@pipeworx/malwarebazaar

MalwareBazaar (abuse.ch) MCP — malware sample metadata.

Part of Pipeworx — an MCP gateway connecting AI agents to 1394+ live data sources.

Tools

• get_sample_info(hash)

• search_tag(tag, limit?)

• search_family(family, limit?)

• search_signature(signature, limit?)

• recent_samples(selector?)

Related MCP server: Malware Analysis MCP Server

Auth

• Platform key: gateway env PLATFORM_ABUSECH_KEY (shared with threatfox).

• BYO: ?_apiKey=<key> after registering at https://auth.abuse.ch.

Data source

https://mb-api.abuse.ch/api/v1/ — header Auth-Key, POST form-encoded.

Quick Start

Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):

{
  "mcpServers": {
    "malwarebazaar": {
      "url": "https://gateway.pipeworx.io/malwarebazaar/mcp"
    }
  }
}

Or connect to the full Pipeworx gateway for access to all 1394+ data sources:

{
  "mcpServers": {
    "pipeworx": {
      "url": "https://gateway.pipeworx.io/mcp"
    }
  }
}

Using with ask_pipeworx

Instead of calling tools directly, you can ask questions in plain English:

ask_pipeworx({ question: "your question about Malwarebazaar data" })

The gateway picks the right tool and fills the arguments automatically.

More

• Docs and guides

• pipeworx.io

License

MIT