list_yara_rulesLABSCO SUMMARY
The rule-writing loop and the scanning loop are both here, which is what makes it more than a scanner.
You can validate a rule before it enters the library, scan a sample with it, and — when it does not fire — pull strings and a hex view from the same file to work out why. Scanning a URL means the server fetches the content, so point it at things you are prepared for the host to download.
What it is
A YARA scanning server. It manages a rule library from custom and community sources, scans URLs and uploaded data against it, and gives you the file-analysis primitives — strings, hex, metadata — you need to write the next rule.
What you get
- list_yara_rules, get_yara_rule, add_yara_rule, update_yara_rule, delete_yara_rule — manage the rule library across custom and community sources
- validate_yara_rule — check rule syntax and get the error detail back before saving
- import_threatflux_rules — pull a rule set in from a repository and branch
- scan_url — fetch and scan the content behind a URL, optionally with a named subset of rules
- scan_data — scan base64 content with a filename and encoding
- get_scan_result — retrieve the detailed result of an earlier scan by id
- upload_file, get_file_info, list_files, download_file, delete_file — a working store for samples
- extract_strings — ASCII and Unicode strings above a minimum length
- get_hex_view — a formatted hex dump from an offset
- get_storage_info and clean_storage — storage statistics and age-based cleanup
- Rule resources addressable as rules://{source} and rule://{name}/{source}
Requirements
Installed from PyPI as yaraflux_mcp_server, or run the Docker image the README builds. The container is started with JWT_SECRET_KEY and ADMIN_PASSWORD in its environment. Tool parameters are passed URL-encoded in a params field.
Setup effort
One command — docker pull threatflux/yaraflux-mcp-server:latest
USE CASES
01
Triaging a suspicious file
Upload it, scan it against the library, and read the matches with their rule metadata.
02
Checking a link before anyone clicks it
Scan the content behind the URL against the current rule set.
03
Writing a rule for something new
Pull the strings and a hex view out of the sample, draft the rule, validate the syntax, then add it.
04
Bringing in a community rule set
Import rules from a repository branch and list what arrived.
05
Keeping the sample store from filling up
Read the storage statistics and remove files older than a threshold.
19 tools
Listed in project docs. Your client may show a different list.
get_yara_rulevalidate_yara_ruleadd_yara_ruleupdate_yara_ruledelete_yara_ruleimport_threatflux_rulesscan_urlscan_dataget_scan_resultupload_fileget_file_infolist_filesdelete_fileextract_stringsget_hex_viewdownload_fileget_storage_infoclean_storageBEFORE YOU INSTALL
What to know first
Tools you get
19 tools named in the project's documentation.
Requires
docker on PATH
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
docker pull threatflux/yaraflux-mcp-server:latestMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"yaraflux-mcp-server": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"--env",
"JWT_SECRET_KEY=<YOUR_JWT_SECRET_KEY>",
"--env",
"ADMIN_PASSWORD=<YOUR_ADMIN_PASSWORD>",
"--env",
"DEBUG=true",
"--env",
"PYTHONUNBUFFERED=1",
"threatflux/yaraflux-mcp-server:latest"
],
"disabled": false,
"autoApprove": [
"scan_url",
"scan_data",
"list_yara_rules",
"get_yara_rule"
]
}
}
}
