Malware Bazaar MCP

Malware Bazaar MCP

What is Malware Bazaar MCP about?

A server that autonomously communicates with the Malware Bazaar platform, fetching the latest samples, metadata, tags, and files. The service exposes MCP tools (get_recent, get_info, get_file, get_taginfo) that can be invoked by an MCP client to incorporate fresh threat intel into security pipelines.

How to use Malware Bazaar MCP?

1. Create an API key on Malware Bazaar (https://auth.abuse.ch/user/me).
2. Add the key to a .env file:

   MALWAREBAZAAR_API_KEY=<YOUR_API_KEY>
   

3. Set up a virtual environment with uv (or any Python venv) and install the requirements.
4. Configure the MCP client with the server definition (see README for macOS/Linux and Windows examples).
5. Run the server:

   uv run malwarebazaar_mcp.py
   

6. Query via the MCP client using natural‑language prompts, e.g., "Help me understand the latest hash from Malware Bazaar."
7. Run tests with python -m unittest discover -s tests and optional coverage commands.

Key features of Malware Bazaar MCP

• AI‑driven orchestration: automatically decides which endpoint to call based on user intent.
• Four core MCP tools:
  • get_recent – retrieve up to 10 newest samples.
  • get_info – obtain detailed metadata for a specific hash.
  • get_file – download the actual malware sample.
  • get_taginfo – list samples associated with a given tag.
• Environment‑agnostic setup: works on macOS, Linux, and Windows.
• Test suite with coverage reporting for confidence in stability.

Use cases of Malware Bazaar MCP

• Automated threat‑intel enrichment in security orchestration platforms.
• Continuous monitoring of newly released malware for SOC analysts.
• Research workflows that need quick access to sample files and metadata.
• Integration with sandboxing or reverse‑engineering pipelines to fetch samples on demand.

FAQ from the Malware Bazaar MCP

Q: Do I need a paid Malware Bazaar account?
A: No, a free user API key is sufficient for the provided endpoints.

Q: Can I request more than 10 recent samples?
A: The get_recent tool is limited to 10 by design; you can call it repeatedly or adjust the server code.

Q: Is the server safe to run on production environments?
A: Yes, but always store the API key securely and restrict access to authorized MCP clients.

Q: Which Python version is required?
A: The project targets Python 3.9+, and uv handles dependency resolution automatically.

MalwareBazaar_MCP

An AI-driven MCP server that autonomously interfaces with Malware Bazaar, delivering real-time threat intel and sample metadata for authorized cybersecurity research workflows.

MCP Tools

get_recent: Get up to 10 most recent samples from MalwareBazaar.

get_info: Get detailed metadata about a specific malware sample.

get_file: Download a malware sample from MalwareBazaar.

get_taginfo: Get malware samples associated with a specific tag.

Step 1: Create a MalwareBazaar APIKEY

https://auth.abuse.ch/user/me

Step 2: Create .env

MALWAREBAZAAR_API_KEY=<APIKEY>

Step 3a: Create Virtual Env & Install Requirements - MAC/Linux

curl -LsSf https://astral.sh/uv/install.sh | sh
cd MalwareBazaar_MCP
uv init .
uv venv
source .venv/bin/activate
uv pip install -r requirements.txt

Step 3b: Create Virtual Env & Install Requirements - Windows

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
cd MalwareBazaar_MCP
uv init .
uv venv
.venv\Scripts\activate
uv pip install -r requirements.txt

Step 4a: Add Config to the MCP Client - MAC/Linux

{
    "mcpServers": {
        "malwarebazaar": {
            "description": "Malware Bazaar MCP Server",
            "command": "/Users/XXX/.local/bin/uv",
            "args": [
                "--directory",
                "/Users/XXX/Documents/MalwareBazaar_MCP",
                "run",
                "malwarebazaar_mcp.py"
            ]
        }
    }
}

Step 4b: Add Config to the MCP Client - Windows

{
    "mcpServers": {
        "malwarebazaar": {
            "description": "Malware Bazaar MCP Server",
            "command": "uv",
            "args": [
                "--directory",
                "C:\Users\XXX\Document\MalwareBazaar_MCP",
                "run",
                "malwarebazaar_mcp.py"
            ]
        }
    }
}

Step 5: Run MCP Server

uv run malwarebazaar_mcp.py

Step 6: Run MCP Client & Query

Help me understnad the latest hash from Malware Bazaar.

Step 7: Run Tests

python -m unittest discover -s tests

uv pip install coverage==7.8.0
coverage run --branch -m unittest discover -s tests
coverage report -m
coverage html
open htmlcov/index.html  # MAC
xdg-open htmlcov/index.html  # Linux
start htmlcov\index.html  # Windows
coverage erase

License

Apache License, Version 2.0