JoeSandboxMCP

Name: JoeSandboxMCP
Author: joesecurity

@joesecurity

リポジトリ

JoeSandboxMCP について

A Model Context Protocol (MCP) server for interacting with Joe Sandbox Cloud.

#malware-analysis #threatintel #joe-sandbox #phishing

基本情報

カテゴリ

その他

トランスポート

stdio

公開者

joesecurity

投稿者

Matthias Vogler

設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "JoeSandbox": {
      "command": "uv",
      "args": [
        "--directory",
        "/absolute/path/to/joesandboxMCP",
        "run",
        "main.py"
      ],
      "env": {
        "JBXAPIKEY": "your-jbxcloud-apikey",
        "ACCEPTTAC": "SET_TRUE_IF_YOU_ACCEPT"
      }
    }
  }
}

ツール

ツールは検出されませんでした

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is JoeSandboxMCP?

JoeSandboxMCP is a Model Context Protocol (MCP) server that integrates with Joe Sandbox Cloud to expose rich analysis and IOC extraction capabilities. It is built for use with MCP-compatible applications like Claude Desktop, Glama, or custom LLM agents.

How to use JoeSandboxMCP?

Clone the repository, install dependencies with uv, and configure the MCP server in your client's JSON settings. Set the environment variables JBXAPIKEY (your API key) and ACCEPTTAC (set to TRUE to accept the terms) in the server configuration. Then launch the server using the provided uv run main.py command.

Key features of JoeSandboxMCP

Submit files, URLs, websites, or command lines for analysis
Extract IOCs for dropped files, IPs, domains, and URLs
Retrieve signature detections and behavioral evidence
Visualize process trees with command lines and hierarchy
Download unpacked PE files and PCAP network captures
All results structured for clear LLM consumption

Use cases of JoeSandboxMCP

Submit a suspicious file or URL for dynamic sandbox analysis
Retrieve indicators of compromise for threat intelligence feeds
Investigate behavioral signatures and process execution trees
Download network packet captures for offline C2 analysis
Search past submissions by hash, filename, or detection status

FAQ from JoeSandboxMCP

What environment variables are required?

You must set JBXAPIKEY to your Joe Sandbox Cloud API key and set ACCEPTTAC=TRUE to confirm you have read and accepted the Joe Security Terms and Conditions.

How do I install JoeSandboxMCP?

Clone the repo, run uv venv and uv pip install -e . in the project directory, then configure the MCP server with the command uv --directory /path/to/joesandboxMCP run main.py.

Can I submit both files and URLs?

Yes – the server supports submitting local files, remote URLs, websites, and command lines for dynamic analysis.

What kind of results does the server return?

All results are formatted for easy consumption by language models, including verdicts, scores, process trees, network indicators, signatures, and unpacked binaries.