Malwagon
Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.
我該用這個嗎
品質與安全性
根據工具定義與協定合規性的自動化分析。
上下文成本
這是每次將伺服器的工具載入模型上下文時所消耗的約略 token 數量。數量越高，可用於其他工作的注意力就越少。
安裝
一鍵安裝
將以下內容加入你的 `claude_desktop_config.json` 檔案：
{
"mcpServers": {
"malwagon": {
"url": "https://malwagon.com/mcp"
}
}
}遠端端點
https://malwagon.com/mcpstreamable-http它能做什麼
工具清單
工具（5）
🟢lookup_hash(sha256)
Find analyses of a known SHA-256 digest. Returns the caller's own scans of those bytes plus any publicly shared scan of them. Sends nothing anywhere: this searches scans that already exist on this platform. Answers with an empty list when the hash is unknown or not visible to this token, without distinguishing the two.
輸入結構描述
{
"type": "object",
"properties": {
"sha256": {
"type": "string",
"description": "A 64 character hex SHA-256 digest.",
"minLength": 64,
"maxLength": 64
}
},
"required": [
"sha256"
],
"additionalProperties": false
}輸出結構描述
{
"type": "object",
"properties": {
"sha256": {
"type": "string"
},
"scans": {
"type": "object",
"description": "A bounded list: items plus what was returned, counted and cut.",
"properties": {
"items": {
"type": "array"
},
"returned": {
"type": "integer"
},
"total": {
"type": "integer"
},
"truncated": {
"type": "boolean"
}
},
"required": [
"items",
"returned",
"total",
"truncated"
]
}
},
"required": [
"sha256",
"scans"
]
}🟢get_report(scan_id)
The derived analysis report for one scan: verdict, capabilities, behaviour summary, observed operations and defanged indicators. Derived data only - it never contains the sample's bytes, its decompiled source, a download link or an artifact reference. Every list in the result reports what was returned, counted and truncated. Answers 'not found' for a scan that does not exist and for one this token may not read, identically.
輸入結構描述
{
"type": "object",
"properties": {
"scan_id": {
"type": "integer",
"description": "The scan's numeric id."
}
},
"required": [
"scan_id"
],
"additionalProperties": false
}🟢search_indicator(indicator, type)
Find scans where an indicator was observed: an IP, a domain, a URL, a mutex, a registry key, a hash or a JA3/JA4 fingerprint. The indicator is matched exactly; defanged input such as 'evil[.]com' is refanged first. Only scans this token may read are searched.
輸入結構描述
{
"type": "object",
"properties": {
"indicator": {
"type": "string",
"description": "The exact indicator value. Defanged forms are accepted.",
"maxLength": 512
},
"type": {
"type": "string",
"description": "Optional indicator type to narrow the search: ip, domain, url, md5, sha1, sha256, imphash, mutex, registry, filepath, email, ja3, ja4, user_agent."
}
},
"required": [
"indicator"
],
"additionalProperties": false
}輸出結構描述
{
"type": "object",
"properties": {
"indicator": {
"type": "string"
},
"matches": {
"type": "object",
"description": "A bounded list: items plus what was returned, counted and cut.",
"properties": {
"items": {
"type": "array"
},
"returned": {
"type": "integer"
},
"total": {
"type": "integer"
},
"truncated": {
"type": "boolean"
}
},
"required": [
"items",
"returned",
"total",
"truncated"
]
}
},
"required": [
"indicator",
"matches"
]
}🟢poll_scan(scan_id)
The current status of one scan, for polling after submit_scan. Cheap enough to call in a loop. 'terminal' means the scan will not change again; 'report_available' means get_report will return a full report. Answers 'not found' for an unknown scan and an unreadable one identically.
輸入結構描述
{
"type": "object",
"properties": {
"scan_id": {
"type": "integer",
"description": "The scan's numeric id."
}
},
"required": [
"scan_id"
],
"additionalProperties": false
}輸出結構描述
{
"type": "object",
"properties": {
"scan_id": {
"type": "integer"
},
"module": {
"type": "string"
},
"status": {
"type": "string"
},
"verdict": {
"type": [
"string",
"null"
]
},
"score": {
"type": [
"integer",
"null"
]
},
"tags": {
"type": "object"
},
"submitted_at": {
"type": [
"string",
"null"
]
},
"finished_at": {
"type": [
"string",
"null"
]
},
"sha256": {
"type": [
"string",
"null"
]
},
"size": {
"type": [
"integer",
"null"
]
},
"mime": {
"type": [
"string",
"null"
]
},
"terminal": {
"type": "boolean"
},
"report_available": {
"type": "boolean"
}
}
}🟡submit_scan(module, target, private)
Queue a new analysis of a target that can be named as text: a SHA-256 to look up, a URL to visit, a command to run, or a package to install. Uploading a file or a document is not possible over MCP. This spends the account's own credits and is subject to its plan limits. Poll the returned scan_id with poll_scan, then read it with get_report.
輸入結構描述
{
"type": "object",
"properties": {
"module": {
"type": "string",
"enum": [
"hash",
"url",
"command",
"package"
],
"description": "hash: look up a SHA-256. url: visit a URL in a browser VM. command: run a command line in a Windows VM. package: install a package in a Linux VM. url and package detonate with internet access and are refused on a plan that does not include it."
},
"target": {
"type": "string",
"description": "The digest, URL, command line or package specifier, matching the chosen module.",
"maxLength": 2048
},
"private": {
"type": "boolean",
"description": "Keep the scan off the public corpus. Free plans cannot make a scan private and this is ignored for them."
}
},
"required": [
"module",
"target"
],
"additionalProperties": false
}輸出結構描述
{
"type": "object",
"properties": {
"scan_id": {
"type": "integer"
},
"module": {
"type": "string"
},
"status": {
"type": "string"
},
"verdict": {
"type": [
"string",
"null"
]
},
"score": {
"type": [
"integer",
"null"
]
},
"tags": {
"type": "object"
},
"submitted_at": {
"type": [
"string",
"null"
]
},
"finished_at": {
"type": [
"string",
"null"
]
},
"sha256": {
"type": [
"string",
"null"
]
},
"size": {
"type": [
"integer",
"null"
]
},
"mime": {
"type": [
"string",
"null"
]
},
"terminal": {
"type": "boolean"
},
"report_available": {
"type": "boolean"
}
}
}社群
證據