Cyberbro
About
Extracts Indicators of Compromise (IoCs) from text and checks their reputation using multiple threat intelligence services.
Details
- Author
- stanfrbd
- Categories
- Other, Security
Jump to
Setup
Install Cyberbro in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/stanfrbd/mcp-cyberbro
Follow the installation instructions in the repository README, then restart your MCP client.
Extract IoCs from messy text and analyze them with Cyberbro.
🌐demo.cyberbro.net
Model Context Protocol server for Cyberbro.
This project is packaged as a standard Python distribution and can be launched with:
- uvx mcp-cyberbro
- pip install mcp-cyberbrothenmcp-cyberbro
- Analyze observables (IP, domain, URL, hash, etc.) via Cyberbro engines.
- Integrate threat-analysis actions directly in MCP-capable assistants.
- Run withstdio,sse, orstreamable-httptransports.
- Compatible with any MCP client that supports one of these transports.
uvx mcp-cyberbro --cyberbro_url http://localhost:5000
pip install mcp-cyberbro mcp-cyberbro --cyberbro_url http://localhost:5000
pip install -e . mcp-cyberbro --cyberbro_url http://localhost:5000
Default container command starts instreamable-httpmode on port8000.
docker run --rm -p 8000:8000 \ -e CYBERBRO_URL=http://host.docker.internal:5000 \ ghcr.io/stanfrbd/mcp-cyberbro:latest
To run instdiomode, a custom Dockerfile is required:
FROM ghcr.io/stanfrbd/mcp-cyberbro:latest CMD ["mcp-cyberbro", "--transport", "stdio"]
docker build -t mcp-cyberbro-stdio . docker run -i --rm -e CYBERBRO_URL=http://host.docker.internal:5000 mcp-cyberbro-stdio
- CYBERBRO_URL
- API_PREFIX(default:api)
- SSL_VERIFY(true/false)
- MCP_TRANSPORT(stdio,sse,streamable-http)
- MCP_HOST
- MCP_PORT
- MCP_MOUNT_PATH
- MCP_SSE_PATH
- MCP_STREAMABLE_HTTP_PATH
CLI flags are also available and override env values.
You can use this server with Claude Desktop, Claude Code, Cursor, OpenAI-compatible MCP clients, or any other MCP client.
{ "mcpServers": { "cyberbro": { "command": "uvx", "args": ["mcp-cyberbro"], "env": { "CYBERBRO_URL": "http://localhost:5000" } } } }
To use Docker withstdiotransport (required by some MCP clients), build a custom image as shown in the Docker section above, then reference it:
{ "mcpServers": { "cyberbro": { "command": "docker", "args": ["run", "-i", "--rm", "-e", "CYBERBRO_URL", "mcp-cyberbro-stdio"], "env": { "CYBERBRO_URL": "http://localhost:5000" } } } }
{ "servers": { "mcp-cyberbro": { "type": "stdio", "command": "uvx", "args": [ "mcp-cyberbro" ], "env": { "CYBERBRO_URL": "http://127.0.0.1:5000" } } } }
server.jsonis included for MCP Registry publication and points to PyPI packagemcp-cyberbro.
- .github/workflows/publish-test-pypi.yml
- .github/workflows/publish-pypi.yml
- .github/workflows/publish-mcp-plugin.yml
- analyze_observable
- is_analysis_complete
- get_analysis_results
- get_engines
- get_web_url
Here are practical prompt examples you can use with any MCP-capable assistant connected to Cyberbro.
- Cyberbro: Check indicators for target.com
- Can you check this IP reputation with Cyberbro? 192.168.1.1. Use github, google and virustotal engines.
- I want to analyze the domain example.com. What can Cyberbro tell me about it? Use max 3 engines.
- Analyze these observables with Cyberbro: suspicious-domain.com, 8.8.8.8, and 44d88612fea8a8f36de82e1278abb02f. Use all available engines.
- I found this (hash|domain|url|ip|extension). Can you submit it for analysis to Cyberbro and analyze the results?
- Create an OSINT report for the domain example.com using Cyberbro. Use all available engines and pivot on the results for more information. Use a maximum of 10 analysis requests.
- Model Context Protocol
- MCP Python SDK
- Cyberbro
Open-source, self-hostable MCP server for WhisperGraph — a graph of 7.39B nodes / 39B edges mapping DNS, BGP, GeoIP, WHOIS, and threat intelligence. Six read-only tools (Cypher query + schema introspection + threat assessment), six resources, eight investigation prompts. stdio and Streamable HTTP transports.
MCP-native OSINT framework for AI agents. Exposes 9 intelligence tools (email enumeration, username search, breach check, WHOIS, IP intel, subdomain enum, dorks, paste search, phone intel) via Model Context Protocol. Also works as a standalone Python CLI.
Real-time OSINT intelligence platform for global security monitoring.
Performs data enrichment on observables using third-party services via the security-cli Python package.
An MCP server for memory forensics using the Volatility 3 framework.
A Model Context Protocol (MCP) server implementation that provides seamless integration with the AbuseIPDB API for IP reputation checking and abuse report management.
Allows access to DFIR / forensics data that was analyzed by the open source Autopsy platform
Latvian property portal MCP: search rentals, sales & nightly stays, market stats; owner tools via OAuth. Remote server at https://bezbaseina.lv/mcp
Connect to your CISO Adapt workspace to search, analyse, export, and manage risks and policies with natural language
CVE database and vulnerability intelligence for AI agents. Search NIST NVD, check software security, find known vulnerabilities — no API key required.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
