MalwareTracker & QuickSand MCP Server (malwaretracker-mcp)

Official Model Context Protocol (MCP) server for MalwareTracker.com and QuickSand.

Inspect untrusted PDFs, Microsoft Office documents (DOC, DOCX, XLS, XLSX, PPT, PPTX, RTF, OneNote), emails (EML, MSG), and RAG ingestion inputs in <100ms for:

• Weaponized Document Exploits & Macros — 239+ YARA signatures covering 67+ Office/PDF CVEs, OLE2/OOXML stream unpacking, VBA stomping, XLM macros, and encrypted VelvetSweatshop payloads.
• Hidden AI / RAG Prompt Injection — Invisible PDF rendering (3 Tr), zero-point font overrides, <w:vanish/> hidden OOXML instructions, spoofed <tool_call> tags, and Markdown data-exfiltration beacons.
• Zero-Retention Compliance — In-memory scanning (?store=false) for SOC 2, HIPAA, and ISO 27001 workflows.

Get a free API key (100 scans/month) at https://api.malwaretracker.com/portal.

---

Quickstart

Option A: Local stdio via uvx (Recommended for scanning local files)

Add to claude_desktop_config.json, .cursor/mcp.json, or Windsurf / VS Code MCP settings:

{
  "mcpServers": {
    "malwaretracker": {
      "command": "uvx",
      "args": ["malwaretracker-mcp"],
      "env": {
        "MALWARETRACKER_API_KEY": "mt_live_YOUR_API_KEY"
      }
    }
  }
}

Or install with pip:

pip install malwaretracker-mcp

Or add directly in Claude Code:

claude mcp add malwaretracker -e MALWARETRACKER_API_KEY=mt_live_YOUR_API_KEY -- uvx malwaretracker-mcp

Option B: Hosted Remote Streamable HTTP (Zero local install)

Connect any Streamable HTTP MCP client directly to https://api.malwaretracker.com/mcp:

{
  "mcpServers": {
    "malwaretracker-remote": {
      "type": "streamable-http",
      "url": "https://api.malwaretracker.com/mcp",
      "headers": {
        "Authorization": "Bearer mt_live_YOUR_API_KEY"
      }
    }
  }
}

---

Available MCP Tools

Tool	Description	Quota Cost
quicksand_scan_document	Scan a local file_path, content_base64, or text_content in <100ms for document malware, CVEs, and AI prompt injection (store=false zero-retention).	1 scan
quicksand_triage_document	Fast Tier-0 SOAR phishing triage returning allow, detonate_in_sandbox, or quarantine_and_detonate plus CVE/MITRE/AI-safety verdicts.	1 scan
malwaretracker_lookup_hash	Look up cached threat intelligence & stream analysis reports by MD5, SHA1, SHA256, or SHA512.	Free
malwaretracker_list_yara_catalog	Search MalwareTracker's YARA signature catalog, CVEs, MITRE ATT&CK IDs, and AI prompt-injection rules.	Free (no key needed)
malwaretracker_get_quota	Check active MalwareTracker plan, monthly usage, and remaining scan quota.	Free

Built-in MCP Prompt

• audit_untrusted_document(file_path) — Enforces a pre-ingestion security audit before an AI agent reads or summarizes an untrusted document.

---

LangChain / LlamaIndex Python Guardrail

malwaretracker-mcp also bundles SafeQuickSandDocumentGuard for Python RAG pipelines:

from malwaretracker_mcp import SafeQuickSandDocumentGuard

guard = SafeQuickSandDocumentGuard(api_key="mt_live_YOUR_API_KEY")
verdict = guard.verify_file("candidate_resume.pdf")
# Raises PermissionError in <100ms if an exploit or hidden prompt injection is detected!

---

Links

• Website & Interactive Scanner: https://malwaretracker.com
• Developer Portal & Free API Key: https://api.malwaretracker.com/portal
• API Reference: https://malwaretracker.com/api.html
• License: MIT