@antiylabs/iep-scan-mcp 0.1.1

package/bin/SEngine.dat

@@ -0,0 +1,27 @@
+[File]
+avlsdk = _BASEPATH_\avl\AVLSDK.so
+TranserSdk = _BASEPATH_\avl\aid2name.so
+ScanMode = _BASEPATH_\avl\Config\high_scan.ct
+ScanModeDs = _BASEPATH_\avl\Config\avl.conf
+FmtAndDs = _BASEPATH_\avl\Config\identify.ct
+Afd = _BASEPATH_\avl\Config\afd.ct
+
+[Path]
+DataBase = _BASEPATH_\avl\Data
+NameBase = _BASEPATH_\avl\NData
+Module = _BASEPATH_\avl\Module
+Tmp = _BASEPATH_\avl\Tmp
+Log = _BASEPATH_\avl\Log\
+
+[Scan]
+LogEnable = 1
+VCSEnable = 0
+ASDroidEnable =0
+ASScriptEnable =0
+ASEXPLOITEnable = 1
+DsEnable = 1
+MaxSize=524288000
+ApackRecureLayer = 6
+Duplicate = 1
+AllMod=0
+White=0

package/bin/VEngine.dat

@@ -0,0 +1,6 @@
+[url_split]
+value=0
+[domain_split]
+value=0
+[outtype]
+value=1

package/bin/VFilter_Engine.rule

@@ -0,0 +1 @@
+null

package/bin/YaraRule/AVLYR000.IDX

@@ -0,0 +1 @@
+njwhus'%wb%

package/bin/YaraRule/AVLYR001.IDX

@@ -0,0 +1 @@
+njwhus'%wb%

package/bin/avl/Data/AVLSP001.DAT

@@ -0,0 +1 @@
+AVL3���4d�_阰�J~z�Bц4�$Pʠ��ՌDH�LM����=���$�F�p9u1MIm2�TV#4.���9u1MIm2�TV#4.���9u1MIm2�TV#4.���9u1MIm2�TV#4.���9u1MIm2�TV#4.���9u1MIm2�TV#4.���9u1MIm2�TV#4.���9u1MIm2�TV#4.���9u1MIm2�TV#4.���9u1MIm2�TV#4.���9u1MIm2�TV#4.���9u1MIm2�TV#4.���c�ĵ�U�4B�%�>�&�Uv+�܉	��ȈPcu��1����0� v&GW?�V�P6y�+��P1�aU��=�Y����!�Σ��􂞎9u1MIm2�TV#4.��ʬ�CL�l��ng۴�-���52�#<D�5$�+

package/bin/business_plugins/RpcX3.ini

@@ -0,0 +1,20 @@
+[RpcFilter]
+Edr=RpcScan.exe
+Scan=ATScan.exe
+AntiyScan=AntiyScan.exe
+[BufferFilter]
+value1="fmtfilter"
+value2="cat"
+value3="pathcache"
+value4="white"
+value5="customcache"
+value6="cloud"
+value7="yara"
+[LibBase]
+value=".."
+[flushmem]
+value=0
+[VEngine]
+value=0
+[cacheavl]
+value=0

package/bin/cfg/cloudip.ini

@@ -0,0 +1,10 @@
+[Server]
+Address=10.254.16.59:80/cloud3
+Address2=apc.antiy.net.cn/V4/cloud2
+Pid=IEP_MCP_AV
+Key=Antiy_IEP_MCP
+Ver=3.5
+Type=antiy
+[CloudSize]
+Value=50
+

package/bin/cloudip.ini

@@ -0,0 +1,18 @@
+[Server]
+;Address=10.254.176.89/cloud3
+Address=127.0.0.1:80/cloud3
+;Address2=apc.antiy.net.cn/v4/cloud2
+Address2=139.159.193.73:34580/cloud2
+Uuid=693572AF04D0F77865C286F8448CA492
+Ver=3.5
+Type=antiy
+[link]
+Private=1
+[Lk]
+Address=10.255.49.18/api/cloud2
+Uuid=0D1466EDEA154F5F85AD379B9BEC81C1
+Ver=3.5
+[Swtich]
+ACloud=1
+
+

