mcpField
R
Ransomware Live MCP Server

Ransomware Live MCP Server

Local
github.com/slouchdSecurity0Updated 80w ago
Repository

About Ransomware Live MCP Server

Ransomware Live MCP Server connects MCP clients to ransomware.live data for security researchers and analysts. It supports searches across victims and ransomware groups by time, location, sector, and keyword.

Key features

  1. 01Recent victim records
  2. 02Victim counts by sector
  3. 03Victim searches by sector and country
  4. 04Victim searches by year and month
  5. 05Keyword-based victim search
  6. 06Ransomware group and victim details

Use cases

  1. 01Review recent ransomware claims
  2. 02Find victims in a sector or country
  3. 03Track claims over time
  4. 04Research a ransomware group

MCP support

The MCP server exposes ransomware.live API data through tools for MCP clients, including victim and ransomware group queries.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

No install method listed yet

We haven’t collected a package or remote endpoint for this server. Follow the instructions in the project README.

Repository

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

Ransomware Live MCP Server

This model context protocol (MCP) server interfaces with the ransomware.live API. Allowing you to use any LLM/MCP client of your choosing to reason over this data and find insights.

Credit for ransomware.live goes to its creator Julien Mousqueton.

🧰 Available Tools and Resources

  • get_recent_victims: tool - get details about the last 100 victims claimed by ransomware groups that are tracked by ransomware.live
  • get_sector_counts: tool - get the number of victims by sector that are tracked by ransomware.live
  • get_victims_by_sector: tool - get details about victims within a specific sector
  • get_victims_by_sector_countrycode: tool - get details about victims within a specific sector and country code
  • get_victims_by_countrycode: tool - get details about victims within a specific country
  • get_victims_by_year: tool - get details about the victims within a specific year
  • get_victims_by_year_month: tool - get details about the victims within a specific year and month
  • get_victims_by_keyword: tool - query for victims by keyword
  • get_all_ransomware_groups: tool - get details about all ransomware groups that are tracked by ransomware.live
  • get_ransomware_group: tool - get details about a specific ransomware group according to ransomware.live
  • get_ransomware_group_victims: tool - get all victims of a specific ransomware group according to ransomware.live

📝 Usage

Start the server using the default stdio transport

uv run ransomwarelive_mcp_server

🧑‍💻 Usage (Development)

Start the server and test it with the MCP inspector

uv add "mcp[cli]"
mcp dev server.py

🔍 Example Use Case

Using the MCP server with Claude desktop (you must have Claude desktop installed)

uv add "mcp[cli]"
mcp install server.py --name "Ransomware Live MCP Server"

With a basic prompt:

Claude desktop MCP test

With a basic prompt and visual output:

Claude desktop MCP test

🪪 License

MIT License

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.