Malwarebazaar MCP

🚀 Malware Bazaar MCP Server

An AI-based MCP server that automatically interfaces with Malware Bazaar, providing real-time threat intelligence and sample metadata to support authorized cybersecurity research workflows.

✨ Features

MCP Tools

• get_recent: Retrieve up to 10 of the latest malware samples.
• get_info: Obtain detailed metadata for a specific malware sample.
• get_file: Download a specified malware sample from Malware Bazaar.
• get_taginfo: Fetch relevant malware samples based on tags.

🚀 Quick Start

Step 1: Create a Malware Bazaar API Key

Visit https://auth.abuse.ch/user/me to create your API key.

Step 2: Create a .env File

MALWAREBAZAAR_API_KEY=<APIKEY>

Step 3a: Create a Virtual Environment and Install Dependencies (for Mac/Linux)

curl -LsSf https://astral.sh/uv/install.sh | sh  
cd MalwareBazaar_MCP  
uv init .  
uv venv  
source .venv/bin/activate  
uv pip install -r requirements.txt

Step 3b: Create a Virtual Environment and Install Dependencies (for Windows)

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"  
cd MalwareBazaar_MCP  
uv init .  
uv venv  
.venv\Scripts\activate  
uv pip install -r requirements.txt

Step 4a: Add Configuration to the MCP Client (for Mac/Linux)

{
    "mcpServers": {
        "malwarebazaar": {
            "description": "Malware Bazaar MCP Server",
            "command": "/Users/XXX/.local/bin/uv",
            "args": [
                "--directory",
                "/Users/XXX/Documents/MalwareBazaar_MCP",
                "run",
                "malwarebazaar_mcp.py"
            ]
        }
    }
}

Step 4b: Add Configuration to the MCP Client (for Windows)

{
    "mcpServers": {
        "malwarebazaar": {
            "description": "Malware Bazaar MCP Server",
            "command": "uv",
            "args": [
                "--directory",
                "C:\\Users\\XXX\\Document\\MalwareBazaar_MCP",
                "run",
                "malwarebazaar_mcp.py"
            ]
        }
    }
}

Step 5: Run the MCP Server

uv run malwarebazaar_mcp.py

Step 6: Run the MCP Client and Conduct Queries

Help me understand the latest hashes on Malware Bazaar.

Step 7: Run Tests

python -m unittest discover -s tests  

uv pip install coverage==7.8.0  
coverage run --branch -m unittest discover -s tests  
coverage report -m  
coverage html  
open htmlcov/index.html  # Mac  
xdg-open htmlcov/index.html  # Linux  
start htmlcov\index.html  # Windows  
coverage erase

📄 License

This project is licensed under the Apache License, Version 2.0.