JoeSandboxMCP

Name: JoeSandboxMCP
Author: joesecurity

@joesecurity

Repository

About JoeSandboxMCP

A Model Context Protocol (MCP) server for interacting with Joe Sandbox Cloud.

#malware-analysis #threatintel #joe-sandbox #phishing

Basic information

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "JoeSandbox": {
      "command": "uv",
      "args": [
        "--directory",
        "/absolute/path/to/joesandboxMCP",
        "run",
        "main.py"
      ],
      "env": {
        "JBXAPIKEY": "your-jbxcloud-apikey",
        "ACCEPTTAC": "SET_TRUE_IF_YOU_ACCEPT"
      }
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is JoeSandboxMCP?

JoeSandboxMCP is a Model Context Protocol (MCP) server that integrates with Joe Sandbox Cloud to expose rich analysis and IOC extraction capabilities. It is built for use with MCP-compatible applications like Claude Desktop, Glama, or custom LLM agents.

How to use JoeSandboxMCP?

Clone the repository, install dependencies with uv, and configure the MCP server in your client's JSON settings. Set the environment variables JBXAPIKEY (your API key) and ACCEPTTAC (set to TRUE to accept the terms) in the server configuration. Then launch the server using the provided uv run main.py command.

Key features of JoeSandboxMCP

Submit files, URLs, websites, or command lines for analysis
Extract IOCs for dropped files, IPs, domains, and URLs
Retrieve signature detections and behavioral evidence
Visualize process trees with command lines and hierarchy
Download unpacked PE files and PCAP network captures
All results structured for clear LLM consumption

Use cases of JoeSandboxMCP

Submit a suspicious file or URL for dynamic sandbox analysis
Retrieve indicators of compromise for threat intelligence feeds
Investigate behavioral signatures and process execution trees
Download network packet captures for offline C2 analysis
Search past submissions by hash, filename, or detection status

FAQ from JoeSandboxMCP

What environment variables are required?

You must set JBXAPIKEY to your Joe Sandbox Cloud API key and set ACCEPTTAC=TRUE to confirm you have read and accepted the Joe Security Terms and Conditions.

How do I install JoeSandboxMCP?

Clone the repo, run uv venv and uv pip install -e . in the project directory, then configure the MCP server with the command uv --directory /path/to/joesandboxMCP run main.py.

Can I submit both files and URLs?

Yes – the server supports submitting local files, remote URLs, websites, and command lines for dynamic analysis.

What kind of results does the server return?

All results are formatted for easy consumption by language models, including verdicts, scores, process trees, network indicators, signatures, and unpacked binaries.