OSINT MCP Server

Implementation Reference

• src/tools/threat.ts:13-26 (handler)

  The actual logic for looking up a hash in MalwareBazaar.

  async lookupHash(hash: string): Promise<any> {
    try {
      const response = await fetch("https://mb-api.abuse.ch/api/v1/", {
        method: "POST",
        body: new URLSearchParams({
          query: "get_info",
          hash: hash
        })
      });
      return await response.json();
    } catch (error) {
      throw new McpError(ErrorCode.InternalError, `Hash Lookup error: ${(error as Error).message}`);
    }
  }

• src/index.ts:641-650 (registration)

  Registration of the "hash_lookup" tool.

  server.tool(
    "hash_lookup",
    { hash: z.string().describe("MD5/SHA1/SHA256 hash to lookup in MalwareBazaar") },
    async ({ hash }) => {
      const result = await threatClient.lookupHash(hash);
      return {
        content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
      };
    }
  );