reverse-skills-max/vendor-new/malware-analysis-claude-skills/references/mcp_integrations.md

MCP Server Integrations for Malware Analysis

Optional MCP (Model Context Protocol) servers that accelerate the analysis workflow. These are not dependencies — every skill works without them. But they eliminate manual steps like copy-pasting hashes into browser tabs or exporting IOCs by hand.

Quick Setup

MCP servers are configured in your Claude Code settings (~/.claude/settings.json) or Claude Desktop config. Each requires an API key set as an environment variable.

{
  "mcpServers": {
    "virustotal": {
      "command": "npx",
      "args": ["-y", "@burtthecoder/mcp-virustotal"],
      "env": { "VIRUSTOTAL_API_KEY": "your-key" }
    }
  }
}

---

Recommended MCP Servers

1. VirusTotal MCP Server

What it does: Query VirusTotal for file hashes, URLs, domains, and IP addresses directly from Claude — no browser needed.

GitHub: BurtTheCoder/mcp-virustotal

Tools provided:

• File hash analysis (MD5/SHA1/SHA256) — detection results, behaviors, network connections, dropped files, threat actors
• URL analysis — security scan results, contacted domains/IPs, redirects
• Domain analysis — DNS records, WHOIS, SSL certificates, subdomains, historical data
• IP analysis — geolocation, reputation, communicating files, historical certificates

Which skills benefit:

Skill	How It Helps
malware-triage	Automates the reputation check phase — paste a hash and get detection rates, family name, first-seen date, community comments instantly instead of opening VirusTotal in a browser
malware-dynamic-analysis	Look up C2 IPs and domains observed during execution to check if they're already known malicious
detection-engineer	Validate IOCs against VT before including in rules — confirm IPs/domains are still active and associated with the threat
malware-report-writer	Pull detection rates and threat actor associations for the report's sample information section

Setup:

{
  "mcpServers": {
    "virustotal": {
      "command": "npx",
      "args": ["-y", "@burtthecoder/mcp-virustotal"],
      "env": {
        "VIRUSTOTAL_API_KEY": "your-api-key"
      }
    }
  }
}

API key: Free tier at virustotal.com (4 lookups/min, 500/day). Premium for higher limits.

---

2. Threat.Zone MCP Server

What it does: Submit files and URLs to Threat.Zone's sandbox for automated malware analysis — sandbox execution, static analysis, and CDR (Content Disarm and Reconstruction).

GitHub: threat-zone/threatzonemcp

Tools provided:

• scan_file_sandbox — Submit files for sandbox analysis with full configuration (environment, timeout, internet, HTTPS inspection, modules)
• scan_file_sandbox_simple — Quick sandbox submission with defaults
• scan_file_static — Static analysis submission
• scan_file_cdr — Content Disarm and Reconstruction
• Network activity retrieval — DNS queries, HTTP/TCP/UDP requests, network threats
• Artifact and IOC retrieval from analysis results
• Config extractor results
• HTML report generation

Which skills benefit:

Skill	How It Helps
malware-triage	Submit samples for quick automated analysis when you don't have time for manual VM execution
malware-dynamic-analysis	Supplements local VM analysis — compare your findings with Threat.Zone's sandbox results
specialized-file-analyzer	Submit Office docs, PDFs, scripts for automated detonation without manual tool setup
detection-engineer	Pull network IOCs (DNS, HTTP, TCP) directly from sandbox results to feed into Sigma/Suricata rules

Setup:

pip install threatzonemcp

{
  "mcpServers": {
    "threatzone": {
      "command": "python",
      "args": ["-m", "threatzonemcp"],
      "env": {
        "THREATZONE_API_KEY": "your-api-key"
      }
    }
  }
}

API key: Register at threat.zone

---

3. Threat Intel MCP Server (Multi-Source)

What it does: Unified access to multiple threat intelligence feeds — AlienVault OTX, AbuseIPDB, GreyNoise, and abuse.ch platforms (URLhaus, MalwareBazaar, ThreatFox, Feodo Tracker).

