maltiverse-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MALTIVERSE_API_KEY | Yes | Bearer API key from your Maltiverse profile. Required for tool calls. | |
| MALTIVERSE_TIMEOUT | No | Per-request timeout in seconds. | 30 |
| MALTIVERSE_BASE_URL | No | Override the Maltiverse API base URL. | https://api.maltiverse.com |
| MALTIVERSE_LOG_LEVEL | No | Logging level. Logs go to stderr. | WARNING |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
Query the Maltiverse threat-intelligence platform. Use maltiverse_check_indicator (or the type-specific maltiverse_check_ip / _hostname / _url / _sample tools) to get the reputation and threat attributions of a single IoC, and maltiverse_search to hunt across the dataset by classification, threat name, tag, ASN, or country. All tools are read-only; results are concise by default — pass response_format='detailed' for full per-feed attributions.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| maltiverse_check_ipA | Look up the threat-intel reputation of an IP address in Maltiverse. Use this when you have an IP and need its classification (malicious / suspicious / neutral / whitelist), associated threats and feeds, ASN, and behaviour flags (C2, scanner, TOR, VPN, proxy, etc.). For domains use maltiverse_check_hostname; if you don't know the indicator type, use maltiverse_check_indicator. |
| maltiverse_check_hostnameA | Look up the reputation of a hostname or domain in Maltiverse. Use for domains/FQDNs (phishing, malware distribution, C2). Pass the bare hostname without a scheme or path — for a full URL use maltiverse_check_url. |
| maltiverse_check_urlA | Look up the reputation of a specific URL in Maltiverse. Maltiverse keys URLs by the SHA-256 of the raw URL string; this tool computes that checksum for you. Pass a full URL (with scheme). To check just the domain, use maltiverse_check_hostname instead. |
| maltiverse_check_sampleA | Look up a malware sample by file hash in Maltiverse. Returns classification, AV detection ratio, file type, and threat attributions. Accepts MD5/SHA-1/SHA-256/SHA-512; the right endpoint is chosen from the hash length. |
| maltiverse_check_indicatorA | Look up any indicator when you don't know its type up front. This is the convenient default: pass an IP, domain, URL, or hash and the server routes to the correct Maltiverse endpoint. Prefer the specific tools (maltiverse_check_ip/_hostname/_url/_sample) when you already know the type and want to avoid ambiguity. |
| maltiverse_searchA | Search Maltiverse for indicators matching a query. Use this to hunt across the whole dataset (by threat name, tag, classification, ASN, country, feed, etc.) rather than looking up one known indicator. Results are paginated: when has_more is true, call again with offset set to the returned next_offset. Keep limit small (default 20) to stay within output limits. Example: query='classification:malicious AND type:ip AND country_code:RU'. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 6 tools
Each tool targets a distinct indicator type (IP, hostname, URL, hash) plus a router and a search, and the descriptions explicitly cross-reference the others ('for domains use X, for full URLs use Y'). The only intentional overlap — maltiverse_check_indicator as a default router — is clearly framed as a fallback to the specific tools rather than a competing option.
All six tools follow a single lowercase snake_case verb_noun convention with a uniform server prefix (maltiverse_check_ip, maltiverse_check_url, maltiverse_search). The one meta-tool (check_indicator) still conforms to the same pattern, so the surface is fully predictable.
Six tools is well-proportioned for a read-only threat-intel lookup server, with one tool per indicator type plus a router and a search. There is no filler, and each tool earns its place by mapping to a real Maltiverse endpoint.
All the core lookup paths an agent needs — IP, hostname, URL, hash, generic routing, and dataset search with pagination guidance — are covered with no dead ends. Minor gaps remain: no bulk/multi-indicator lookup and no write-side operations (tagging, sample submission) that the underlying API likely supports.