MalwareTracker Document Malware & AI Safety Scanner

com.malwaretracker/mcpVersion 2.3.0

Scan PDFs, Office docs, and RAG files for malware exploits, macros, CVEs, and AI prompt injection.

Status

Responds433 msNov 14, 2026, 14:05 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:05 UTC
Latency: 433 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 21:12 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://api.malwaretracker.com/mcpResponds433 msNov 14, 2026, 14:05 UTC

No sign-in

Claude Code

claude mcp add --transport http malwaretracker https://api.malwaretracker.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: malwaretracker
Remote MCP server URL: https://api.malwaretracker.com/mcp

Cursor

{
  "mcpServers": {
    "malwaretracker": {
      "url": "https://api.malwaretracker.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"malwaretracker","type":"http","url":"https://api.malwaretracker.com/mcp"}'

Streamable HTTP

pypi: malwaretracker-mcp 2.3.0

Package only

PyPI (uvx)

claude mcp add malwaretracker -- uvx malwaretracker-mcp==2.3.0

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

5 tools

Tools of MalwareTracker Document Malware & AI Safety Scanner
	Description		Read-only	Idempotent	Open world
`malwaretracker_get_quota`Check current MalwareTracker API plan, monthly scan usage, and remaining quota.	Check current MalwareTracker API plan, monthly scan usage, and remaining quota.	No	Yes	Yes	No
`malwaretracker_list_yara_catalog`List or filter MalwareTracker's QuickSand YARA signature catalog, covered CVEs, MITRE ATT&CK techniques, and AI/RAG prompt-injection detection rules. Requires no API key.	List or filter MalwareTracker's QuickSand YARA signature catalog, covered CVEs, MITRE ATT&CK techniques, and AI/RAG prompt-injection detection rules. Requires no API key.	No	Yes	Yes	No
`malwaretracker_lookup_hash`Look up a previously analyzed document malware & stream report by MD5, SHA1, SHA256, or SHA512 hash. Does not consume monthly scan quota.	Look up a previously analyzed document malware & stream report by MD5, SHA1, SHA256, or SHA512 hash. Does not consume monthly scan quota.	No	Yes	Yes	No
`quicksand_scan_document`Scan a PDF, Office document (DOC/DOCX/XLS/XLSX/PPT/PPTX/RTF/OneNote), email, archive, URL, or extracted text in under 100ms for embedded malware exploits, macros, CVEs, and hidden AI/RAG prompt-injection payloads (3 Tr invisible PDF text, zero-point fonts, hidden OOXML vanish runs, spoofed tool-call tags, and markdown exfiltration beacons) with zero file retention. IMPORTANT: Pass 'text_content' (raw/extracted text, Markdown, or HTML), 'content_base64' (base64 file bytes or data URI), or 'url' (public https:// link). Do not pass container-local '/mnt/user-data' file paths directly.	Scan a PDF, Office document (DOC/DOCX/XLS/XLSX/PPT/PPTX/RTF/OneNote), email, archive, URL, or extracted text in under 100ms for embedded malware exploits, macros, CVEs, and hidden AI/RAG prompt-injection payloads (3 Tr invisible PDF text, zero-point fonts, hidden OOXML vanish runs, spoofed tool-call tags, and markdown exfiltration beacons) with zero file retention. IMPORTANT: Pass 'text_content' (raw/extracted text, Markdown, or HTML), 'content_base64' (base64 file bytes or data URI), or 'url' (public https:// link). Do not pass container-local '/mnt/user-data' file paths directly.	No	Yes	Yes	No
`quicksand_triage_document`Fast Tier-0 SOAR phishing & attachment triage. Evaluates a document in milliseconds and returns verdict ('clean' \| 'suspicious' \| 'malicious'), recommended_action ('allow' \| 'detonate_in_sandbox' \| 'quarantine_and_detonate'), escalate_to_sandbox, matched CVEs, MITRE ATT&CK techniques, and AI prompt-injection findings. Pass 'text_content', 'content_base64', or 'url' (https://).	Fast Tier-0 SOAR phishing & attachment triage. Evaluates a document in milliseconds and returns verdict ('clean' \| 'suspicious' \| 'malicious'), recommended_action ('allow' \| 'detonate_in_sandbox' \| 'quarantine_and_detonate'), escalate_to_sandbox, matched CVEs, MITRE ATT&CK techniques, and AI prompt-injection findings. Pass 'text_content', 'content_base64', or 'url' (https://).	No	Yes	Yes	No

Details

Registry status: Active
Published: Nov 12, 2026
Updated: Nov 12, 2026
Website: https://malwaretracker.com/api.html#mcp⁠ (opens in a new tab)
Repository: https://github.com/tylabs/malwaretracker-mcp⁠ (opens in a new tab)
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing