About Malware Sandbox MCP
Malware Sandbox MCP is an MCP server in the Files category: detonate files & URLs in cloud malware sandboxes (Hybrid Analysis, tria.ge, ANY.RUN) and enrich IOCs across MalwareBazaar, ThreatFox, URLhaus, Feodo, URLScan & VirusTotal — straight from Claude. BYOK, async, MITRE ATT&CK.
Install
git clone https://github.com/mukul975/Malware-Sandbox-mcpThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (4)
get_analysis_stateLightweight status poll (and raw lifecycle detail) for a submission.
Parameters not published.
get_quotaAPI quota / usage limits for one backend.
Parameters not published.
get_reportOne async poll of a submission; returns `working` or the final normalized + ATT&CK-enriched report.
Parameters not published.
submit_sampleSubmit a file or URL to a detonation sandbox (Hybrid Analysis / tria.ge / ANY.RUN). Returns a `task_id` immediately.
Parameters not published.
Ask AI
Ask AI about Malware Sandbox MCP
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.