PhishSpot

PhishSpot — connector documentation

• MCP endpoint: https://phishspot.connectorbay.com/mcp
• REST API: POST https://phishspot.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://phishspot.connectorbay.com/openapi.json
• Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
• Authentication: none required. An optional Authorization: Bearer <key> raises rate limits.
• Health: https://phishspot.connectorbay.com/health · Tool schemas: https://phishspot.connectorbay.com/tools.json
• Publisher: Unify Dynamics LLC · connectorbay.com/phishspot · agent@connectorbay.com

What PhishSpot is for

An email or text looks almost right — almost the right sender, almost the right link — and you need to know what to check before you click anything. PhishSpot answers that from a hand-curated red-flags reference, plus a real computed check for one of phishing's most common tricks: a domain built to look like a brand you trust.

PhishSpot never fetches, visits, resolves, or scans a real URL, email, or attachment. The lookalike-domain check is a pure local string-similarity calculation against a bundled list of well-known brand domains, never a live reputation, DNS, or safe-browsing lookup.

What it does

list_red_flag_categories and get_red_flag_category cover six real phishing red-flag categories — urgency/ fear tactics, suspicious sender-domain mismatches, generic greetings, requests for credentials via a link, too-good-to-be-true offers, and unexpected attachments — each with concrete example phrasing. url_inspection_guide explains how to check a link's real destination before clicking: hovering or long-pressing to preview it, reading a domain right-to-left to find the actual registered domain (not a deceptive subdomain), and spotting lookalike-character tricks. check_lookalike_domain is a REAL computed heuristic — it Levenshtein edit-distance-compares a suspicious domain against a bundled list of ~29 well-known brand domains (or a caller-supplied list) and flags likely character-substitution impersonation, such as arnazon.com for amazon.com or rnicrosoft.com for microsoft.com, while correctly leaving genuinely unrelated domains unflagged. what_to_do_if_clicked_checklist covers recovery steps if you already clicked a phishing link or opened a malicious attachment.

What it is not

PhishSpot is not a live URL scanner, safe-browsing service, or antivirus tool — check_lookalike_domain never fetches, resolves, or visits the domain it's given; it only compares the text of the domain string itself against known brand names. It is not a spam filter or email-security product — it doesn't inspect your actual inbox or messages, only whatever text or domain you describe to it. And a domain that isn't flagged is not a guarantee of safety — the lookalike check catches one common trick (character substitution against well-known brands), not every possible phishing technique.

Tools

Red-flag catalog

list_red_flag_categories — The full catalog of phishing red-flag categories, each with a one-line description.

get_red_flag_category — Full detail on one category: description and real example phrasing/patterns. Args: category.

Links

url_inspection_guide — How to check a link's real destination before clicking, without visiting it.

check_lookalike_domain — A real Levenshtein edit-distance comparison of a domain against well-known brand domains, flagging likely character-substitution impersonation. Args: domain, brand_domains, max_results.

Recovery

what_to_do_if_clicked_checklist — What to do if you already clicked a phishing link or opened a malicious attachment.

Conventions

• Read-only. Every tool reads bundled reference data or computes a string comparison from arguments; nothing is written anywhere and nothing about the user is stored.
• Result envelope. ok: true with data, or ok: false with a structured error (bad_input).
• Rate limits. Free tier 60 tool calls/minute and 300/day per user (keyed on the user identifier supplied by the host agent, else client IP); Pro keys raise this. Over-limit calls return HTTP 429 with Retry-After. initialize and tools/list are never counted.

Support

agent@connectorbay.com · connectorbay.com/phishspot/support

PhishSpot — Privacy Policy

Effective 28 September 2026. Unify Dynamics LLC ("we", "us"), Menlo Park, California.

What PhishSpot is. PhishSpot is a connector (an MCP server and REST API) that AI assistants and personal agents call on your behalf for phishing red-flags education and a lookalike-domain string comparison. You interact with your assistant; the assistant sends us only the arguments needed for that one lookup or calculation.

PhishSpot never fetches, visits, resolves, or scans a real URL, email, or attachment. check_lookalike_domain compares the text of a domain you provide against a bundled list of well-known brand domain names — it makes no network request, DNS lookup, or connection to that domain or to any other third party. It is not a safe- browsing or reputation service.

What we receive. The arguments of each tool call — for example, a red-flag category name or a domain string like "arnazon.com" — the technical headers needed to serve the request (an IP address or a client identifier supplied by the assistant, and a Pro API key if you have one), and standard server logs.

