AssemblyLine 4 MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| AL4_URL | Yes | URL of your AssemblyLine 4 instance (e.g., https://your-al4-instance:443) | |
| AL4_APIKEY | Yes | API key in format 'keyname:password' | |
| AL4_USERNAME | Yes | Username for AssemblyLine 4 | |
| AL4_TLS_VERIFY | No | Set to 'false' to skip TLS verification (for self-signed certs) | true |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| al4_whoamiA | Return details about the currently authenticated AssemblyLine user. |
| al4_submit_fileA | Submit a local file to AssemblyLine for immediate synchronous analysis. Returns a submission ID. Limited to 5 concurrent submissions. |
| al4_submit_urlC | Submit a URL to AssemblyLine for immediate synchronous analysis. |
| al4_submit_sha256B | Submit a file by its SHA256 hash to AssemblyLine for immediate synchronous analysis. The file must already exist in the AL4 file store. |
| al4_ingest_fileA | Asynchronously ingest a local file into AssemblyLine. Preferred for high-volume workflows. Returns an ingest ID. Results arrive on a notification queue. |
| al4_ingest_urlC | Asynchronously ingest a URL into AssemblyLine. |
| al4_ingest_sha256A | Asynchronously ingest a file by SHA256 hash into AssemblyLine. The file must already exist in the AL4 file store. |
| al4_submission_is_completeC | Check whether a submission has finished processing. |
| al4_submission_getC | Get metadata and status for a submission. |
| al4_submission_fullC | Get the complete results tree for a finished submission, including all service results and scores. |
| al4_submission_summaryC | Get a summarised view of a submission's results. |
| al4_ingest_get_messagesB | Retrieve completion notifications from an ingest notification queue. |
| al4_search_submissionsA | Search AssemblyLine submissions using Lucene query syntax (e.g. 'params.submitter:admin AND al_score:[500 TO *]'). |
| al4_search_alertsC | Search AssemblyLine alerts using Lucene query syntax. |
| al4_search_filesA | Search the AssemblyLine file store using Lucene query syntax (e.g. 'type:executable/windows AND seen.last:[now-7d TO now]'). |
| al4_search_resultsC | Search AssemblyLine service results using Lucene query syntax. |
| al4_alert_getC | Get a specific alert by its alert ID. |
| al4_file_infoB | Get metadata for a file by its SHA256 hash. |
| al4_file_resultsC | Get all service analysis results for a file by SHA256. |
| al4_file_scoreB | Get the highest score assigned to a file across all submissions. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 20 tools
Each tool targets a distinct operation: alerts, files, ingest, search, submissions, submit, and user info. Tools within the same group are clearly differentiated (e.g., al4_submission_full vs al4_submission_summary). No ambiguity exists.
All tools use the consistent `al4_verb_noun` pattern with snake_case. Verbs are predictable (get, search, submit, ingest) and nouns match resources. No mixing of styles.
20 tools fully cover the AssemblyLine API without being excessive. Each tool serves a specific need for file analysis, alerting, and submission management, fitting the platform's scope.
The toolset provides comprehensive file operations (info, results, score, ingestion, submission), search, and alert retrieval. Missing update/delete operations for submissions or alerts, but these are minor gaps for an analysis platform.