MalwareTracker Document Malware & AI Safety Scanner

Working Security A

com.malwaretracker/mcpv2.3.0 Domain verified

Scan PDFs, Office docs, and RAG files for malware exploits, macros, CVEs, and AI prompt injection.

Security

Watch Source Website

Registry entry

Open in the registry

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-11-12T21:35:47.597622Z",
      "publishedAt": "2026-11-12T21:35:47.597622Z",
      "statusChangedAt": "2026-11-12T21:35:47.597622Z"
    }
  },
  "server": {
    "name": "com.malwaretracker/mcp",
    "icons": [
      {
        "src": "https://malwaretracker.com/assets/images/android-chrome-512x512.png",
        "sizes": [
          "512x512"
        ],
        "mimeType": "image/png"
      }
    ],
    "title": "MalwareTracker Document Malware & AI Safety Scanner",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "remotes": [
      {
        "url": "https://api.malwaretracker.com/mcp",
        "type": "streamable-http",
        "headers": [
          {
            "name": "Authorization",
            "isSecret": true,
            "description": "Bearer mt_live_... API key from https://api.malwaretracker.com/portal",
            "placeholder": "Bearer mt_live_..."
          }
        ]
      }
    ],
    "version": "2.3.0",
    "packages": [
      {
        "version": "2.3.0",
        "transport": {
          "type": "stdio"
        },
        "identifier": "malwaretracker-mcp",
        "runtimeHint": "uvx",
        "registryType": "pypi",
        "registryBaseUrl": "https://pypi.org",
        "environmentVariables": [
          {
            "name": "MALWARETRACKER_API_KEY",
            "isSecret": true,
            "description": "MalwareTracker API key (100 free scans/month at https://api.malwaretracker.com/portal)",
            "placeholder": "mt_live_..."
          }
        ]
      }
    ],
    "repository": {
      "url": "https://github.com/tylabs/malwaretracker-mcp",
      "source": "github"
    },
    "websiteUrl": "https://malwaretracker.com/api.html#mcp",
    "description": "Scan PDFs, Office docs, and RAG files for malware exploits, macros, CVEs, and AI prompt injection."
  }
}

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://api.malwaretracker.com/mcp

Authorization (optional)

Bearer mt_live_... API key from https://api.malwaretracker.com/portal

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

malwaretracker_get_quota Read-only

Check current MalwareTracker API plan, monthly scan usage, and remaining quota.

This tool takes no arguments.

Try it

Call this server's tools from your browser. Nothing to install.

https://api.malwaretracker.com/mcp

Authorization (optional)

Bearer mt_live_... API key from https://api.malwaretracker.com/portal

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

malwaretracker_get_quota Read-only

Check current MalwareTracker API plan, monthly scan usage, and remaining quota.

This tool takes no arguments.

Tools (5)

malwaretracker_get_quota

Check current MalwareTracker API plan, monthly scan usage, and remaining quota.

read-only

No arguments.

Input schema (JSON)

{
  "type": "object",
  "properties": {}
}

malwaretracker_list_yara_catalog

List or filter MalwareTracker's QuickSand YARA signature catalog, covered CVEs, MITRE ATT&CK techniques, and AI/RAG prompt-injection detection rules. Requires no API key.

read-only

Argument	Type	Description
cve	string	Optional CVE filter (e.g. 'CVE-2023-38831' or 'CVE-2024-21413').
search	string	Optional keyword to match rule names or descriptions.
category	string	Optional rule category filter (e.g. 'ai_safety', 'exploit', 'pdf', 'exe').

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "cve": {
      "type": "string",
      "description": "Optional CVE filter (e.g. 'CVE-2023-38831' or 'CVE-2024-21413')."
    },
    "search": {
      "type": "string",
      "description": "Optional keyword to match rule names or descriptions."
    },
    "category": {
      "type": "string",
      "description": "Optional rule category filter (e.g. 'ai_safety', 'exploit', 'pdf', 'exe')."
    }
  }
}

malwaretracker_lookup_hash

Look up a previously analyzed document malware & stream report by MD5, SHA1, SHA256, or SHA512 hash. Does not consume monthly scan quota.

read-only

Argument	Type	Description
hash*	string	Hexadecimal MD5, SHA1, SHA256, or SHA512 file hash.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "hash"
  ],
  "properties": {
    "hash": {
      "type": "string",
      "description": "Hexadecimal MD5, SHA1, SHA256, or SHA512 file hash."
    }
  }
}

quicksand_scan_document

Scan a PDF, Office document (DOC/DOCX/XLS/XLSX/PPT/PPTX/RTF/OneNote), email, archive, or extracted text in <100ms for embedded malware exploits, macros, CVEs, and hidden AI/RAG prompt-injection payloads (3 Tr invisible PDF text, zero-point fonts, <w:vanish/> OOXML tags, spoofed <tool_call> tags, and markdown exfiltration beacons) with zero file retention.

read-only

Argument	Type	Description
filename	string	Original filename (e.g. 'invoice.pdf' or 'resume.docx').
password	string	Optional password for decrypting protected Office documents.
text_content	string	Raw UTF-8 text, Markdown, or HTML to inspect if binary bytes are unavailable.
content_base64	string	Base64-encoded bytes of the document to inspect.

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "filename": {
      "type": "string",
      "default": "document.pdf",
      "description": "Original filename (e.g. 'invoice.pdf' or 'resume.docx')."
    },
    "password": {
      "type": "string",
      "description": "Optional password for decrypting protected Office documents."
    },
    "text_content": {
      "type": "string",
      "description": "Raw UTF-8 text, Markdown, or HTML to inspect if binary bytes are unavailable."
    },
    "content_base64": {
      "type": "string",
      "description": "Base64-encoded bytes of the document to inspect."
    }
  }
}

quicksand_triage_document

Fast Tier-0 SOAR phishing & attachment triage. Evaluates a document in milliseconds and returns verdict ('clean' | 'suspicious' | 'malicious'), recommended_action ('allow' | 'detonate_in_sandbox' | 'quarantine_and_detonate'), escalate_to_sandbox, matched CVEs, MITRE ATT&CK techniques, and AI prompt-injection findings.

read-only

Argument	Type	Description
filename	string	Attachment filename (e.g. 'reported_phish.doc').
text_content	string	Raw UTF-8 text/HTML body to triage if binary bytes are unavailable.
content_base64	string	Base64-encoded bytes of the attachment to triage.

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "filename": {
      "type": "string",
      "default": "attachment.doc",
      "description": "Attachment filename (e.g. 'reported_phish.doc')."
    },
    "text_content": {
      "type": "string",
      "description": "Raw UTF-8 text/HTML body to triage if binary bytes are unavailable."
    },
    "content_base64": {
      "type": "string",
      "description": "Base64-encoded bytes of the attachment to triage."
    }
  }
}

MalwareTracker Document Malware & AI Safety Scanner

Registry entry

Try it

malwaretracker_get_quota Read-only

MalwareTracker Document Malware & AI Safety Scanner

Registry entry

Try it

malwaretracker_get_quota Read-only

Install

Tools (5)

Security checkA97/100