OLETools Secure MCP Server

This project provides a secure microservice using FastMCP to analyze Microsoft Office documents (Excel, Word, PowerPoint) and related file types (like XLL add-ins) for potential malicious content using static analysis techniques. It leverages external tools like oletools, XLMMacroDeobfuscator, and pefile.

Features

• Analyzes VBA Macros (olevba)

• Detects XLM Macros (XLMMacroDeobfuscator, olevba)

• Checks for DDE Links (msodde)

• Extracts embedded OLE Objects (oleobj)

• Analyzes XLL file exports for suspicious functions (pefile)

• Extracts IOCs (URLs, IPs, Hashes, Emails) using iocextract

• Provides basic MIME type and file size validation (python-magic)

• Uses a configurable scoring system for basic risk classification

• Designed for integration with systems supporting the MCP protocol (like compatible versions of Claude Desktop).

Related MCP server: Office MCP Server

Prerequisites

• Python 3.6+

• OLETools: Install via pip install oletools

• XLMMacroDeobfuscator: Install via pip install XLMMacroDeobfuscator

• python-magic: Install via pip install python-magic-bin (Windows)

• iocextract (optional): Install via pip install iocextract for advanced IOC extraction

• Claude Desktop application

Installation

1. Clone the Repository:

   git clone https://github.com/pradeep895/oletools-mcp-server.git
   cd oletools-mcp-server

2. Install Dependencies:

pip install -r requirements.txt

3. Download the "Claude Desktop" application go to the Developer settings and Edit the "claude_desktop_config.json" file and paste content in the configuration.json file.Restart the application.

4. Run the config file:

python config.py

6. Run the server:

python mcp_service.py

9. Go to "Claude Desktop" application and check for the "hammer symbol" it appeared means MCP tools are available.

10. type "analyze_vba_macros in <filepath\example.xlsm>" this will help you to analyze the excel file statically and gave you the findings.

analyze_vba_macros file_path:"C:\path\to\your\example.xlsm"