MalwareTracker Document Malware & AI Safety Scanner

MalwareTracker & QuickSand MCP Server (malwaretracker-mcp)

Official Model Context Protocol (MCP) server for MalwareTracker.com and QuickSand.

Inspect untrusted PDFs, Microsoft Office documents (DOC, DOCX, XLS, XLSX, PPT, PPTX, RTF, OneNote), emails (EML, MSG), and RAG ingestion inputs in <100ms for:

• Weaponized Document Exploits & Macros — 239+ YARA signatures covering 67+ Office/PDF CVEs, OLE2/OOXML stream unpacking, VBA stomping, XLM macros, and encrypted VelvetSweatshop payloads.
• Hidden AI / RAG Prompt Injection — Invisible PDF rendering (3 Tr), zero-point font overrides, <w:vanish/> hidden OOXML instructions, spoofed <tool_call> tags, and Markdown data-exfiltration beacons.
• Zero-Retention Compliance — In-memory scanning (?store=false) for SOC 2, HIPAA, and ISO 27001 workflows.

Get a free API key (100 scans/month) at https://api.malwaretracker.com/portal.

---

Quickstart

Option A: 1-Click Plugin Install (Google Antigravity, Claude Code, Cursor)

• Google Antigravity:

  agy plugin install https://github.com/tylabs/malwaretracker-mcp
  

• Claude Code:

  /plugin marketplace add tylabs/malwaretracker-mcp
  /plugin install malwaretracker@malwaretracker
  

• Agent Skills (skills.sh):

  npx skills add tylabs/malwaretracker-mcp
  

Option B: Hosted Remote Streamable HTTP + OAuth 2.1 (Zero local install)

• Claude.ai / OAuth 2.1 Connectors: Connect directly to https://api.malwaretracker.com/mcp/oauth (supports OAuth 2.1 + PKCE S256, Dynamic Client Registration, Google Sign-In, and API key auth).
• Bearer / Header Streamable HTTP (https://api.malwaretracker.com/mcp):

  {
    "mcpServers": {
      "malwaretracker-remote": {
        "type": "streamable-http",
        "url": "https://api.malwaretracker.com/mcp",
        "headers": {
          "Authorization": "Bearer mt_live_YOUR_API_KEY"
        }
      }
    }
  }
  

Option C: Local stdio via uvx (Recommended for scanning local disk paths)

Add to claude_desktop_config.json, .cursor/mcp.json, or Windsurf / VS Code MCP settings:

{
  "mcpServers": {
    "malwaretracker": {
      "command": "uvx",
      "args": ["malwaretracker-mcp"],
      "env": {
        "MALWARETRACKER_API_KEY": "mt_live_YOUR_API_KEY"
      }
    }
  }
}

Or install with pip:

pip install malwaretracker-mcp

---

Available MCP Tools

Tool	Description	Quota Cost
quicksand_scan_document	Scan a local file_path, content_base64, or text_content in <100ms for document malware, CVEs, and AI prompt injection (store=false zero-retention).	1 scan
quicksand_triage_document	Fast Tier-0 SOAR phishing triage returning allow, detonate_in_sandbox, or quarantine_and_detonate plus CVE/MITRE/AI-safety verdicts.	1 scan
malwaretracker_lookup_hash	Look up cached threat intelligence & stream analysis reports by MD5, SHA1, SHA256, or SHA512.	Free
malwaretracker_list_yara_catalog	Search MalwareTracker's YARA signature catalog, CVEs, MITRE ATT&CK IDs, and AI prompt-injection rules.	Free (no key needed)
malwaretracker_get_quota	Check active MalwareTracker plan, monthly usage, and remaining scan quota.	Free

Built-in MCP Prompt

• audit_untrusted_document(file_path) — Enforces a pre-ingestion security audit before an AI agent reads or summarizes an untrusted document.

---

LangChain / LlamaIndex Python Guardrail

malwaretracker-mcp also bundles SafeQuickSandDocumentGuard for Python RAG pipelines:

from malwaretracker_mcp import SafeQuickSandDocumentGuard

guard = SafeQuickSandDocumentGuard(api_key="mt_live_YOUR_API_KEY")
verdict = guard.verify_file("candidate_resume.pdf")
# Raises PermissionError in <100ms if an exploit or hidden prompt injection is detected!

---

Links

• Website & Interactive Scanner: https://malwaretracker.com
• Developer Portal & Free API Key: https://api.malwaretracker.com/portal
• API Reference: https://malwaretracker.com/api.html
• Privacy Policy: https://malwaretracker.com/privacy.html
• Terms of Service: https://malwaretracker.com/terms.html
• License: MIT