MCP SERVER · OFFICIAL PROJECTPull the indicators out of messy text and run them through Cyberbro's threat-analysis engines.
LABSCO SUMMARY
The useful part is the front of the workflow: an alert email or a chat message pasted in whole, with several observables of different kinds mixed through it, becomes one analysis run across the engines you picked. Analysis is asynchronous, so the shape is analyse, poll, read — and the web URL turns the finished result into a link for whoever needs the full picture inside Cyberbro.
A client for a Cyberbro instance. Hand it text containing IPs, domains, URLs, hashes or Chrome extension IDs — several at once — choose which engines to run, then poll for the results or open them in Cyberbro's own web view.
A running Cyberbro instance, with CYBERBRO_URL pointing at it — http://localhost:5000, for example. Install with uvx mcp-cyberbro or pip install mcp-cyberbro, and pass the URL as --cyberbro_url or through the environment. API_PREFIX defaults to api and SSL_VERIFY toggles certificate checking. The transport is selectable — stdio, sse or streamable-http — with MCP_HOST, MCP_PORT and path variables for the HTTP forms; the published ghcr.io/stanfrbd/mcp-cyberbro image starts in streamable-http on port 8000, and running it as stdio takes a two-line Dockerfile of your own. Nothing to authorize for the server itself.
One command — uvx mcp-cyberbro
USE CASES
Paste the text, run the observables it contains through the engines, and poll until the analysis is done.
List what your instance actually has configured before you start the run.
Get the analysis's web GUI URL so they can open the full view themselves.
Send them in one call rather than one per observable, then read the results together.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
analyze_observableTrigger an analysis for a given observable (IP, domain, URL, hash, chrome extension id) using Cyberbro. It can support multiple observables at once separated by spaces. Args: text: Observable(s) to analyze. engines: List of engine names. Returns: The analysis response from Cyberbro API.
get_analysis_resultsRetrieve the results of a previous analysis by analysis_id. Args: analysis_id: Analysis ID to retrieve results for. Returns: The analysis results from Cyberbro API.
get_enginesList available Cyberbro engines. This is the first tool to be called to get the usable engines. Returns: The list of engines.
get_web_urlGet the web GUI URL for a given analysis ID. Args: analysis_id: Analysis ID to get the web URL for. Returns: The web URL from Cyberbro API - Useful for the user to check the results.
is_analysis_completeCheck if the analysis is complete for the given analysis_id. Args: analysis_id: Analysis ID to check. Returns: The completion status from Cyberbro API.
BEFORE YOU INSTALL
5 tools when we connected.
CONTEXT COST
Rated by the size of the 5 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Add the block to your client, or run the command directly.
{
"mcpServers": {
"cyberbro": {
"command": "uvx",
"args": [
"mcp-cyberbro"
],
"env": {
"CYBERBRO_URL": "http://localhost:5000"
}
}
}
}uvx mcp-cyberbroMCP servers
joesecurity
google
UPinar
NAXG