You can validate a rule before it enters the library, scan a sample with it, and — when it does not fire — pull strings and a hex view from the same file to work out why. Scanning a URL means the server fetches the content, so point it at things you are prepared for the host to download.
A YARA scanning server. It manages a rule library from custom and community sources, scans URLs and uploaded data against it, and gives you the file-analysis primitives — strings, hex, metadata — you need to write the next rule.
- list_yara_rules, get_yara_rule, add_yara_rule, update_yara_rule, delete_yara_rule — manage the rule library across custom and community sources
- validate_yara_rule — check rule syntax and get the error detail back before saving
- import_threatflux_rules — pull a rule set in from a repository and branch
- scan_url — fetch and scan the content behind a URL, optionally with a named subset of rules
- scan_data — scan base64 content with a filename and encoding
- get_scan_result — retrieve the detailed result of an earlier scan by id
- upload_file, get_file_info, list_files, download_file, delete_file — a working store for samples
- extract_strings — ASCII and Unicode strings above a minimum length
- get_hex_view — a formatted hex dump from an offset
- get_storage_info and clean_storage — storage statistics and age-based cleanup
- Rule resources addressable as rules://{source} and rule://{name}/{source}
Installed from PyPI as yaraflux_mcp_server, or run the Docker image the README builds. The container is started with JWT_SECRET_KEY and ADMIN_PASSWORD in its environment. Tool parameters are passed URL-encoded in a params field.
One command — docker pull threatflux/yaraflux-mcp-server:latest