# MCP Server Integrations for Malware Analysis

Optional MCP (Model Context Protocol) servers that accelerate the analysis workflow. These are **not dependencies** — every skill works without them. But they eliminate manual steps like copy-pasting hashes into browser tabs or exporting IOCs by hand.

## Quick Setup

MCP servers are configured in your Claude Code settings (`~/.claude/settings.json`) or Claude Desktop config. Each requires an API key set as an environment variable.

```json
{
  "mcpServers": {
    "virustotal": {
      "command": "npx",
      "args": ["-y", "@burtthecoder/mcp-virustotal"],
      "env": { "VIRUSTOTAL_API_KEY": "your-key" }
    }
  }
}
```

---

## Recommended MCP Servers

### 1. VirusTotal MCP Server

**What it does:** Query VirusTotal for file hashes, URLs, domains, and IP addresses directly from Claude — no browser needed.

**GitHub:** [BurtTheCoder/mcp-virustotal](https://github.com/BurtTheCoder/mcp-virustotal)

**Tools provided:**
- File hash analysis (MD5/SHA1/SHA256) — detection results, behaviors, network connections, dropped files, threat actors
- URL analysis — security scan results, contacted domains/IPs, redirects
- Domain analysis — DNS records, WHOIS, SSL certificates, subdomains, historical data
- IP analysis — geolocation, reputation, communicating files, historical certificates

**Which skills benefit:**

| Skill | How It Helps |
|-------|-------------|
| **malware-triage** | Automates the reputation check phase — paste a hash and get detection rates, family name, first-seen date, community comments instantly instead of opening VirusTotal in a browser |
| **malware-dynamic-analysis** | Look up C2 IPs and domains observed during execution to check if they're already known malicious |
| **detection-engineer** | Validate IOCs against VT before including in rules — confirm IPs/domains are still active and associated with the threat |
| **malware-report-writer** | Pull detection rates and threat actor associations for the report's sample information section |

**Setup:**
```json
{
  "mcpServers": {
    "virustotal": {
      "command": "npx",
      "args": ["-y", "@burtthecoder/mcp-virustotal"],
      "env": {
        "VIRUSTOTAL_API_KEY": "your-api-key"
      }
    }
  }
}
```

**API key:** Free tier at [virustotal.com](https://www.virustotal.com/) (4 lookups/min, 500/day). Premium for higher limits.

---

### 2. Threat.Zone MCP Server

**What it does:** Submit files and URLs to Threat.Zone's sandbox for automated malware analysis — sandbox execution, static analysis, and CDR (Content Disarm and Reconstruction).

**GitHub:** [threat-zone/threatzonemcp](https://github.com/threat-zone/threatzonemcp)

**Tools provided:**
- `scan_file_sandbox` — Submit files for sandbox analysis with full configuration (environment, timeout, internet, HTTPS inspection, modules)
- `scan_file_sandbox_simple` — Quick sandbox submission with defaults
- `scan_file_static` — Static analysis submission
- `scan_file_cdr` — Content Disarm and Reconstruction
- Network activity retrieval — DNS queries, HTTP/TCP/UDP requests, network threats
- Artifact and IOC retrieval from analysis results
- Config extractor results
- HTML report generation

**Which skills benefit:**

| Skill | How It Helps |
|-------|-------------|
| **malware-triage** | Submit samples for quick automated analysis when you don't have time for manual VM execution |
| **malware-dynamic-analysis** | Supplements local VM analysis — compare your findings with Threat.Zone's sandbox results |
| **specialized-file-analyzer** | Submit Office docs, PDFs, scripts for automated detonation without manual tool setup |
| **detection-engineer** | Pull network IOCs (DNS, HTTP, TCP) directly from sandbox results to feed into Sigma/Suricata rules |

**Setup:**
```bash
pip install threatzonemcp
```

```json
{
  "mcpServers": {
    "threatzone": {
      "command": "python",
      "args": ["-m", "threatzonemcp"],
      "env": {
        "THREATZONE_API_KEY": "your-api-key"
      }
    }
  }
}
```

**API key:** Register at [threat.zone](https://app.threat.zone/)

---

### 3. Threat Intel MCP Server (Multi-Source)

**What it does:** Unified access to multiple threat intelligence feeds — AlienVault OTX, AbuseIPDB, GreyNoise, and abuse.ch platforms (URLhaus, MalwareBazaar, ThreatFox, Feodo Tracker).

**GitHub:** [aplaceforallmystuff/mcp-threatintel](https://github.com/aplaceforallmystuff/mcp-threatintel)

**Tools provided:**
- **AbuseIPDB** — IP reputation scores, abuse reports, confidence ratings
- **GreyNoise** — Distinguish internet background noise from targeted attacks
- **URLhaus** — Malicious URL lookups (abuse.ch)
- **MalwareBazaar** — Malware sample lookups by hash (abuse.ch)
- **ThreatFox** — IOC lookups across the ThreatFox database (abuse.ch)
- **Feodo Tracker** — Botnet C2 infrastructure tracking (no auth required)
- **AlienVault OTX** — Pulse and indicator lookups

