Threat.Zone

This MCP server provides AI assistants with comprehensive malware analysis capabilities through integration with the Threat.Zone API, built by the Malwation Team using Python with FastMCP, httpx, and Pydantic. It offers multiple analysis methods including static analysis, dynamic sandbox execution with configurable environments (Windows, macOS, Android, Linux), URL scanning, and CDR (Content Disarm and Reconstruction) processing, alongside detailed result retrieval for indicators of compromise, YARA rules, network traffic, and configuration extraction. The implementation features extensive sandbox customization options (timeout settings, environment selection, evasion techniques), artifact management with download capabilities for sanitized files and HTML reports, and supports both public and private scan modes, making it valuable for security researchers, malware analysts, and AI assistants that need programmatic access to advanced threat analysis workflows.

Source

Repository: https://github.com/threat-zone/threatzonemcp