Overview

This MCP (Model Context Protocol) server provides a streaming interface to MalwareBazaar metadata, enabling authorized security tools and research workflows to consume real‑time threat intelligence. Instead of periodically polling MalwareBazaar’s web APIs, clients can subscribe to an MCP-compatible stream to receive new sample metadata, tags, and contextual attributes as they arrive. This is useful for threat-hunting pipelines, automated triage, and enrichment workflows that need low-latency access to malware sample signals.

The project exposes both push and pull‑style endpoints (WebSocket/SSE and REST) that follow MCP conventions for context delivery. It includes filtering and access control so organizations can tailor which samples are forwarded to downstream systems and ensure only authorized consumers access the stream.

Features

Real‑time streaming of MalwareBazaar sample metadata (SHA256, filenames, tags, timestamps, etc.)
MCP‑compatible endpoints (WebSocket and Server‑Sent Events) for persistent subscriptions
REST endpoints for history and on‑demand queries
Filter rules (by tag, file type, YARA match, or custom attributes)
Authentication and token‑based access control for authorized consumers
Docker and local development support for quick deployment
Configurable logging and rate limiting for operational stability

Installation / Configuration

Clone the repository and run with Docker (recommended) or locally with Python.

Clone:

git clone https://github.com/mytechnotalent/MalwareBazaar_MCP.git
cd MalwareBazaar_MCP

Run with Docker:

# build and run container
docker build -t malwarebazaar-mcp .
docker run -d \
  -e PORT=8080 \
  -e MCP_TOKEN=your_mcp_token_here \
  -e MALWAREBAZAAR_API_KEY=your_mb_api_key_if_required \
  -p 8080:8080 \
  --name mb-mcp \
  malwarebazaar-mcp

Docker Compose example:

version: "3.7"
services:
  mcp:
    image: malwarebazaar-mcp:latest
    build: .
    ports:
      - "8080:8080"
    environment:
      - PORT=8080
      - MCP_TOKEN=${MCP_TOKEN}
      - MALWAREBAZAAR_API_KEY=${MALWAREBAZAAR_API_KEY}
    restart: unless-stopped

Local (Python) development:

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# run server
export PORT=8080
export MCP_TOKEN=your_mcp_token_here
python app.py

Configuration options (example environment variables):

PORT — server listen port (default: 8080)
MCP_TOKEN — token required to subscribe to streams
MALWAREBAZAAR_API_KEY — optional, if you use an authenticated MB endpoint
LOG_LEVEL — logging verbosity (info, debug, warn)
FILTER_RULES — JSON or path to file with default filter configuration

Available Resources

Endpoints and sample usage. Replace HOST and TOKEN with your server values.

Subscribe via Server‑Sent Events (SSE):

curl -N -H "Authorization: Bearer $MCP_TOKEN" \
  "http://HOST:PORT/stream/sse?filter=tags:ransomware"

Connect via WebSocket:

# example using websocat
websocat "ws://HOST:PORT/stream/ws" -H "Authorization: Bearer $MCP_TOKEN"

REST: fetch recent metadata

curl -H "Authorization: Bearer $MCP_TOKEN" "http://HOST:PORT/api/recent?limit=50"

Common metadata fields in each message:

Field	Type	Description
sha256	string	SHA256 hash of the sample
file_name	string	Original filename (if known)
tags	array[string]	MalwareBazaar tags (e.g., ransomware, trojan)
signature	string	AV signature or family label
file_type	string	File type or extension
size	integer	File size in bytes
date	string	ISO8601 timestamp when sample was observed
download_url	string	(if enabled) URL to download sample (restricted)

Example SSE payload (JSON):

{
  "sha256": "abcdef123...",
  "file_name": "invoice.doc",
  "tags": ["ransomware"],
  "signature": "Some:ThreatFamily",
  "file_type": "doc",
  "size": 123456,
  "date": "2026-04-01T12:34:56Z",
  "download_url": "https://..."
}

Use Cases

Threat enrichment: Subscribe to the stream and automatically add new sample metadata to a SIEM or CTI platform to enrich alerts with the latest indicators.
- Example: A lambda function receives SSE events, looks up related IP/URL indicators, and appends context to active incidents.
Automated triage: Feed incoming metadata into sandboxing or YARA‑based analysis to prioritize potentially dangerous samples for further inspection.
- Example: A downstream worker matches incoming items against internal YARA rules and queues matching samples for dynamic analysis.
Community research and monitoring: Researchers can keep a low‑latency record of newly observed samples for longitudinal studies or time‑series analysis.
- Example: Store stream messages in a time‑series database to analyze trends in file types and families over weeks.
Integration with detection pipelines: Use filters to forward only specific tags (e.g., ransomware) to IDS/EDR policy managers for faster rule updates.

Security and Best Practices

Use TLS in production for both SSE and WebSocket connections.
Protect download URLs and sensitive sample artifacts; enforce least privilege for tokens.
Apply server‑side rate limiting and validation on filter inputs to avoid abuse.
Rotate MCP_TOKEN and API keys regularly and store them securely (e.g., secrets manager).

For full implementation details and source code, see the repository on GitHub: https://github.com/mytechnotalent/MalwareBazaar_MCP

MalwareBazaar MCP Server for Real Time Threat Intelligence