MalwareBazaar_MCP
About
An AI-driven MCP server that autonomously interfaces with Malware Bazaar, delivering real-time threat intel and sample metadata for authorized cybersecurity research workflows.
Details
- Author
- mytechnotalent
- GitHub stars
- 30
- Downloads
- 393
- Categories
- Other, AI, Developer Tools, Security
Jump to
- Retrieves up to 10 most recent malware samples from MalwareBazaar.
- Returns detailed metadata for a specific malware sample.
- Downloads malware samples for offline analysis.
- Queries samples associated with a given tag.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
MalwareBazaar_MCPCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Obtain an API key from MalwareBazaar (https://auth.abuse.ch/user/me), store it in a .env file as MALWAREBAZAAR_API_KEY=<APIKEY>, set up a Python virtual environment with uv, install dependencies, add the server configuration to your MCP client, and run uv run malwarebazaar_mcp.py.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"malwarebazaar_mcp": {
"MalwareBazaar_MCP": {
"command": "uv",
"args": [
"init",
"."
]
}
}
}
}McpServers
{
"MalwareBazaar_MCP": {
"command": "uv",
"args": [
"init",
"."
]
}
}Interface with Malware Bazaar to get real-time threat intelligence and sample metadata for cybersecurity research.
An AI-driven MCP server that autonomously interfaces with Malware Bazaar, delivering real-time threat intel and sample metadata for authorized cybersecurity research workflows.
get_recent: Get up to 10 most recent samples from MalwareBazaar.
get_info: Get detailed metadata about a specific malware sample.
get_file: Download a malware sample from MalwareBazaar.
get_taginfo: Get malware samples associated with a specific tag.
Step 3a: Create Virtual Env & Install Requirements - MAC/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh cd MalwareBazaar_MCP uv init . uv venv source .venv/bin/activate uv pip install -r requirements.txt
Step 3b: Create Virtual Env & Install Requirements - Windows
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex" cd MalwareBazaar_MCP uv init . uv venv .venv\Scripts\activate uv pip install -r requirements.txt
Step 4a: Add Config to the MCP Client - MAC/Linux
{ "mcpServers": { "malwarebazaar": { "description": "Malware Bazaar MCP Server", "command": "/Users/XXX/.local/bin/uv", "args": [ "--directory", "/Users/XXX/Documents/MalwareBazaar_MCP", "run", "malwarebazaar_mcp.py" ] } } }
Step 4b: Add Config to the MCP Client - Windows
{ "mcpServers": { "malwarebazaar": { "description": "Malware Bazaar MCP Server", "command": "uv", "args": [ "--directory", "C:\Users\XXX\Document\MalwareBazaar_MCP", "run", "malwarebazaar_mcp.py" ] } } }
Help me understnad the latest hash from Malware Bazaar.
python -m unittest discover -s tests uv pip install coverage==7.8.0 coverage run --branch -m unittest discover -s tests coverage report -m coverage html open htmlcov/index.html # MAC xdg-open htmlcov/index.html # Linux start htmlcov\index.html # Windows coverage erase
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Exploit Intelligence Platform MCP Server
An MCP (Model Context Protocol) server that gives AI assistants access to the Exploit Intelligence Platform — hundreds of thousands of vulnerabilities and exploits from NVD, CISA KEV, VulnCheck KEV, InTheWild.io, ENISA EUVD, OSV.dev, EPSS, ExploitDB, Metasploit, GitHub, and more. I
CVE database and vulnerability intelligence for AI agents. Search NIST NVD, check software security, find known vulnerabilities — no API key required.
Real-time CVE lookup via NIST NVD 2.0, CISA KEV alerts, EPSS exploitation probability, and MITRE ATT&CK mappings. 7 tools for AI-powered vulnerability assessment.
Access real-time cyber and threat intelligence, including details on vulnerabilities, threat actors, and malware.
The NVD CVE MCP Server is a powerful security research tool
MCP-native OSINT framework for AI agents. Exposes 9 intelligence tools (email enumeration, username search, breach check, WHOIS, IP intel, subdomain enum, dorks, paste search, phone intel) via Model Context Protocol. Also works as a standalone Python CLI.
TI Mindmap HUB MCP Server provides AI assistants with direct access to curated threat intelligence — reports, CVEs, IOCs, STIX bundles, and weekly briefings — through the Model Context Protocol.
Discover mobile app attack surfaces via BeVigil OSINT — hosts, subdomains, URLs, and more.
Interact with Binalyze AIR's digital forensics and incident response capabilities using natural language.
Manage threat models, components, and security data on the Devici platform.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