Everything is answered from a bundled reference file or computed locally, and nothing is stored. No request is forwarded to any third party — there is no upstream call at all, including for the domain you ask us to check — and no query is logged in request bodies, recorded, or used to train anything. Each request is answered independently and nothing carries over between requests; PhishSpot does not build a profile of what emails, links, or domains you've been checking.

What we do not receive or store. We do not receive your actual email or text message content, the full URL you clicked, your name, or a copy of any file. check_lookalike_domain only ever receives the domain string itself (e.g. "arnazon.com"), not a full email or a browsing history. Rate-limit counters (a client identifier and timestamps) are held in memory for at most 24 hours. Hosting-provider access logs, which contain IP addresses and request paths but not request bodies, are retained for up to 30 days for security and abuse prevention.

Sub-processors. None — the reference dataset is bundled with the server and every response is computed locally. Hosting: Vercel (United States regions).

Legal bases and your rights. Our processing is necessary to provide the service you request through your assistant. Because we store no personal data beyond short-lived logs, requests to access, correct, or delete personal data are usually satisfied automatically; you can still contact agent@connectorbay.com and we will respond within 30 days. We do not sell or share personal information and do not use your data to train models.

Not a phishing-reporting channel. If you received a phishing email, forward it to reportphishing@apt-wg.org or use your email provider's reporting feature; for phishing text messages, forward to 7726 (SPAM) in the US. PhishSpot does not file reports on your behalf.

Changes. We will post changes here with a new effective date.

PhishSpot — Terms of Service

Effective 28 September 2026. These terms govern use of the PhishSpot connector ("the Service") operated by Unify Dynamics LLC ("we", "us").

1. The Service. PhishSpot returns hand-curated phishing red-flags REFERENCE and EDUCATION — red-flag categories with examples, a URL-inspection guide, a computed lookalike-domain string comparison, and a what-to-do-if-clicked recovery checklist — from data bundled with the server and computation over your arguments. It is accessed through an AI assistant or directly over MCP or HTTP.
2. Not a URL scanner, safe-browsing, DNS, or antivirus service. PhishSpot does NOT fetch, visit, resolve, or scan any real URL, email, attachment, or file. check_lookalike_domain compares the text of a domain string against known brand names only; it makes no network connection to that domain or to any third party. A domain not flagged is not a certification of safety, and a domain flagged is not proof of malice.
3. Not a substitute for your own judgment or your email/security provider's tools. This Service is a general educational reference. It does not inspect your actual inbox, messages, or files, and it is not a replacement for your email provider's spam/phishing filtering, your device's antivirus software, or your own caution before clicking a link or opening an attachment.
4. Individual results vary. Real phishing tactics vary and evolve constantly, and new impersonation techniques emerge regularly. The red-flag categories and lookalike-domain detection here are widely reported starting points, not an exhaustive list, and they cannot catch every possible phishing technique.
5. Acceptable use. Automated use within the published rate limits is welcome. Do not represent PhishSpot's output as a security certification, malware scan result, or legal determination to any third party.
6. Availability. The Service is provided "as is" without warranty of any kind. We may change, limit, or discontinue it at any time.
7. Data. Our Privacy Policy describes what we process. In short: your query is answered from a bundled reference file or computed locally from the domain string you provide, and nothing is stored. No real URL is ever fetched, and no email or file content is ever processed.
8. Pro keys. Optional Pro API keys are issued at our discretion, are personal to the holder, and may be revoked for abuse.
9. Liability. To the fullest extent permitted by law, Unify Dynamics LLC is not liable for any loss — including loss arising from a phishing attack — arising from use of or reliance on the Service in place of independent verification, your own security tools, or professional advice. Our total liability is limited to US $100.
10. Governing law. California law; venue in San Mateo County, California.
11. Contact. Unify Dynamics LLC · agent@connectorbay.com · https://connectorbay.com/phishspot

PhishSpot support

Email agent@connectorbay.com. We answer within two business days.

• MCP endpoint: https://phishspot.connectorbay.com/mcp
• REST API: https://phishspot.connectorbay.com/openapi.json
• Live status: https://phishspot.connectorbay.com/health

When you report a problem, include the question you asked your agent, roughly when, and which agent you used (for example Claude, ChatGPT or Gemini). Never send us passwords, account numbers or ID numbers. PhishSpot never asks for them.