This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
Scan files, hunt threats and pivot campaigns with MetaDefender Aether.
Minimal MCP server for the Aether / Filescan.io API: a thin translation layer between the LLM and the API. Each tool calls Aether and returns only what the LLM needs. Scans are always private.
tools/scan.py)Tool | What it does | API |
| Upload a local file as a private scan |
|
| Submit a URL as a private scan |
|
Try:
"Scan ~/Downloads/invoice.pdf in Aether and tell me if it is malicious and why."
tools/lookup.py)Tool | What it does | API |
| Reputation of up to 100 SHA-256s |
|
| Hash a local file and look it up (never uploaded) |
|
| Reputation of up to 100 IOCs of one type |
|
Try:
"Is this IP malicious, and which samples use it? "
"Check the reputation of these 20 domains from the incident: "
tools/search.py)Tool | What it does | API |
| Malware family names |
|
| File types and file type groups |
|
| MITRE ATT&CK technique IDs and names |
|
| Signal groups (sandbox indicators) |
|
| Source of a YARA rule, by name |
|
| Search reports by family, file type, signal group, technique, tag, verdict, file name, registry key, YARA rule, date; newest report per file |
|
| Reports that contain an IP, domain, URL, email or SHA-256; newest report per file |
|
| Samples with similar code, with similarity %, verdict and tags |
|
| Report counts per verdict for IOCs |
|
Try:
"Find AsyncRAT samples from this month and list their C2 servers."
"Which other samples contact api.ip.sb? Are they the same campaign?"
tools/report.py)Tool | What it does | API |
| Verdict, file and tags of a scan by |
|
| IOCs extracted from a report, with where each was found |
|
| Malware configs extracted from up to 20 reports |
|
| MITRE ATT&CK techniques of a report, with the signal groups behind each |
|
| Emulation events of the input, extracted and downloaded files of a report |
|
| Files extracted from a report's file (interesting ones by default) |
|
| YARA rules that matched each file of a report |
|
| Malware families attributed to a report's files, with the evidence for each |
|
| Rendered pages of a report: final URL, redirects and a screenshot |
|
Try:
"Extract the malware config and C2s of that sample."
"Map that sample to MITRE ATT&CK tactics and techniques."
"What does that script do when it runs? Any persistence or network activity?"
"Which family is that sample, and what is the evidence?"
client.py allowlists the endpoints above; nothing can download sample files.
Related MCP server: Yunaq GAC MCP Server
You need uv and an Aether API key.
Claude Code
claude mcp add aether -s user -e AETHER_API_KEY=<your key> -- uvx --from git+https://github.com/filescanio/aether-mcp@v1.0.0 aether-mcpClaude Desktop: download aether-1.0.0.mcpb from the
latest release, open it, and enter your API key
when asked.
To build the bundle: npx @anthropic-ai/mcpb pack . dist/aether-1.0.0.mcpb.
Codex: add to ~/.codex/config.toml (the first start downloads the server, so allow it more than the default 10s):
[mcp_servers.aether]
command = "uvx"
args = ["--from", "git+https://github.com/filescanio/aether-mcp@v1.0.0", "aether-mcp"]
env = { AETHER_API_KEY = "<your key>" }
startup_timeout_sec = 60Other MCP clients (Cursor, Windsurf, Gemini CLI...): run the same command over stdio, e.g. in mcp.json:
{
"mcpServers": {
"aether": {
"command": "uvx",
"args": ["--from", "git+https://github.com/filescanio/aether-mcp@v1.0.0", "aether-mcp"],
"env": { "AETHER_API_KEY": "<your key>" }
}
}
}This server cannot be deployed
Breach intelligence API: email search, domain monitoring, passwords and stealer logs.
Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.
Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans
Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.
