threatintel_lookup_hash
Look up a file hash (MD5, SHA1, SHA256) across AlienVault OTX, MalwareBazaar, and other threat intelligence sources to assess maliciousness.
Instructions
Look up a file hash (MD5, SHA1, SHA256) across threat intelligence sources (OTX, MalwareBazaar)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hash | Yes | File hash (MD5, SHA1, or SHA256) |
Implementation Reference
- src/index.ts:140-153 (schema)Tool registration and input schema for threatintel_lookup_hash. Defines the tool name, description, and input schema requiring a 'hash' string parameter (MD5, SHA1, or SHA256).
{ name: "threatintel_lookup_hash", description: "Look up a file hash (MD5, SHA1, SHA256) across threat intelligence sources (OTX, MalwareBazaar)", inputSchema: { type: "object" as const, properties: { hash: { type: "string", description: "File hash (MD5, SHA1, or SHA256)", }, }, required: ["hash"], }, }, - src/index.ts:496-533 (handler)Handler for threatintel_lookup_hash. Extracts the hash from args, determines hash type by length (MD5=32, SHA1=40, SHA256=64), queries OTX (if configured) and MalwareBazaar (always attempted), and returns aggregated JSON results.
// Unified hash lookup case "threatintel_lookup_hash": { const { hash } = args as { hash: string }; const results: Record<string, unknown> = { hash }; // OTX if (services.otx) { try { const hashType = hash.length === 32 ? "MD5" : hash.length === 40 ? "SHA1" : "SHA256"; const otxResult = await apiRequest<unknown>( `${config.otx.baseUrl}/indicators/file/${hashType}/${hash}/general`, { headers: { "X-OTX-API-KEY": config.otx.apiKey! } } ); results.otx = otxResult; } catch (e) { results.otx = { error: e instanceof Error ? e.message : String(e) }; } } // MalwareBazaar try { const mbResult = await apiRequest<unknown>( config.abusech.malwarebazaar, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: `query=get_info&hash=${encodeURIComponent(hash)}`, } ); results.malwarebazaar = mbResult; } catch (e) { results.malwarebazaar = { error: e instanceof Error ? e.message : String(e) }; } return { content: [{ type: "text", text: JSON.stringify(results, null, 2) }], }; } - src/index.ts:363-374 (registration)Server registration. The MCP server is created with name 'mcp-threatintel' and tools capability, then handles ListToolsRequestSchema and CallToolRequestSchema. The TOOLS array (including threatintel_lookup_hash) is registered via ListToolsRequestSchema handler.
// Create server instance const server = new Server( { name: "mcp-threatintel", version: "1.0.0", }, { capabilities: { tools: {}, }, } ); - src/index.ts:78-97 (helper)Generic API request helper used by the hash lookup handler to make HTTP requests to OTX and MalwareBazaar endpoints.
async function apiRequest<T>( url: string, options: RequestInit = {} ): Promise<T> { const response = await fetch(url, { ...options, headers: { "Content-Type": "application/json", "Accept": "application/json", ...(options.headers || {}), }, }); if (!response.ok) { const text = await response.text(); throw new Error(`API error ${response.status}: ${text}`); } return response.json() as Promise<T>; }