ransomware-live-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| RANSOMWARE_LIVE_API_KEY | No | API key for Ransomware.live Pro tier. Optional, as free tier works without it. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_api_infoB | Get basic API metadata and information |
| get_recent_victimsA | Get the latest disclosed ransomware victims |
| get_group_infoA | Get detailed information about a specific ransomware group |
| get_all_groupsA | Get a list of all known ransomware groups |
| get_all_cyberattacksB | Get all known cyberattacks |
| get_recent_cyberattacksC | Get recently added cyberattacks |
| get_group_victimsA | Get all victims claimed by a specific ransomware group |
| search_victimsB | Search for victims by keyword |
| get_country_attacksB | Get cyberattacks for a specific country |
| get_country_victimsB | Get victims from a specific country |
| get_victims_by_dateA | Get victims by specific year and month |
| get_sector_victimsB | Get victims from a specific business sector |
| get_cert_contactsA | Get national CERT contact information for a country |
| get_yara_rulesA | Get YARA rules associated with a ransomware group |
| get_negotiation_chatA | [Pro tier, requires RANSOMWARE_LIVE_API_KEY] Get leaked ransomware negotiation chat logs (ransom demands, counteroffers, payment outcomes). Call with no arguments to discover which groups have chats available; add |
| get_ransom_noteA | [Pro tier, requires RANSOMWARE_LIVE_API_KEY] Get ransom note text left by ransomware groups. Call with no arguments to discover which groups have notes on file; add |
| get_iocsA | [Pro tier, requires RANSOMWARE_LIVE_API_KEY] Get Indicators of Compromise (file hashes, IPs, domains, emails, BTC addresses, URLs) for ransomware groups. Call with no |
| get_mitre_ttpsA | [Pro tier, requires RANSOMWARE_LIVE_API_KEY] Get a ransomware group's MITRE ATT&CK tactics/techniques (TTPs), exploited CVEs (with CVSS scores), and tooling, as part of its comprehensive Pro-tier intelligence profile. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| API Information | Basic information about the Ransomware.live API |
| Recent Victims | Most recently disclosed ransomware victims |
| All Ransomware Groups | Complete list of all known ransomware groups |
| Recent Cyberattacks | Recently added cyberattacks |
TDQS
Scored across 18 tools
Most tools map to clearly distinct resources such as victims, groups, cyberattacks, CERT contacts, YARA rules, and Pro-tier intelligence data. The six victim-related tools are distinct filters, but their volume means an agent must read the arguments carefully to avoid selecting the wrong victim query.
The overwhelming majority of tools follow a consistent get_<resource> snake_case pattern, making the set highly predictable. The single exception is search_victims, which uses the verb 'search' rather than 'get', but it still follows a clear verb_noun convention.
At 18 tools, the server is slightly above the typical well-scoped range, but the breadth of ransomware intelligence data justifies the count. Each tool covers a distinct data slice across free and Pro tiers, and there is minimal obvious redundancy.
The server provides broad coverage of public intelligence including victims, groups, attacks, and CERT contacts, plus Pro-tier depth in YARA rules, negotiation chats, ransom notes, IoCs, and MITRE TTPs. The main retrieval dimensions of group, country, sector, date, and keyword are all represented, leaving agents few dead ends.