malwarebazaar 5 tools

MCP server exposing 5 tools for malwarebazaar.

Endpoint

This URL is a JSON-RPC 2.0 endpoint over HTTP. Issue POST requests with a JSON-RPC body. Browsers and search crawlers land here on GET.

POST https://gateway.pipeworx.io/malwarebazaar/mcp
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/list"}

Tools

• get_sample_info — Metadata for a malware sample by hash (md5/sha1/sha256). Returns file type, signature, file_name, first/last seen, tags, family, intel sources.
• search_tag — Look up malware samples in MalwareBazaar (the abuse.ch sample corpus) carrying a given tag, such as "emotet", "macro", "exe", or "ransomware". Returns the matching samples with sha256/md5 hashes, file type, file name, signature, family, first-seen date, and reporter, plus a match count. Answers which recently submitted malware samples carry a given tag.
• search_family — Look up malware samples in MalwareBazaar (the abuse.ch sample corpus) attributed to one malware family or signature name, for example "Cobalt Strike" or "AgentTesla". Returns the matching samples with sha256/md5 hashes, file type, file name, first and last seen dates, tags, and intel sources. Answers which samples of a named malware family have been submitted and how recently.
• search_signature — Find samples matching a YARA / threat-intel signature.
• recent_samples — Most recent samples in MalwareBazaar. Use the selector to pick a chunk size.

Full documentation

Code samples (curl / TypeScript / one-click client install), schemas, and the live playground are on the pack page:
https://pipeworx.io/packs/malwarebazaar/

About Pipeworx

Pipeworx is an open MCP gateway connecting AI agents to live data. pipeworx.io