package/bin/iep-scan-mcp.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+"use strict";
+
+// iep-scan-mcp —— stdio 传输的 MCP 启动器。
+//
+// 职责很小：定位随包分发的 AntiyIepScanMcp 可执行文件，把 stdio 原样交给它。
+// 必须用 stdio: "inherit"：MCP 的 JSON-RPC 帧走真实 fd 0/1，
+// 若在此处 pipe 再转发，就要自己承担缓冲、背压和分帧的 bug。
+//
+// 本文件是**源文件**，由打包脚本复制进 bin/。不要直接编辑 bin/ 下的副本。
+//
+// 传给子进程的环境变量：
+//   IEPSCAN_DATA_DIR —— 可写的数据目录（引擎、病毒库、日志），默认用户配置目录
+
+const path = require("path");
+const os = require("os");
+const fs = require("fs");
+const { spawn } = require("child_process");
+
+const BIN_DIR = __dirname;
+const EXE = path.join(BIN_DIR, "AntiyIepScanMcp.exe");
+
+function fail(message) {
+  process.stderr.write(`iep-scan-mcp: ${message}\n`);
+  process.exit(1);
+}
+
+// 明确不支持非 Windows 平台，而不是抛一个看不懂的 spawn 错误。
+if (process.platform !== "win32") {
+  fail(
+    `扫描引擎当前仅提供 Windows 版本，本机为 ${process.platform}/${process.arch}。` +
+      `详见 README 的平台支持说明。`
+  );
+}
+if (process.arch !== "x64") {
+  fail(`扫描引擎当前仅提供 x64 版本，本机架构为 ${process.arch}。`);
+}
+if (!fs.existsSync(EXE)) {
+  fail(`未找到可执行文件 ${EXE}。安装可能不完整，请重新安装本包。`);
+}
+
+// 数据目录：优先沿用调用方显式设置的值，否则落到用户配置目录。
+const env = Object.assign({}, process.env);
+if (!env.IEPSCAN_DATA_DIR) {
+  const base =
+    process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+  env.IEPSCAN_DATA_DIR = path.join(base, "AntiyIepScanMcp");
+}
+
+const child = spawn(EXE, ["mcp-stdio", ...process.argv.slice(2)], {
+  stdio: "inherit",
+  env,
+  windowsHide: true,
+});
+
+// 转发终止信号，避免父进程先退导致子进程成为孤儿。
+for (const sig of ["SIGINT", "SIGTERM"]) {
+  process.on(sig, () => {
+    if (!child.killed) child.kill(sig);
+  });
+}
+
+child.on("error", (err) => fail(`启动失败: ${err.message}`));
+child.on("exit", (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+    return;
+  }
+  process.exit(code === null ? 1 : code);
+});

package/bin/libComm4UI.ini

@@ -0,0 +1,8 @@
+[baseinfo]
+installtime=1699840799
+[RegInfo]
+DepName=aa
+EmpName=act
+SecLvl=1
+RegTime=1700210966
+DepID=62f1

package/bin/quarantine.ini

@@ -0,0 +1,3 @@
+ [Setting]
+ Quota=256
+ Path=AEDRRECYCLE

package/bin/usercfg/VSBaseStrategy.cfg

@@ -0,0 +1,21 @@
+[qtnfqsWNqcPzr+fesdqWzviCs/TkjhuavtmRqq??]
+udntqsiNrcP3r+zex9r9zq??=wtndqtiNr8Plr6Xea9rmzqaCf/Sljdiabdmdqw6NbMOor7HegdrzzquCe/SwjcWau9n1qs+NqMP2r6zeltq?
+rNnwqsCNqMP3r9ve=atmRqq??
+[qtncqsqNw8Prr/ze29qazvOCsvTqjgqamtm?]
+udntqsiNrcP3r+zex9r9zq??=wtndqtiNr8Ocr7Dea9qvzv6Cv/TajgqaqNmzqs2Nr8P1r7HetdqnzuuCtPT2jcSaxNnsqtiNgcP1r/Hea9qvzquCcvTgjgKax9ncqsiNbcOSr6??
+rNnwqsCNqMP3r9ve=admRqq??
+rdnhqsCNwsPzr/fe29qgzvWCrPThjgKavdmRqq??=admRqq??
+rdnhqsCNwsPzr/fe29qczvuCq/Txjguaq9nequyN=wtndqtiNr8Plr6Xea9rmzvaCrvTwjcSaudnzqtiNxMPbr/zeqtqmzuqCq/Sljgmax9n0qxKNa8Omr6zea9qvzqaCcvTdjg+axtnsqr+NqMPir//eq9qczvuCj/S?
+[sNn4qtyN0sPlr/zetdqnzwSCs/Tejh+avdnfquyN]
+rNnwqsCNqMP3r9ve=admhquyN
+[q9nuqs2NwcPBr/Les9qnzvSCvfTajfWavNn4qsCNuMPBr+zerdqzzvqCj/S?]
+rNnwqsCNqMP3r9ve=bdmhqxyNn8O?
+[u9nwqsuNx8P3r9ve]
+xdnwqtSN0sPlr/LevNqgzteC=aNmbqxyNbMOpr6begtr1zq+Cj/S?
+[uNnoqtyNvMPlr+zeltq?]
+qNn4qtuNxsPbrADex9qmzv2Cu/TsjgeaqNnsquyN=admRqq??
+v9nfqs2NtMPpr/rexNqgzteC=atmRqq??
+[udn4qr+NuMPwr/jerdqnzvqCj/S?]
+xtnsqtaNuMPur9ve=aNmRqq??
+[u9n1qs+NqMP2r9ve]
+rNnwqsCNqMP3r9ve=admRqq??

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@antiylabs/iep-scan-mcp",
+  "version": "0.1.1",
+  "description": "安天 IEP 病毒检测 MCP 服务（stdio）。让 AI 客户端直接调用 scan_file / scan_hash 做文件查毒与哈希黑白查询。引擎与病毒库随包分发，扫描时引擎会走云查。",
+  "license": "UNLICENSED",
+  "bin": {
+    "iep-scan-mcp": "bin/iep-scan-mcp.js"
+  },
+  "os": [
+    "win32"
+  ],
+  "cpu": [
+    "x64"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "bin/",
+    "README.md"
+  ],
+  "keywords": [
+    "mcp",
+    "modelcontextprotocol",
+    "antiy",
+    "antivirus",
+    "security",
+    "virus-scan"
+  ]
+}