Skip to main content
Glama
a2amarket

ClamAV MCP

by a2amarket
README.md
# ClamAV MCP

Simple ClamAV MCP that allows scanning files for viruses using the ClamAV engine.

![Cursor ClamAV Integration](image.png)

## Requirements

This project requires ClamAV to be installed on your system. Here's how to install it:

### Ubuntu/Debian
```bash
sudo apt-get update
sudo apt-get install clamav clamav-daemon
```

### Windows
1. Download the ClamAV installer from [ClamAV's official website](https://www.clamav.net/downloads)
2. Run the installer and follow the setup wizard
3. Make sure to add ClamAV to your system PATH

### macOS
```bash
brew install clamav
```

## Usage

To run the MCP server:
```bash
uv run mcp run main.py -t sse
```

The server will start and listen for SSE connections on port 8000 by default.

## Cursor Configuration

To use this MCP with Cursor, add the following configuration to your Cursor settings:

```json
{
  "mcpServers": {
    "ClamAV Server": {
      "url": "http://[SERVER_IP]:8000/sse"
    }
  }
}
```

This configuration tells Cursor to connect to the ClamAV MCP server.

## API

The MCP provides a single endpoint:

### scan_file
- Parameters:
  - `base64_data`: Base64 encoded string of the file to scan
  - `filename`: Name of the file to use in the scan
- Returns:
  - `success`: Boolean indicating if the scan was successful
  - `result`: Raw output from clamscan command
  - `error`: Error message if the scan failed 

TDQS

B3.1/5.0

Scored across 1 tool

Disambiguation5/5

With only one tool, there is no possibility of ambiguity or overlap between tools. The single tool has a clear, distinct purpose that cannot be confused with any other tool in the set.

Naming Consistency5/5

With only one tool, naming consistency is inherently perfect. The tool name 'scan_file' follows a clear verb_noun pattern, and there are no other tools to create inconsistency.

Tool Count2/5

A single tool for a ClamAV server feels thin and incomplete. While scanning files is the core function, typical antivirus interfaces would include additional operations like checking database versions, updating signatures, or scanning directories. The scope appears too narrow for practical agent use.

Completeness2/5

The tool surface is severely incomplete for a ClamAV server. It only provides file scanning, missing essential operations like updating virus definitions, scanning directories, checking service status, or getting scan statistics. This creates significant gaps that will limit agent effectiveness in security workflows.

Maintenance

ActivityInactive
ResponsivenessNo issues