MalwareTracker & QuickSand MCP Server (malwaretracker-mcp)

Official Model Context Protocol (MCP) server for MalwareTracker.com and QuickSand.

Inspect untrusted PDFs, Microsoft Office documents (DOC, DOCX, XLS, XLSX, PPT, PPTX, RTF, OneNote), emails (EML, MSG), and RAG ingestion inputs in <100ms for:

• Weaponized Document Exploits & Macros — 239+ YARA signatures covering 67+ Office/PDF CVEs, OLE2/OOXML stream unpacking, VBA stomping, XLM macros, and encrypted VelvetSweatshop payloads.
• Hidden AI / RAG Prompt Injection — Invisible PDF rendering (3 Tr), zero-point font overrides, <w:vanish/> hidden OOXML instructions, spoofed <tool_call> tags, and Markdown data-exfiltration beacons.
• Zero-Retention Compliance — In-memory scanning (?store=false) for SOC 2, HIPAA, and ISO 27001 workflows.

Get a free API key (100 scans/month) at https://api.malwaretracker.com/portal.

Quickstart

Option A: Local stdio via uvx (Recommended for scanning local files)

Add to claude_desktop_config.json, .cursor/mcp.json, or Windsurf / VS Code MCP settings:

{
  "mcpServers": {
    "malwaretracker": {
      "command": "uvx",
      "args": ["malwaretracker-mcp"],
      "env": {
        "MALWARETRACKER_API_KEY": "mt_live_YOUR_API_KEY"
      }
    }
  }
}

Or install with pip:

pip install malwaretracker-mcp

Or add directly in Claude Code:

claude mcp add malwaretracker -e MALWARETRACKER_API_KEY=mt_live_YOUR_API_KEY -- uvx malwaretracker-mcp

Option B: Hosted Remote Streamable HTTP (Zero local install)

Connect any Streamable HTTP MCP client directly to https://api.malwaretracker.com/mcp:

{
  "mcpServers": {
    "malwaretracker-remote": {
      "type": "streamable-http",
      "url": "https://api.malwaretracker.com/mcp",
      "headers": {
        "Authorization": "Bearer mt_live_YOUR_API_KEY"
      }
    }
  }
}

Available MCP Tools

Built-in MCP Prompt

• audit_untrusted_document(file_path) — Enforces a pre-ingestion security audit before an AI agent reads or summarizes an untrusted document.

LangChain / LlamaIndex Python Guardrail

malwaretracker-mcp also bundles SafeQuickSandDocumentGuard for Python RAG pipelines:

from malwaretracker_mcp import SafeQuickSandDocumentGuard

guard = SafeQuickSandDocumentGuard(api_key="mt_live_YOUR_API_KEY")
verdict = guard.verify_file("candidate_resume.pdf")
# Raises PermissionError in <100ms if an exploit or hidden prompt injection is detected!

Links

• Website & Interactive Scanner: https://malwaretracker.com
• Developer Portal & Free API Key: https://api.malwaretracker.com/portal
• API Reference: https://malwaretracker.com/api.html
• License: MIT