GitHub: aplaceforallmystuff/mcp-threatintel

Tools provided:

• AbuseIPDB — IP reputation scores, abuse reports, confidence ratings
• GreyNoise — Distinguish internet background noise from targeted attacks
• URLhaus — Malicious URL lookups (abuse.ch)
• MalwareBazaar — Malware sample lookups by hash (abuse.ch)
• ThreatFox — IOC lookups across the ThreatFox database (abuse.ch)
• Feodo Tracker — Botnet C2 infrastructure tracking (no auth required)
• AlienVault OTX — Pulse and indicator lookups

Which skills benefit:

Skill	How It Helps
malware-triage	Cross-reference hashes against MalwareBazaar and ThreatFox alongside VirusTotal for broader coverage
malware-dynamic-analysis	Check C2 IPs against AbuseIPDB and GreyNoise to assess whether traffic is targeted or background noise
detection-engineer	Validate IOCs against multiple feeds before writing rules — reduces false positives in Sigma/Suricata rules

Setup:

{
  "mcpServers": {
    "threatintel": {
      "command": "npx",
      "args": ["-y", "mcp-threatintel-server"],
      "env": {
        "OTX_API_KEY": "your-otx-key",
        "ABUSEIPDB_API_KEY": "your-abuseipdb-key",
        "GREYNOISE_API_KEY": "your-greynoise-key",
        "ABUSECH_AUTH_KEY": "your-abusech-key"
      }
    }
  }
}

Tools are dynamically enabled based on which API keys you provide — you don't need all of them.

---

4. MISP MCP Server

What it does: Integrates with your MISP (Malware Information Sharing Platform) instance for threat intelligence sharing and IOC management.

GitHub: bornpresident/MISP-MCP-SERVER

Tools provided:

• Search by attribute type, tag, threat actor, or TLP classification
• Cross-platform threat search (Windows, macOS, Linux, Android, iOS, IoT)
• Submit new IOCs directly to your MISP instance
• Generate threat intelligence reports from MISP data
• MISP instance statistics

Which skills benefit:

Skill	How It Helps
malware-triage	Search your organization's MISP for prior sightings of a hash, domain, or IP
detection-engineer	Push finalized IOCs directly to MISP for team-wide sharing
malware-report-writer	Pull existing threat intel context from MISP to enrich reports

Setup: Requires a running MISP instance. See GitHub README for configuration.

---

5. Shodan MCP Server

What it does: Search internet-connected devices, perform IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence.

GitHub: BurtTheCoder/mcp-shodan

Tools provided:

• Search for internet-connected devices by query
• IP reconnaissance and geolocation
• DNS lookups and reverse DNS
• CVE/CPE vulnerability intelligence
• Host information and open ports

Which skills benefit:

Skill	How It Helps
malware-dynamic-analysis	Investigate C2 server infrastructure — what else is running on that IP, what ports are open, what services are exposed
detection-engineer	Enrich network IOCs with infrastructure context for more targeted Suricata rules
malware-report-writer	Add C2 infrastructure details to the network indicators section of reports

Setup:

{
  "mcpServers": {
    "shodan": {
      "command": "npx",
      "args": ["-y", "@burtthecoder/mcp-shodan"],
      "env": {
        "SHODAN_API_KEY": "your-api-key"
      }
    }
  }
}

API key: Free tier at shodan.io

---

6. Volatility MCP Server (Memory Forensics)

What it does: Run Volatility 3 memory forensics plugins via natural language — process analysis, network forensics, and malware detection from memory dumps.

GitHub: bornpresident/Volatility-MCP-Server

Tools provided:

• Process analysis — running processes, parent-child relationships
• Network forensics — identify connections in memory dumps
• Malware detection — code injection, suspicious artifacts
• Plugin execution via natural language

Which skills benefit:

Skill	How It Helps
malware-dynamic-analysis	Analyze memory dumps exported from your VM without needing to remember Volatility plugin syntax
malware-report-writer	Extract memory forensics findings directly for the technical details section

Setup: Requires Volatility 3 installed locally. See GitHub README for configuration.

---

Skill-to-MCP Mapping

Quick reference for which MCP servers help with which skills:

Skill	VirusTotal	Threat.Zone	Threat Intel	MISP	Shodan	Volatility
malware-triage	★	★	★	○
malware-dynamic-analysis	○	○	○		○	★
specialized-file-analyzer	○	★
detection-engineer	○	○	★	★	○
malware-report-writer	○			○	○	○

★ = high impact (eliminates manual steps) | ○ = useful (adds context)

Recommended Starting Setup

If you're setting up from scratch, start with these two — they cover the most common manual steps:

1. VirusTotal — eliminates manual hash/URL/domain lookups during triage (free tier is sufficient for most analysis)
2. Threat Intel (abuse.ch) — adds MalwareBazaar and ThreatFox coverage with just the ABUSECH_AUTH_KEY

Add the others as your workflow demands them.