darknet-mcp-server

malware_search

Search Hybrid Analysis by file hash to retrieve verdict, AV detection rate, and analysis details.

Instructions

Search Hybrid Analysis sandbox by file hash (MD5, SHA1, SHA256). Returns verdict, AV detection rate, and analysis details. Requires HYBRID_API_KEY.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "hash": "<hash>"
    },
    "name": "malware_search"
  }
}

Input Schema

Name	Required	Description	Default
`hash`	Yes	File hash (MD5, SHA1, or SHA256)

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Jun 23, 2026

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey the tool's behavioral profile. It discloses that the operation is a search (non-destructive), what data it returns, and the need for an API key. This is transparent for a read-only hash lookup, though it does not mention rate limits or error behaviors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences: the first states the action and input, the second the output and requirement. Every sentence carries essential information with no fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter search tool with no output schema, the description is sufficiently complete. It covers the purpose, supported hash formats, the service (Hybrid Analysis), return data, and the API key requirement. Minor gaps include not addressing empty results or invalid hash handling, but these are not critical for typical use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage of the 'hash' parameter, describing it as 'File hash (MD5, SHA1, or SHA256)'. The description repeats this information ('by file hash (MD5, SHA1, SHA256)') without adding new semantic meaning, so it meets the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Search Hybrid Analysis sandbox by file hash (MD5, SHA1, SHA256)' and specifies the return values (verdict, AV detection rate, analysis details). This distinguishes it from sibling hash-search tools like bazaarHash by naming the Hybrid Analysis service explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool: when you have a file hash and need Hybrid Analysis sandbox results. It also mentions the prerequisite 'Requires HYBRID_API_KEY,' but it does not explicitly name alternatives or state when not to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server