Cyberbro
Extracts Indicators of Compromise (IoCs) from text and checks their reputation using multiple threat intelligence services.Read full description
stanfrbdLABSCO SUMMARY
The whole report — process tree, unpacked binaries, PCAP — reachable without opening the console.
Submission and read-back happen in one conversation, and responses are truncated and filtered on the way out so a large report does not arrive whole. The parts that usually cost the most clicks are the ones it exposes directly: binaries that only ever existed in memory, and the packet capture as a file you can take away.
What it is
The Joe Security MCP server for Joe Sandbox Cloud: submit files, URLs, websites or command lines for dynamic analysis, then read the report back in a form structured for a language model.
What you get
- Submit local files, remote URLs, websites or command lines, waiting for results or checking back later
- Options for internet access, script logging and archive passwords on submission
- Search past analyses by hash, filename, detection status or threat name
- Network indicators — domains, IPs and URLs contacted, filterable to the malicious ones
- Malicious dropped files with hashes, filenames and originating processes
- Behavioral signature detections, filterable to high impact
- The full process tree with command lines and parent-child relationships
- In-memory unpacked PE files, raw memory dumps and the complete PCAP
- AI-generated reasoning summaries of what the sample did
Requirements
A Joe Sandbox Cloud API key in JBXAPIKEY, and ACCEPTTAC set to confirm you have accepted Joe Security's terms and conditions. Clone the repository, then uv venv and uv pip install -e . before launching main.py through uv.
Setup effort
Build from source — git clone https://github.com/joesecurity/joesandboxMCP.git
USE CASES
01
Getting a verdict on a suspicious file
Submit it, then ask for the status, the score and the behavioral detections.
02
Checking whether something was already analyzed
Search past submissions by hash or filename before spending another run.
03
Building a block list from a run
Pull the contacted domains, IPs and URLs, filtered to the ones flagged malicious.
04
Recovering a payload that only exists in memory
Download the unpacked PE files or the raw memory dumps captured during execution.
BEFORE YOU INSTALL
What to know first
Requires
JBXAPIKEY in your environment
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
You clone this one yourself.
Server setup
TERMINAL
git clone https://github.com/joesecurity/joesandboxMCP.git
cd joesandboxMCP
uv venv
uv pip install -e .MCP Clients
Any MCP client
ANY MCP CLIENT · JSON
{
"mcpServers": {
"JoeSandbox": {
"command": "uv",
"args": [
"--directory",
"<YOUR_PATH_TO_JOESANDBOX_MCP>",
"run",
"main.py"
],
"env": {
"JBXAPIKEY": "<YOUR_JBXAPIKEY>",
"ACCEPTTAC": "SET_TRUE_IF_YOU_ACCEPT"
}
}
}
}
