TriageMCP
MCP server to enable an LLM to do basic static triage of a PE.
A minimal prompt idea could be:
You are a malware analyst tasked to analyse the sample at <PATH> with your MCP tools. Create a markdown report that summarizes your findings.
Of course supplying more info will usually yield a better result.
Installation
Install dependencies:
pip install pefile yara-python die-python mcp[cli]
Then adjust triage.py and change <TOOL>_EXE_PATH and YARA_RULE_PATH accordingly.
Claude Desktop Integration
You can install this server in Claude Desktop and interact with it right away by running:
mcp install .\triage.py
Different transport protocol
By default, without using arguments, the server will use stdio transport:
.\triage.py
To use SSE transport:
.\triage.py --transport http://127.0.0.1:8744
TODO
- VT/AnyRun/Sandbox integration
- Hash lookup
- Streamable HTTP transport
1 maintainer
Metadata
1 maintainer
Release files for iflow-mcp_eversinc33-triagemcp 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| iflow_mcp_eversinc33_triagemcp-0.1.0.tar.gz | 5.5 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| iflow_mcp_eversinc33_triagemcp-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 11.5 kB
Release files / iflow_mcp_eversinc33_triagemcp-0.1.0.tar.gz
| Download URL | iflow_mcp_eversinc33_triagemcp-0.1.0.tar.gz |
|---|---|
| Size | 5.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
cfbfffd826b1214893bf9720ae3ae4edc872968acd26c1dde5f6b0097084d15f
|
|
BLAKE2b-256 checksum How to use checksums |
3451ed8f934feba7205abb739ec617b113283e67026849c325b1afbeee924def
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.10.2 {"installer":{"name":"uv","version":"0.10.2","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Debian GNU/Linux","version":"13","id":"trixie","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
|
Release files / iflow_mcp_eversinc33_triagemcp-0.1.0-py3-none-any.whl
| Download URL | iflow_mcp_eversinc33_triagemcp-0.1.0-py3-none-any.whl |
|---|---|
| Size | 6.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
fb92f6dfb9a9b1992035c59ee29dbe2c15a7f519647ff71cdfa56a2bfcbf5bae
|
|
BLAKE2b-256 checksum How to use checksums |
d750168b44133516b168b3b0000c115ca4a640a580424563c53a424ec337482c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.10.2 {"installer":{"name":"uv","version":"0.10.2","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Debian GNU/Linux","version":"13","id":"trixie","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
|
