MCP server

Malwarebazaar

io.github.pipeworx-io/malwarebazaar

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

MalwareBazaar MCP — abuse.ch malware sample database (free, key required)

Working at last checkOfficial: pipeworx.io's GitHub account (pipeworx-io)About 27,031 tokens per request once connected47 tools

https://gateway.pipeworx.io/malwarebazaar/mcp

At a glance

Type: MCP server
Publisher: pipeworx.io (verified by the MCP Registry)
Status: Working at last check
Tools: 47
Token cost: About 27,031 tokens per request
Sets up in: Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok
Last checked: 26 Oct 2026, 08:29 UTC

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http malwarebazaar https://gateway.pipeworx.io/malwarebazaar/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.malwarebazaar]
url = "https://gateway.pipeworx.io/malwarebazaar/mcp"

Gemini CLI

{"mcpServers":{"malwarebazaar":{"httpUrl":"https://gateway.pipeworx.io/malwarebazaar/mcp"}}}

Cursor

{"mcpServers":{"malwarebazaar":{"url":"https://gateway.pipeworx.io/malwarebazaar/mcp"}}}

VS Code

{"servers":{"malwarebazaar":{"type":"http","url":"https://gateway.pipeworx.io/malwarebazaar/mcp"}}}

Antigravity

agy mcp add malwarebazaar https://gateway.pipeworx.io/malwarebazaar/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"malwarebazaar","server_url":"https://gateway.pipeworx.io/malwarebazaar/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"malwarebazaar","server_url":"https://gateway.pipeworx.io/malwarebazaar/mcp"}

get_sample_info ~122 tokens
Metadata for a malware sample by hash (md5/sha1/sha256). Returns file type, signature, file_name, first/last seen, tags, family, intel sources.
recent_samples ~106 tokens
Most recent samples in MalwareBazaar. Use the selector to pick a chunk size.
search_family ~200 tokens
Look up malware samples in MalwareBazaar (the abuse.ch sample corpus) attributed to one malware family or signature name, for example "Cobalt Strike" or "AgentTesla". Returns the matching samples with sha256/md5 hashes, file type, file name, first and last seen dates, tags, and intel sources. Answer
search_signature ~116 tokens
Find samples matching a YARA / threat-intel signature.
search_tag ~184 tokens
Look up malware samples in MalwareBazaar (the abuse.ch sample corpus) carrying a given tag, such as "emotet", "macro", "exe", or "ransomware". Returns the matching samples with sha256/md5 hashes, file type, file name, signature, family, first-seen date, and reporter, plus a match count. Answers whic

Threatfox
ThreatFox MCP — abuse.ch indicator-of-compromise feed (free, key required)
SiteCheck Web Intel
129 pay-per-call agent tools: security, threat intelligence, web search and SEO data tools. x402
Urlhaus
URLhaus MCP — wraps abuse.ch URLhaus malware URL database (free, no auth)
Presend MCP Server
Before an AI agent installs an npm/PyPI package: typosquat, vulnerability and existence checks.
ContrastAPI
55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
Web & domain tools
Read any public page as markdown, link previews, URL safety, page audits, domain availability and…
how.is domain & IP intelligence
Pay-per-call DNS, WHOIS, domain age, TLS, email auth, blocklists, IP intel. Free samples.
Feodotracker
Feodo Tracker MCP — botnet C&C IP blocklist from abuse.ch.

[![AptLynx](https://aptlynx.net/badge/io.github.pipeworx-io/malwarebazaar.svg)](https://aptlynx.net/servers/io.github.pipeworx-io/malwarebazaar)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents