This connects Claude to abuse.ch's MalwareBazaar, a public repository of malware samples used by security researchers. You get four tools: search by tag, family name, or YARA signature, plus a feed of recent submissions. It's free but needs an API key. Use it when you're triaging threats, hunting for specific malware variants, or pulling sample metadata without leaving your IDE. Routes through Pipeworx's gateway, which means you can either call tools directly or use ask_pipeworx to query in plain English. Part of a larger collection of 673+ data sources if you connect to the full gateway.
MalwareBazaar MCP — abuse.ch malware sample database (free, key required)
Part of Pipeworx — an MCP gateway connecting AI agents to 673+ live data sources.
| Tool | Description |
|---|---|
search_tag | Find samples tagged with a string (e.g., "emotet", "macro", "exe"). |
search_family | Find samples for a malware family name. |
search_signature | Find samples matching a YARA / threat-intel signature. |
recent_samples | Most recent samples in MalwareBazaar. Use the selector to pick a chunk size. |
Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
{
"mcpServers": {
"malwarebazaar": {
"url": "https://gateway.pipeworx.io/malwarebazaar/mcp"
}
}
}
Or connect to the full Pipeworx gateway for access to all 673+ data sources:
{
"mcpServers": {
"pipeworx": {
"url": "https://gateway.pipeworx.io/mcp"
}
}
}
Instead of calling tools directly, you can ask questions in plain English:
ask_pipeworx({ question: "your question about Malwarebazaar data" })
The gateway picks the right tool and fills the arguments automatically.
MIT
hovecapital/read-only-local-postgres-mcp-server
cocaxcode/database-mcp
io.github.infoinlet-marketplace/mcp-mysql
io.github.cybeleri/database-admin
io.github.yash-0620/postgres-mcp-secured