Summary
The whole report — process tree, unpacked binaries, PCAP — reachable without opening the console.
Submission and read-back happen in one conversation, and responses are truncated and filtered on the way out so a large report does not arrive whole. The parts that usually cost the most clicks are the ones it exposes directly: binaries that only ever existed in memory, and the packet capture as a file you can take away.
What it is
The Joe Security MCP server for Joe Sandbox Cloud: submit files, URLs, websites or command lines for dynamic analysis, then read the report back in a form structured for a language model.
What you get
- Submit local files, remote URLs, websites or command lines, waiting for results or checking back later
- Options for internet access, script logging and archive passwords on submission
- Search past analyses by hash, filename, detection status or threat name
- Network indicators — domains, IPs and URLs contacted, filterable to the malicious ones
- Malicious dropped files with hashes, filenames and originating processes
- Behavioral signature detections, filterable to high impact
- The full process tree with command lines and parent-child relationships
- In-memory unpacked PE files, raw memory dumps and the complete PCAP
- AI-generated reasoning summaries of what the sample did
Requirements
A Joe Sandbox Cloud API key in JBXAPIKEY, and ACCEPTTAC set to confirm you have accepted Joe Security's terms and conditions. Clone the repository, then uv venv and uv pip install -e . before launching main.py through uv.