Skip to main content
Glama
mlab-sh

mlab.sh MCP server

Official
by mlab-sh
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Remote

mlab.sh MCP server

Public metadata and connection guide for the remote MCP server at https://mlab.sh/mcp, a threat intelligence server for SOC and DFIR work.

This repo is the registry listing and the documentation. It is not the server source: the server runs inside the mlab.sh backend and is closed source.

Connect

Endpoint: https://mlab.sh/mcp (Streamable HTTP via POST, SSE via GET).

Claude.ai

Settings > Connectors > Add custom connector, then paste the URL. OAuth runs in the browser, no token to copy.

https://mlab.sh/mcp

Claude Desktop

claude_desktop_config.json:

{
  "mcpServers": {
    "mlab": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mlab.sh/mcp",
        "--header",
        "Authorization: Bearer mcp_xxx"
      ]
    }
  }
}

Drop the --header pair to use OAuth instead of a static token.

Cursor

~/.cursor/mcp.json:

{
  "mcpServers": {
    "mlab": {
      "url": "https://mlab.sh/mcp",
      "headers": {
        "Authorization": "Bearer mcp_xxx"
      }
    }
  }
}

VS Code

.vscode/mcp.json:

{
  "servers": {
    "mlab": {
      "type": "http",
      "url": "https://mlab.sh/mcp",
      "headers": {
        "Authorization": "Bearer mcp_xxx"
      }
    }
  }
}

curl

curl -sS -X POST https://mlab.sh/mcp \
  -H "Authorization: Bearer mcp_xxx" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0.0"}}}'

Ready to paste versions of these four configs live in examples/.

Officially supported clients are Claude.ai and Claude Desktop. Other MCP clients (Cursor, VS Code, Windsurf and friends) work but are best effort.

Related MCP server: Ioc Search MCP Server

Tools

IOC enrichment

Tool

Purpose

detect_ioc

Auto detect the IOC type of a value and return relevant threat intel

scan_ip

Threat intel for an IPv4 or IPv6 address

scan_url

Static analysis of a URL without visiting it

scan_hash

File hash lookup (MD5, SHA1, SHA256) in CIRCL hashlookup

scan_crypto

Threat intel for a blockchain address: labels, sanctions, risk score, 18 chains

scan_email

Offline style analysis of an email address

scan_phone

Offline style analysis of a phone number

scan_mac

Offline style analysis of a MAC address

smishing_risk

Score an SMS for smishing

Vulnerabilities and actors

Tool

Purpose

cve_search

Search CVEs

cve_detail

Full CVE record

actors_by_cve

Threat actors known to exploit a CVE

search_actors

Search threat actors

get_actor

Full threat actor profile

Scanning

Tool

Purpose

start_domain_scan

Launch a domain scan: DNS, subdomains, SSL, security.txt, robots.txt

get_domain_scan_results

Poll the results of a domain scan

scan_bash

Static analysis of an inline shell script

scan_sbom

Scan a dependency lockfile or SBOM for known CVEs

Account

Tool

Purpose

get_scan_history

Past scans for the account

get_scan_limits

Current quotas and remaining scans

get_account_info

Account details

add_bookmark

Bookmark an IOC

remove_bookmark

Remove a bookmarked IOC

get_bookmarks

List bookmarked IOCs

hello_world

Connectivity check

Authentication

OAuth 2.1 is the recommended path: authorization code with PKCE S256, dynamic client registration, CIMD supported. The server advertises its metadata at https://mlab.sh/.well-known/oauth-authorization-server, so a compliant client only needs the endpoint URL.

If your client does not speak OAuth, create a static token in Account > Settings > MCP Tokens and send it as Authorization: Bearer mcp_xxx.

Full details: https://doc.mlab.sh/docs/mlab.sh/integrations/mcp

Rate limits and quotas

Limits follow your mlab.sh account plan. Call get_scan_limits to read the quotas and remaining budget that apply to your account.

Registry

Published to the official MCP Registry as sh.mlab/mcp.

https://registry.modelcontextprotocol.io/v0.1/servers?search=sh.mlab

Other public servers

https://news.mlab.sh/mcp is a separate, unauthenticated, read only MCP server exposing a cyber news index. It is not published from this repo.

Security

Report vulnerabilities to security@mlab.sh. See https://mlab.sh/security.txt and SECURITY.md.

License

MIT, see LICENSE.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • FastMCP ThreatIntel

    4R9UN
    A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI-powered threat intelligence analysis of IPs, domains, URLs, and file hashes across multiple threat intelligence platforms (VirusTotal, AlienVault OTX, AbuseIPDB, IPinfo) with APT attribution and interactive reporting through natural language queries.
    35 PyPI
    40
    Apache 2.0

  • Ioc Search MCP Server

    BACH-AI-Tools
    A
    license
    A
    quality
    D
    maintenance
    Enables comprehensive threat analysis for Indicators of Compromise (IoCs) including IP addresses, file hashes, domains, and URLs. It provides detailed reputation scores, security vendor evaluations, and network metadata to facilitate security assessments and risk detection.
    4
    MIT

  • Security Intelligence MCP

    df4u1t
    F
    license
    Not graded
    quality
    D
    maintenance
    Provides a unified interface for security analysts to gather threat intelligence from multiple sources including VirusTotal, Shodan, NVD, AnyRun, AlienVault OTX, and GitHub.
    6 npm
    -