**Which skills benefit:**

| Skill | How It Helps |
|-------|-------------|
| **malware-triage** | Cross-reference hashes against MalwareBazaar and ThreatFox alongside VirusTotal for broader coverage |
| **malware-dynamic-analysis** | Check C2 IPs against AbuseIPDB and GreyNoise to assess whether traffic is targeted or background noise |
| **detection-engineer** | Validate IOCs against multiple feeds before writing rules — reduces false positives in Sigma/Suricata rules |

**Setup:**
```json
{
  "mcpServers": {
    "threatintel": {
      "command": "npx",
      "args": ["-y", "mcp-threatintel-server"],
      "env": {
        "OTX_API_KEY": "your-otx-key",
        "ABUSEIPDB_API_KEY": "your-abuseipdb-key",
        "GREYNOISE_API_KEY": "your-greynoise-key",
        "ABUSECH_AUTH_KEY": "your-abusech-key"
      }
    }
  }
}
```

Tools are dynamically enabled based on which API keys you provide — you don't need all of them.

---

### 4. MISP MCP Server

**What it does:** Integrates with your MISP (Malware Information Sharing Platform) instance for threat intelligence sharing and IOC management.

**GitHub:** [bornpresident/MISP-MCP-SERVER](https://github.com/bornpresident/MISP-MCP-SERVER)

**Tools provided:**
- Search by attribute type, tag, threat actor, or TLP classification
- Cross-platform threat search (Windows, macOS, Linux, Android, iOS, IoT)
- Submit new IOCs directly to your MISP instance
- Generate threat intelligence reports from MISP data
- MISP instance statistics

**Which skills benefit:**

| Skill | How It Helps |
|-------|-------------|
| **malware-triage** | Search your organization's MISP for prior sightings of a hash, domain, or IP |
| **detection-engineer** | Push finalized IOCs directly to MISP for team-wide sharing |
| **malware-report-writer** | Pull existing threat intel context from MISP to enrich reports |

**Setup:** Requires a running MISP instance. See [GitHub README](https://github.com/bornpresident/MISP-MCP-SERVER) for configuration.

---

### 5. Shodan MCP Server

**What it does:** Search internet-connected devices, perform IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence.

**GitHub:** [BurtTheCoder/mcp-shodan](https://github.com/BurtTheCoder/mcp-shodan)

**Tools provided:**
- Search for internet-connected devices by query
- IP reconnaissance and geolocation
- DNS lookups and reverse DNS
- CVE/CPE vulnerability intelligence
- Host information and open ports

**Which skills benefit:**

| Skill | How It Helps |
|-------|-------------|
| **malware-dynamic-analysis** | Investigate C2 server infrastructure — what else is running on that IP, what ports are open, what services are exposed |
| **detection-engineer** | Enrich network IOCs with infrastructure context for more targeted Suricata rules |
| **malware-report-writer** | Add C2 infrastructure details to the network indicators section of reports |

**Setup:**
```json
{
  "mcpServers": {
    "shodan": {
      "command": "npx",
      "args": ["-y", "@burtthecoder/mcp-shodan"],
      "env": {
        "SHODAN_API_KEY": "your-api-key"
      }
    }
  }
}
```

**API key:** Free tier at [shodan.io](https://www.shodan.io/)

---

### 6. Volatility MCP Server (Memory Forensics)

**What it does:** Run Volatility 3 memory forensics plugins via natural language — process analysis, network forensics, and malware detection from memory dumps.

**GitHub:** [bornpresident/Volatility-MCP-Server](https://github.com/bornpresident/Volatility-MCP-Server)

**Tools provided:**
- Process analysis — running processes, parent-child relationships
- Network forensics — identify connections in memory dumps
- Malware detection — code injection, suspicious artifacts
- Plugin execution via natural language

**Which skills benefit:**

| Skill | How It Helps |
|-------|-------------|
| **malware-dynamic-analysis** | Analyze memory dumps exported from your VM without needing to remember Volatility plugin syntax |
| **malware-report-writer** | Extract memory forensics findings directly for the technical details section |

**Setup:** Requires Volatility 3 installed locally. See [GitHub README](https://github.com/bornpresident/Volatility-MCP-Server) for configuration.

---

## Skill-to-MCP Mapping

Quick reference for which MCP servers help with which skills:

| Skill | VirusTotal | Threat.Zone | Threat Intel | MISP | Shodan | Volatility |
|-------|:----------:|:-----------:|:------------:|:----:|:------:|:----------:|
| **malware-triage** | ★ | ★ | ★ | ○ | | |
| **malware-dynamic-analysis** | ○ | ○ | ○ | | ○ | ★ |
| **specialized-file-analyzer** | ○ | ★ | | | | |
| **detection-engineer** | ○ | ○ | ★ | ★ | ○ | |
| **malware-report-writer** | ○ | | | ○ | ○ | ○ |

★ = high impact (eliminates manual steps) | ○ = useful (adds context)

## Recommended Starting Setup

If you're setting up from scratch, start with these two — they cover the most common manual steps:

1. **VirusTotal** — eliminates manual hash/URL/domain lookups during triage (free tier is sufficient for most analysis)
2. **Threat Intel (abuse.ch)** — adds MalwareBazaar and ThreatFox coverage with just the `ABUSECH_AUTH_KEY`

Add the others as your workflow demands them.