Malware Analysis MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| TG_CHAT_ID | No | Telegram chat ID for send_alert (optional). | |
| VT_API_KEY | No | VirusTotal API key for vt_lookup (optional). | |
| MB_AUTH_KEY | Yes | Your Auth-Key from auth.abuse.ch for MalwareBazaar. | |
| TG_BOT_TOKEN | No | Telegram bot token for send_alert (optional). | |
| ALLOWED_SCAN_DIRS | No | Comma-separated list of absolute paths allowed for check_local_file (highly recommended). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 29 tools
Several tools have vague or overlapping purposes, especially get_recent, get_info, get_taginfo, virustotal_lookup, and vt_lookup. The lack of descriptions makes it hard to distinguish similar-sounding intel lookup and generic retrieval tools from one another.
Most names use snake_case, which is readable, but the set mixes verb_noun patterns with noun-only names like entropy and hexdump_text. Abbreviation inconsistency between virustotal_lookup and vt_lookup weakens predictability.
At 29 tools, the server is heavy for a malware analysis utility surface and includes apparent duplication. The encoding, compression, hashing, and crypto operations could likely be grouped or reduced.
The tool set broadly covers threat intel lookup, local file checks, encoding, hashing, entropy, IOC handling, YARA templating, and alerting. It lacks obvious dynamic analysis or sandbox detonation capabilities, but the core analysis utility surface is fairly comprehensive.