JoeSandboxMCP

What is JoeSandboxMCP?

JoeSandboxMCP is a Model Context Protocol (MCP) server that integrates with Joe Sandbox Cloud to expose rich analysis and IOC extraction capabilities. It is built for use with MCP-compatible applications like Claude Desktop, Glama, or custom LLM agents.

How to use JoeSandboxMCP?

Clone the repository, install dependencies with uv, and configure the MCP server in your client's JSON settings. Set the environment variables JBXAPIKEY (your API key) and ACCEPTTAC (set to TRUE to accept the terms) in the server configuration. Then launch the server using the provided uv run main.py command.

Key features of JoeSandboxMCP

• Submit files, URLs, websites, or command lines for analysis
• Extract IOCs for dropped files, IPs, domains, and URLs
• Retrieve signature detections and behavioral evidence
• Visualize process trees with command lines and hierarchy
• Download unpacked PE files and PCAP network captures
• All results structured for clear LLM consumption

Use cases of JoeSandboxMCP

• Submit a suspicious file or URL for dynamic sandbox analysis
• Retrieve indicators of compromise for threat intelligence feeds
• Investigate behavioral signatures and process execution trees
• Download network packet captures for offline C2 analysis
• Search past submissions by hash, filename, or detection status

FAQ from JoeSandboxMCP

What environment variables are required?

You must set JBXAPIKEY to your Joe Sandbox Cloud API key and set ACCEPTTAC=TRUE to confirm you have read and accepted the Joe Security Terms and Conditions.

How do I install JoeSandboxMCP?

Clone the repo, run uv venv and uv pip install -e . in the project directory, then configure the MCP server with the command uv --directory /path/to/joesandboxMCP run main.py.

Can I submit both files and URLs?

Yes – the server supports submitting local files, remote URLs, websites, and command lines for dynamic analysis.

What kind of results does the server return?

All results are formatted for easy consumption by language models, including verdicts, scores, process trees, network indicators, signatures, and unpacked binaries.