# ghostkit.net

> Security tools directory, browser toolkit, URL scanner, and MCP server for AI-assisted security workflows.

ghostkit helps security researchers, malware analysts, and developers inspect suspicious web code, scan URLs for threats, and integrate security tools into AI workflows via MCP.

## Site Structure

- /                     Homepage
- /providers            Directory of external security tool providers
- /providers/{slug}     Individual tool page with features, pricing, reviews
- /categories/{slug}    Tools filtered by category
- /toolkit              33 browser-based security tools (all client-side)
- /toolkit/{slug}       Individual kit tool page
- /recon                URL intelligence scanner (multi-phase threat analysis)
- /recon/{id}           Scan result with risk score, headers, DNS, TLS, threats
- /mcp                  MCP server documentation (36 tools for Claude, Cursor, etc.)
- /learn                5-chapter security investigation course
- /learn/{slug}         Individual course chapter
- /techniques           22 security technique reference pages
- /techniques/{slug}    Individual technique deep-dive
- /jobs                 Security job listings aggregator
- /pricing              Free and Pro tier comparison
- /llms-full.txt        Extended version with full tool descriptions

## Toolkit Categories

### Decode & Transform
- JS Deobfuscator - Decode hex, unicode, base64, unpack eval()
- Encoder/Decoder - Base64, Hex, URL, HTML entities, Unicode, Octal
- JWT Decoder - Inspect headers, payloads, claims, expiry
- SAML Decoder - Decode SAML responses and assertions
- Base64 Image Viewer - Preview hidden embedded images
- QR Code Reader/Generator - Read and create QR codes

### Inspect & Analyze
- URL Analyzer - Phishing indicators, homoglyphs, defang
- Email Headers - SPF/DKIM/DMARC checks, spoofing detection
- CSP Analyzer - Content-Security-Policy grading A-F
- CORS Checker - Detect wildcard origins, credential leaks
- Character Inspector - Homoglyphs, zero-width, mixed scripts
- Cookie Analyzer - Secure/HttpOnly/SameSite flag checks
- Entropy Analyzer - Shannon entropy, encryption detection
- Hex Viewer - Binary inspection with magic byte detection
- EXIF Viewer - Image metadata and GPS extraction
- HTTP Response Inspector - Parse headers, flag misconfigurations
- Certificate Decoder - X.509 subject, SANs, expiry, key strength
- CSR Decoder - Certificate Signing Request inspection
- DNS Lookup - A, AAAA, MX, TXT, NS, CNAME, SOA records
- SSH Key Analyzer - Key type, bit strength, fingerprints

### Format & Compare
- JSON Formatter - Validate, tree view, path copying
- YAML/TOML Formatter - Validate, convert to JSON
- Code Diff - Side-by-side comparison
- Regex Tester - Real-time matching with security patterns
- Timestamps - Unix/ISO conversion, date math
- Cron Parser - Plain English, next runs, presets
- XML Formatter - Validate, format, element counting
- SQL Formatter - Format, minify, table/join analysis
- HTML Prettifier - Format, element/class counting

### Crypto & Network
- Hash Generator - MD5, SHA-1, SHA-256, SHA-512
- Password Generator - Secure passwords and passphrases
- RSA/EC Key Generator - PEM keypairs via Web Crypto API
- HMAC Generator - SHA-256/512 signatures for webhooks
- UUID Generator - v4 generation, v1/v7 parsing
- TOTP Generator - Time-based one-time passwords
- IP/CIDR Calculator - Subnet masks, CIDR ranges

### Web3 & Blockchain
- Keccak-256 Hasher - Ethereum selectors and event topics
- ABI Decoder - Transaction calldata to function calls
- Transaction Decoder - Raw RLP-encoded Ethereum TX parsing

## MCP Server

36 tools available via Model Context Protocol (Streamable HTTP, spec 2025-06-18) for Claude, Cursor, Windsurf, and other MCP clients. Endpoint: https://ghostkit.net/api/mcp with X-API-Key header. Setup guide at /mcp.

## URL Scanner (Recon)

Multi-phase async analysis: HTTP headers, DNS, WHOIS, TLS, threat feeds, source code analysis, phishing detection, JS deobfuscation. Produces a 0-100 risk score.

## Learn

5-chapter course covering URL analysis, JavaScript deobfuscation, phishing email investigation, PHP malware decoding, and building security workflows.

## API Access

REST API with API key authentication. Endpoints for scan submission, tool execution, and MCP integration. Free tier: 5 scans/day. Pro tier: 200 scans/day.

## Contact

Website: https://ghostkit.net
Email: info@ghostkit.net

## Last Updated

March 2026