@pipeworx/mcp-malwarebazaar 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pipeworx
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,59 @@
+# mcp-malwarebazaar
+
+MalwareBazaar MCP — abuse.ch malware sample database (free, key required)
+
+Part of [Pipeworx](https://pipeworx.io) — an MCP gateway connecting AI agents to 250+ live data sources.
+
+## Tools
+
+| Tool | Description |
+|------|-------------|
+| `search_tag` | Find samples tagged with a string (e.g., "emotet", "macro", "exe"). |
+| `search_family` | Find samples for a malware family name. |
+| `search_signature` | Find samples matching a YARA / threat-intel signature. |
+| `recent_samples` | Most recent samples in MalwareBazaar. Use the selector to pick a chunk size. |
+
+## Quick Start
+
+Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
+
+```json
+{
+  "mcpServers": {
+    "malwarebazaar": {
+      "url": "https://gateway.pipeworx.io/malwarebazaar/mcp"
+    }
+  }
+}
+```
+
+Or connect to the full Pipeworx gateway for access to all 250+ data sources:
+
+```json
+{
+  "mcpServers": {
+    "pipeworx": {
+      "url": "https://gateway.pipeworx.io/mcp"
+    }
+  }
+}
+```
+
+## Using with ask_pipeworx
+
+Instead of calling tools directly, you can ask questions in plain English:
+
+```
+ask_pipeworx({ question: "your question about Malwarebazaar data" })
+```
+
+The gateway picks the right tool and fills the arguments automatically.
+
+## More
+
+- [All tools and guides](https://github.com/pipeworx-io/examples)
+- [pipeworx.io](https://pipeworx.io)
+
+## License
+
+MIT

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@pipeworx/mcp-malwarebazaar",
+  "version": "0.1.0",
+  "description": "MalwareBazaar MCP — abuse.ch malware sample database (free, key required)",
+  "type": "module",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "keywords": ["mcp", "mcp-server", "model-context-protocol", "pipeworx", "malwarebazaar"],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pipeworx-io/mcp-malwarebazaar"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0"
+  }
+}

package/server.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.pipeworx-io/malwarebazaar",
+  "title": "Malwarebazaar",
+  "description": "MalwareBazaar MCP — abuse.ch malware sample database (free, key required)",
+  "version": "0.1.0",
+  "websiteUrl": "https://pipeworx.io/packs/malwarebazaar",
+  "repository": {
+    "url": "https://github.com/pipeworx-io/mcp-malwarebazaar",
+    "source": "github"
+  },
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://gateway.pipeworx.io/malwarebazaar/mcp"
+    }
+  ]
+}

