Threat.Zone MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| THREATZONE_API_KEY | Yes | Your Threat.Zone API key | |
| THREATZONE_API_URL | No | Custom API URL for private tenants or on-premise deployments | https://app.threat.zone |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_metafieldsB | Get available metafields for scan configuration. |
| get_levelsA | Get threat levels used in analysis results. |
| get_statusesB | Get submission statuses. |
| get_sample_metafieldB | Get sample metafield configuration for sandbox analysis. |
| interpret_statusA | Interpret a numeric status value from submission results. Args: status_value: Numeric status value (1-5) Returns: Human-readable status description |
| interpret_threat_levelA | Interpret a numeric threat level value from analysis results. Args: level_value: Numeric threat level (0-3) Returns: Human-readable threat level description |
| get_submission_status_summaryB | Get submission details with interpreted status and threat level. Args: uuid: Submission UUID Returns: Submission details with human-readable status and threat level |
| get_user_infoB | Get current user information, workspace details, and usage limits. |
| get_server_configB | Get current server configuration including API URL and connection status. Returns: Configuration details including API URL, version, and status |
| scan_urlC | Analyze a URL for threats and malicious content. Args: url: The URL to analyze is_public: Whether the scan results should be public |
| scan_file_sandboxA | Submit a file for advanced sandbox analysis with detailed configuration. Args: file_path: Path to the file to analyze is_public: Whether the scan results should be public (default: False) entrypoint: File to execute within archive (if applicable) password: Password for archive files (if applicable) environment: Analysis environment - w7_x64, w10_x64, w11_x64, macos, android, linux (default: w10_x64) timeout: Analysis timeout in seconds - 60, 120, 180, 240, 300 (default: 180) work_path: Working directory - desktop, root, %AppData%, windows, temp (default: desktop) mouse_simulation: Enable mouse simulation (default: True) https_inspection: Enable HTTPS inspection (default: False) internet_connection: Enable internet connection (default: False) raw_logs: Include raw logs (default: False) snapshot: Take VM snapshots (default: False) sleep_evasion: Enable sleep evasion techniques (default: False) smart_tracing: Enable smart tracing (default: False) dump_collector: Enable dump collection (default: False) open_in_browser: Open files in browser (default: False) extension_check: Perform extension check (default: True) modules: Analysis modules to use, e.g., ["csi", "cdr"] (default: None) auto_config: Use automatic configuration (default: False) |
| scan_file_sandbox_simpleA | Submit a file for simple sandbox analysis using default settings. This is a simplified version of scan_file_sandbox with default configurations. Use scan_file_sandbox for advanced configuration options. Args: file_path: Path to the file to analyze is_public: Whether the scan results should be public (default: False) entrypoint: File to execute within archive (if applicable) password: Password for archive files (if applicable) |
| scan_file_staticC | Submit a file for static analysis. Args: file_path: Path to the file to analyze is_public: Whether the scan results should be public entrypoint: File to execute within archive (if applicable) password: Password for archive files (if applicable) |
| scan_file_cdrB | Submit a file for CDR (Content Disarm and Reconstruction) processing. Args: file_path: Path to the file to process is_public: Whether the scan results should be public entrypoint: File to execute within archive (if applicable) password: Password for archive files (if applicable) |
| get_submissionC | Get submission details by UUID. Args: uuid: Submission UUID |
| get_submission_indicatorsC | Get all indicators for a specific submission. Args: uuid: Submission UUID |
| get_submission_iocsC | Get all Indicators of Compromise for a specific submission. Args: uuid: Submission UUID |
| get_submission_yara_rulesC | Get all matched YARA rules for a specific submission. Args: uuid: Submission UUID |
| get_submission_varist_resultsC | Get Varist Hybrid Analyzer results for a specific submission. Args: uuid: Submission UUID |
| get_submission_artifactsC | Get all artifacts for a specific submission. Args: uuid: Submission UUID |
| get_submission_config_extractorC | Get all extracted configurations for a specific submission. Args: uuid: Submission UUID |
| get_submission_dnsC | Get all DNS queries for a specific submission. Args: uuid: Submission UUID |
| get_submission_httpB | Get all HTTP requests and packets for a specific submission. Args: uuid: Submission UUID |
| get_submission_tcpB | Get all TCP requests and packets for a specific submission. Args: uuid: Submission UUID |
| get_submission_udpC | Get all UDP requests and packets for a specific submission. Args: uuid: Submission UUID |
| get_submission_network_threatsB | Get all network threats for a specific submission. Args: uuid: Submission UUID |
| get_my_submissionsB | Get user's submissions with pagination. Args: page: Page number (default: 1) jump: Number of items per page (default: 10) |
| get_public_submissionsC | Get public submissions with pagination. Args: page: Page number (default: 1) jump: Number of items per page (default: 10) |
| search_by_hashC | Search submissions by file hash (MD5, SHA1, or SHA256). Args: hash: File hash to search for page: Page number (default: 1) jump: Number of items per page (default: 10) |
| download_sanitized_fileB | Download the CDR-sanitized file for a given submission UUID. Args: uuid: Submission UUID Returns: Base64-encoded file content |
| download_html_reportC | Download HTML analysis report for a submission. Args: uuid: Submission UUID Returns: HTML report content |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 31 tools
Most tools have distinct purposes targeting specific submission data types or actions, but some overlap exists. For example, get_submission_indicators and get_submission_iocs could be confusing as both relate to threat indicators, though their descriptions suggest iocs might be a subset. The three scan_file_* tools are well-differentiated by analysis type (CDR, sandbox, static).
Tool names follow a highly consistent verb_noun pattern throughout. All tools use snake_case with clear prefixes: 'get_' for retrieval, 'download_' for file downloads, 'scan_' for analysis submissions, 'interpret_' for value translation, and 'search_' for searching. This consistency makes the tool set predictable and easy to navigate.
With 31 tools, the count feels heavy for a threat analysis server. While the domain involves detailed submission data retrieval, many tools are variations fetching specific artifact types (DNS, HTTP, TCP, UDP, etc.) that could potentially be consolidated. The number exceeds typical well-scoped ranges (3-15 tools), suggesting some tool proliferation.
The tool set provides comprehensive coverage for a threat analysis platform. It includes submission creation (multiple scan types), retrieval (detailed artifacts, statuses, reports), search capabilities, user/system information, and interpretation helpers. There are no apparent gaps in the core workflow from submission to analysis results retrieval.