MalwareBazaar_MCP

MalwareBazaar_MCP

一个由 AI 驱动的 MCP 服务，可自主与 Malware Bazaar 交互，为经授权的网络安全研究工作流提供实时威胁情报和样本元数据。

MCP 工具

get_recent：从 MalwareBazaar 获取最多 10 个最新样本。

get_info：获取特定恶意软件样本的详细元数据。

get_file：从 MalwareBazaar 下载恶意软件样本。

get_taginfo：获取与特定标签关联的恶意软件样本。

步骤 1：创建 MalwareBazaar APIKEY

https://auth.abuse.ch/user/me

步骤 2：创建 .env

MALWAREBAZAAR_API_KEY=<APIKEY>

步骤 3a：创建虚拟环境并安装依赖项 - MAC/Linux

curl -LsSf https://astral.sh/uv/install.sh | sh
cd MalwareBazaar_MCP
uv init .
uv venv
source .venv/bin/activate
uv pip install -r requirements.txt

步骤 3b：创建虚拟环境并安装依赖项 - Windows

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
cd MalwareBazaar_MCP
uv init .
uv venv
.venv\Scripts\activate
uv pip install -r requirements.txt

步骤 4a：将配置添加到 MCP 客户端 - MAC/Linux

{
    "mcpServers": {
        "malwarebazaar": {
            "description": "Malware Bazaar MCP Server",
            "command": "/Users/XXX/.local/bin/uv",
            "args": [
                "--directory",
                "/Users/XXX/Documents/MalwareBazaar_MCP",
                "run",
                "malwarebazaar_mcp.py"
            ]
        }
    }
}

步骤 4b：将配置添加到 MCP 客户端 - Windows

{
    "mcpServers": {
        "malwarebazaar": {
            "description": "Malware Bazaar MCP Server",
            "command": "uv",
            "args": [
                "--directory",
                "C:\Users\XXX\Document\MalwareBazaar_MCP",
                "run",
                "malwarebazaar_mcp.py"
            ]
        }
    }
}

步骤 5：运行 MCP 服务

uv run malwarebazaar_mcp.py

步骤 6：运行 MCP 客户端并查询

Help me understnad the latest hash from Malware Bazaar.

步骤 7：运行测试

python -m unittest discover -s tests

uv pip install coverage==7.8.0
coverage run --branch -m unittest discover -s tests
coverage report -m
coverage html
open htmlcov/index.html  # MAC
xdg-open htmlcov/index.html  # Linux
start htmlcov\index.html  # Windows
coverage erase

许可证

Apache 许可证 2.0 版