MalwareBazaarSAFE

An AI-driven MCP server that autonomously interfaces with Malware Bazaar, delivering real-time threat intel and sample metadata for authorized cybersecurity research workflows.

MCP Tools

get_recent: Get up to 10 most recent samples from MalwareBazaar.

get_info: Get detailed metadata about a specific malware sample.

get_file: Download a malware sample from MalwareBazaar.

get_taginfo: Get malware samples associated with a specific tag.

Step 1: Create a MalwareBazaar APIKEY

https://auth.abuse.ch/user/me

Step 2: Create .env

MALWAREBAZAAR_API_KEY=

Step 3a: Create Virtual Env & Install Requirements - MAC/Linux

curl -LsSf https://astral.sh/uv/install.sh | sh
cd MalwareBazaar_MCP
uv init .
uv venv
source .venv/bin/activate
uv pip install -r requirements.txt

Step 3b: Create Virtual Env & Install Requirements - Windows

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
cd MalwareBazaar_MCP
uv init .
uv venv
.venv\Scripts\activate
uv pip install -r requirements.txt

Step 4a: Add Config to the MCP Client - MAC/Linux

{
"mcpServers": {
"malwarebazaar": {
"description": "Malware Bazaar MCP Server",
"command": "/Users/XXX/.local/bin/uv",
"args": [
"--directory",
"/Users/XXX/Documents/MalwareBazaar_MCP",
"run",
"malwarebazaar_mcp.py"
]
}
}
}

Step 4b: Add Config to the MCP Client - Windows

{
"mcpServers": {
"malwarebazaar": {
"description": "Malware Bazaar MCP Server",
"command": "uv",
"args": [
"--directory",
"C:\Users\XXX\Document\MalwareBazaar_MCP",
"run",
"malwarebazaar_mcp.py"
]
}
}
}

Step 5: Run MCP Server

uv run malwareb