Oletools MCP Server

A security microservice project based on FastMCP, used for static analysis of potential malicious content in Microsoft Office documents, supporting functions such as VBA/XLM macro detection and DDE link check.

Security Developer tools #Document analysis #Malicious detection #Macro security #Static scanning .Python

rating : 2.5 points

downloads : 9.0K

update time : 2025-04-29

Open Site

What is OLETools Secure MCP Server?

This is a service specifically designed to analyze the security of Microsoft Office documents (such as Excel, Word, PPT). It can automatically detect potential malicious code, suspicious macro commands, and other security threats in documents.

How to use this service?

After connecting to the service through the Claude Desktop application, simply send the document path to obtain a security analysis report. The service will automatically scan and return detailed detection results.

Applicable scenarios

It is suitable for scenarios such as enterprise security teams analyzing suspicious email attachments, individuals checking downloaded Office files, and developers testing document security.

Main features

VBA macro analysis

Detect VBA macro code in Word/Excel documents and identify suspicious behavior patterns

XLM macro detection

Identify Excel 4.0 (XLM) macros and perform deobfuscation analysis

DDE link check

Detect dynamic data exchange (DDE) fields and commands in documents

OLE object extraction

Extract embedded OLE objects from documents for separate analysis

XLL plugin check

Analyze the exported functions of Excel plugins (XLL)

Threat indicator extraction

Automatically extract threat indicators such as URLs, IPs, and hashes from documents

Advantages

Analyze documents without installing professional security software

Support multiple Office document formats and versions

Provide detailed risk scores and classifications

Seamlessly integrate with Claude Desktop

Limitations

Only support static analysis and cannot detect runtime behavior

Have limited analysis capabilities for encrypted documents

Require Python environment support

How to use

Install dependencies

Ensure that Python 3.6+ and necessary components are installed

Configure Claude Desktop

Edit the configuration file and restart the application

Start the service

Run the main service program

Use the analysis function

Enter the analysis command in Claude Desktop

Usage examples

Analyze a suspicious Word document

Quickly check if a suspicious email attachment contains malicious macros after receiving it

Check an Excel file

Verify if a downloaded Excel spreadsheet contains hidden XLM macros

Frequently Asked Questions

Which file formats does the service support?

How long does the analysis take?

How to determine if a document is secure?

Does it support password - protected documents?

Related resources

OLETools official documentation

Technical documentation of the core analysis tool

MCP protocol description

Technical specification of the Model Context Protocol

Example configuration file

Service configuration example

🚀 Secure MCP Server Based on OleTools

This project offers a microservice that uses FastMCP to analyze Microsoft Office documents (such as Excel, Word, PowerPoint) and related file types (e.g., XLL add - ins). It detects potential malicious content through static analysis techniques. The service integrates external tools like oletools, XLMMacroDeobfuscator, and pefile.

🚀 Quick Start

This secure MCP server provides a robust solution for analyzing Microsoft Office documents and related files. It leverages multiple external tools to detect potential threats.

✨ Features

Analyze VBA macros (olevba)
Detect XLM macros (XLMMacroDeobfuscator, olevba)
Check DDE links (msodde)
Extract embedded OLE objects (oleobj)
Analyze suspicious functions exported by XLL files (pefile)
Extract IOCs (URLs, IPs, hashes, emails) using iocextract
Provide basic validation based on MIME type and file size (python - magic)
Configure a scoring system for basic risk classification
Designed for integration with systems supporting the MCP protocol (e.g., compatible versions of Claude Desktop)

📦 Installation

Prerequisites

Python 3.6 or higher
OLETools: Install via pip install oletools
XLMMacroDeobfuscator: Install via pip install XLMMacroDeobfuscator
python - magic: On Windows, install via pip install python - magic - bin
iocextract (optional): Install via pip install iocextract for advanced IOC extraction
Claude Desktop application

Installation Steps

Clone the repository:

git clone https://github.com/pradeep895/oletools - mcp - server.git
cd oletools - mcp - server

Install dependencies:
```
pip install -r requirements.txt
```
Download the "Claude Desktop" application. Go to the developer settings and edit the "claude_desktop_config.json" file. Paste the content into the configuration file. Restart the application.
Run the configuration file:
```
python config.py
```
Start the server:
```
python mcp_service.py
```
Check if the "hammer icon" appears in the "Claude Desktop" application, indicating that the MCP tool is available.
Enter the command analyze_vba_macros in <filepath\example.xlsm> to analyze an Excel file and get the results:
```
analyze_vba_macros file_path:"C:\path\to\your\example.xlsm"
```