mukul975

Malware Sandbox MCP — Development skill for Claude Code

Development community

Detonate files & URLs in cloud malware sandboxes (Hybrid Analysis, tria.ge, ANY.RUN) and enrich IOCs across MalwareBazaar, ThreatFox, URLhaus, Feodo, URLScan & VirusTotal — straight from Claude.

How to install Malware Sandbox MCP

This entry records only its repository, not the path inside it, so there is no exact command to give. Open mukul975/Malware-Sandbox-mcp and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Malware Sandbox MCP does

Detonate files & URLs in cloud malware sandboxes (Hybrid Analysis, tria.ge, ANY.RUN) and enrich IOCs across MalwareBazaar, ThreatFox, URLhaus, Feodo, URLScan & VirusTotal — straight from Claude. BYOK, async, MITRE ATT&CK.

Alternatives in Development

Skills — My personal directory of skills, straight from my .claude directory 8.8k ★
Ansoff Matrix — Ansoff Matrix analysis across 4 growth strategy quadrants 7.8k ★
Microsandbox — Open-source self-hosted MicroVM sandboxes with sub-200ms startup, hardware-level isolation via libkrun 5k ★

README

malware-sandbox-mcp

![Malware Sandbox MCP — detonate, normalize, enrich for Claude](.github/social-preview.png)

[![CI](https://img.shields.io/github/actions/workflow/status/mukul975/Malware-Sandbox-mcp/ci.yml?branch=main&label=CI)](https://github.com/mukul975/Malware-Sandbox-mcp/actions/workflows/ci.yml) [![License: MIT](https://img.shields.io/github/license/mukul975/Malware-Sandbox-mcp)](LICENSE) [![Python](https://img.shields.io/badge/python-3.11%20%7C%203.12%20%7C%203.13-blue)](pyproject.toml) [![MCP](https://img.shields.io/badge/MCP-compatible-blueviolet)](https://modelcontextprotocol.io) [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff) [![Stars](https://img.shields.io/github/stars/mukul975/Malware-Sandbox-mcp?style=social)](https://github.com/mukul975/Malware-Sandbox-mcp/stargazers)

**Detonate suspicious files and URLs in cloud malware sandboxes — and pull back normalized verdicts, IOCs and MITRE ATT&CK techniques — directly from Claude.**

[!WARNING] **For authorized security research and defensive use only.** This server submits files and URLs to **third-party cloud sandboxes**; on free/community tiers (tria.ge, abuse.ch, Hybrid Analysis) submissions and results may be **public and non-deletable**. Do not submit confidential, personal, or proprietary data. This repository contains **no live malware samples**. You are responsible for complying with each provider's Terms of Service and your local laws. See [Safety, legal & responsible use](#safety-legal--responsible-use).

The problem

Triaging one suspicious sample means juggling four browser tabs: submit to a sandbox, wait, copy the verdict, pivot the C2 into a threat-intel database, look the hash up on VirusTotal, then hand-map behaviours to ATT&CK. Every report has a different schema, and the raw JSON is hundreds of kilobytes — far too large to paste into an LLM.