package/src/index.ts

@@ -0,0 +1,185 @@
+interface McpToolDefinition {
+  name: string;
+  description: string;
+  inputSchema: {
+    type: 'object';
+    properties: Record<string, unknown>;
+    required?: string[];
+  };
+}
+
+interface McpToolExport {
+  tools: McpToolDefinition[];
+  callTool: (name: string, args: Record<string, unknown>) => Promise<unknown>;
+  meter?: { credits: number };
+  cost?: Record<string, unknown>;
+  provider?: string;
+}
+
+/**
+ * MalwareBazaar MCP — abuse.ch malware sample database (free, key required)
+ *
+ * Search by hash / family / tag / signature. Pairs with `virustotal` (per-
+ * sample verdict aggregation), `threatfox` (related IOCs), and `alienvault-otx`
+ * (campaign context).
+ *
+ * API: https://bazaar.abuse.ch/api/
+ * Auth: header `Auth-Key`. Free, shares the same key as ThreatFox at
+ *       auth.abuse.ch.
+ *
+ * Tools:
+ * - get_sample_info:  metadata for a specific sample by hash
+ * - search_tag:       samples tagged with X (e.g., "emotet", "ransomware")
+ * - search_family:    samples by malware family name
+ * - search_signature: samples matching a YARA/Rapid7 signature
+ * - recent_samples:   most recent N samples added to the corpus
+ */
+
+
+const ENDPOINT = 'https://mb-api.abuse.ch/api/v1/';
+
+const tools: McpToolExport['tools'] = [
+  {
+    name: 'get_sample_info',
+    description:
+      'Metadata for a malware sample by hash (md5/sha1/sha256). Returns file type, signature, file_name, first/last seen, tags, family, intel sources.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        hash: { type: 'string', description: 'md5 / sha1 / sha256' },
+      },
+      required: ['hash'],
+    },
+  },
+  {
+    name: 'search_tag',
+    description: 'Find samples tagged with a string (e.g., "emotet", "macro", "exe").',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        tag: { type: 'string', description: 'Tag string' },
+        limit: { type: 'number', description: 'Max results (default 100)' },
+      },
+      required: ['tag'],
+    },
+  },
+  {
+    name: 'search_family',
+    description: 'Find samples for a malware family name.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        family: { type: 'string', description: 'Family name (signature)' },
+        limit: { type: 'number', description: 'Max results (default 100)' },
+      },
+      required: ['family'],
+    },
+  },
+  {
+    name: 'search_signature',
+    description: 'Find samples matching a YARA / threat-intel signature.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        signature: { type: 'string', description: 'Signature name (e.g., "Cobalt Strike")' },
+        limit: { type: 'number', description: 'Max results (default 100)' },
+      },
+      required: ['signature'],
+    },
+  },
+  {
+    name: 'recent_samples',
+    description: 'Most recent samples in MalwareBazaar. Use the selector to pick a chunk size.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        selector: {
+          type: 'string',
+          description: '"time" (1h window) or "100" (last 100 samples). Default "100".',
+          enum: ['time', '100'],
+        },
+      },
+      required: [],
+    },
+  },
+];
+
+async function callTool(name: string, args: Record<string, unknown>): Promise<unknown> {
+  const apiKey = (args._apiKey as string | undefined)?.trim();
+  if (!apiKey) {
+    throw new Error(
+      'MalwareBazaar requires an API key. Contact the operator about platform credentials (PLATFORM_ABUSECH_KEY), or BYO via ?_apiKey=<key> after registering at https://auth.abuse.ch.',
+    );
+  }
+  switch (name) {
+    case 'get_sample_info':
+      return mbPost(apiKey, { query: 'get_info', hash: reqStr(args, 'hash', '"<sha256>"') });
+    case 'search_tag':
+      return mbPost(apiKey, {
+        query: 'get_taginfo',
+        tag: reqStr(args, 'tag', '"emotet"'),
+        limit: (args.limit as number) ?? 100,
+      });
+    case 'search_family':
+      return mbPost(apiKey, {
+        query: 'get_siginfo',
+        signature: reqStr(args, 'family', '"Cobalt Strike"'),
+        limit: (args.limit as number) ?? 100,
+      });
+    case 'search_signature':
+      return mbPost(apiKey, {
+        query: 'get_yara',
+        yara_rule: reqStr(args, 'signature', '"<yara_rule_name>"'),
+        limit: (args.limit as number) ?? 100,
+      });
+    case 'recent_samples':
+      return mbPost(apiKey, { query: 'get_recent', selector: (args.selector as string) ?? '100' });
+    default:
+      throw new Error(`Unknown tool: ${name}`);
+  }
+}
+
+function reqStr(args: Record<string, unknown>, key: string, example: string): string {
+  const v = args[key];
+  if (typeof v !== 'string' || !v.trim()) {
+    throw new Error(`Required argument "${key}" is missing or empty. Pass a string like ${example}.`);
+  }
+  return v;
+}
+
+async function mbPost(apiKey: string, body: Record<string, unknown>) {
+  const form = new URLSearchParams();
+  for (const [k, v] of Object.entries(body)) form.set(k, String(v));
+
+  const res = await fetch(ENDPOINT, {
+    method: 'POST',
+    headers: {
+      'Auth-Key': apiKey,
+      'Content-Type': 'application/x-www-form-urlencoded',
+      Accept: 'application/json',
+    },
+    body: form.toString(),
+  });
+  if (res.status === 401 || res.status === 403) throw new Error('MalwareBazaar: unauthorized — check the API key');
+  if (res.status === 429) throw new Error('MalwareBazaar: rate-limit (HTTP 429)');
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`MalwareBazaar error: ${res.status} ${text.slice(0, 200)}`);
+  }
+  const data = (await res.json()) as {
+    query_status?: string;
+    data?: unknown[];
+  };
+
+  if (data.query_status && data.query_status !== 'ok' && data.query_status !== 'no_results') {
+    throw new Error(`MalwareBazaar: ${data.query_status}`);
+  }
+  return {
+    query: body.query,
+    status: data.query_status ?? null,
+    count: Array.isArray(data.data) ? data.data.length : 0,
+    samples: Array.isArray(data.data) ? data.data : [],
+  };
+}
+
+export default { tools, callTool, meter: { credits: 1 } } satisfies McpToolExport;

package/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "declaration": true
+  },
+  "include": ["src"]
+}