app sits behind one secure MCP URL, and there is no server for you to deploy or keep running. Add an integration in the dashboard and it is live on the next call, with no config to change and no new credentials to wire up. Tools load only when a task needs them, so your agent stays fast and focused however many apps you connect.
Run this and approve access in the browser window.
Start a new chat and ask: "List the tools you can use from MewCP." You should see your connected apps.
Use this when you need to check if a link or URL is safe, suspicious, or malicious. Provides reputation verdict based on threat intelligence database. Returns one of: - malicious: Confirmed harmful link - suspicious: Potentially dangerous link - safe: Verified safe link - unknown: No threat intelligence available Cross-tool workflow: - For unknown or suspicious verdicts, consider using reputation-whois to check domain registration details (age, registrar, abuse contact). - If the URL redirects to a different domain, consider scanning the destination URL separately. - If the URL came from an email or text message, consider checking the sender with reputation-check_email or reputation-check_phone. Do not use this for general web searches, content fetching, or webpage analysis.
Use this when you need to check if a phone number is associated with scams or suspicious activity. Provides reputation verdict and additional phone information. Returns one of: - malicious: Confirmed scam or spam phone number - suspicious: Potentially dangerous number - safe: Verified legitimate number - unknown: No threat intelligence available Also provides optional details like carrier, location, and phone type when available. Cross-tool workflow: - If the caller provided links, consider scanning them with reputation-check_link. - If the caller provided email addresses, consider scanning them with reputation-check_email. Do not use this for phone number lookups, caller ID services, or general phone directory searches.
Use this when you need to check if an email address is associated with phishing, scams, or malicious activity. Checks the email domain against threat intelligence database. Returns one of: - malicious: Confirmed phishing or malicious email domain - suspicious: Potentially dangerous email domain - safe: Verified legitimate email domain - unknown: No threat intelligence available Cross-tool workflow: - If the email contains URLs, consider scanning them with reputation-check_link. - If the email contains phone numbers, consider scanning them with reputation-check_phone. - For unknown or suspicious verdicts, consider using reputation-whois to check domain registration details (age, registrar, abuse contact). Do not use this for email validation, mailbox verification, or general email lookup services.
Use this when a user wants to report a suspicious link, email address, or phone number. Submits the indicator to the threat intelligence system for analysis. Only use when explicitly requested by the user. Do not use this to automatically report every checked item.
Use this when you need to look up domain registration information to verify legitimacy or identify suspicious patterns. Provides WHOIS/RDAP data including registrar, registration dates, name servers, and abuse contacts. Particularly useful for identifying newly registered domains (common in phishing and scams). Returns the registrar's abuse contact email when available, which can be used for filing complaints about fraudulent domains. Cross-tool workflow: - Consider using reputation-check_link to check the domain's threat reputation alongside WHOIS registration data. Do not use this for general domain availability checks or bulk domain searches.
Use this when you need to check multiple links, emails, or phone numbers at once. Scans all indicators concurrently and returns a unified result. Each indicator needs: - type: 'url', 'email', or 'phone' - value: the URL, email address, or phone number (E.164 format for phones) Returns a summary with counts per verdict and individual results for each indicator. Prefer this over individual scan tools when 3 or more indicators are present. Maximum 10 indicators per request. Cross-tool workflow: - For unknown URL or email verdicts, consider using reputation-whois on the associated domains for additional registration context and abuse contact information.
