Skip to content

Malwagon

by malwagon.com · remote · no sign-in to list tools · v1.1.0 · published by com.malwagon

Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.

Changes · 2
CompareRegistry entry

5 tools: 2 change things and 3 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http malwagon https://malwagon.com/mcp --header 'Authorization: <your-authorization>'

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

5 tools

Changes things 2Claude Code: ask
  • poll_scanThe current status of one scan, for polling after submit_scan.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The current status of one scan, for polling after submit_scan. Cheap enough to call in a loop. 'terminal' means the scan will not change again; 'report_available' means get_report will return a full report. Answers 'not found' for an unknown scan and an unreadable one identically.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • submit_scanQueue a new analysis of a target that can be named as text: a SHA-256 to look up, a URL to visit, a command to run, or a package to install.No findings

    Why it is in this group

    • The name "submit_scan" says "submit": a word for a change.
    Description, as the server wrote it
    Queue a new analysis of a target that can be named as text: a SHA-256 to look up, a URL to visit, a command to run, or a package to install. Uploading a file or a document is not possible over MCP. This spends the account's own credits and is subject to its plan limits. Poll the returned scan_id with poll_scan, then read it with get_report.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 3Claude Code: allow
  • get_reportThe derived analysis report for one scan: verdict, capabilities, behaviour summary, observed operations and defanged indicators.No findings

    Why it is in this group

    • The name "get_report" says "get": a word for reading.
    Description, as the server wrote it
    The derived analysis report for one scan: verdict, capabilities, behaviour summary, observed operations and defanged indicators. Derived data only - it never contains the sample's bytes, its decompiled source, a download link or an artifact reference. Every list in the result reports what was returned, counted and truncated. Answers 'not found' for a scan that does not exist and for one this token may not read, identically.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • lookup_hashFind analyses of a known SHA-256 digest.No findings

    Why it is in this group

    • The name "lookup_hash" says "lookup": a word for reading.
    Description, as the server wrote it
    Find analyses of a known SHA-256 digest. Returns the caller's own scans of those bytes plus any publicly shared scan of them. Sends nothing anywhere: this searches scans that already exist on this platform. Answers with an empty list when the hash is unknown or not visible to this token, without distinguishing the two.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • search_indicatorFind scans where an indicator was observed: an IP, a domain, a URL, a mutex, a registry key, a hash or a JA3/JA4 fingerprint.No findings

    Why it is in this group

    • The name "search_indicator" says "search": a word for reading.
    Description, as the server wrote it
    Find scans where an indicator was observed: an IP, a domain, a URL, a mutex, a registry key, a hash or a JA3/JA4 fingerprint. The indicator is matched exactly; defanged input such as 'evil[.]com' is refanged first. Only scans this token may read are searched.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http malwagon https://malwagon.com/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__malwagon__lookup_hash",
      "mcp__malwagon__get_report",
      "mcp__malwagon__search_indicator"
    ],
    "ask": [
      "mcp__malwagon__poll_scan",
      "mcp__malwagon__submit_scan"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as malwagon. Review it before you use it.