The Threat.Zone MCP server provides LLMs with access to powerful malware analysis capabilities through a standardized Model Context Protocol (MCP). This server enables AI assistants to analyze files and URLs for threats, retrieve detailed analysis results, and generate security reports.
You can install the Threat.Zone MCP server using pip or uv:
# Using pip
pip install threatzone-mcp
# Using uv (recommended)
uv add threatzone-mcp
Set your Threat.Zone API credentials as environment variables:
export THREATZONE_API_KEY="your_api_key_here"
# Optional: For private tenants or on-premise deployments
export THREATZONE_API_URL="https://your-tenant.threat.zone"
Alternatively, create a .env file:
THREATZONE_API_KEY=your_api_key_here
# Optional: Custom API URL (defaults to https://app.threat.zone)
THREATZONE_API_URL=https://your-tenant.threat.zone
https://app.threat.zone (default)https://your-tenant.threat.zonehttps://your-server.company.comFind your Claude Desktop configuration directory:
~/Library/Application Support/Claude/%APPDATA%\Claude\~/.config/Claude/Create or edit claude_desktop_config.json:
{
"mcpServers": {
"threatzone": {
"command": "uv",
"args": [
"run",
"--directory",
"/full/path/to/your/threatzonemcp",
"threatzone-mcp"
],
"env": {
"THREATZONE_API_KEY": "your_actual_api_key_here",
"THREATZONE_API_URL": "https://your-tenant.threat.zone"
}
}
}
}
After saving the configuration:
In Claude Desktop, try asking:
"Can you get my Threat.Zone user information?"
You can run the server directly with:
# Using the installed script
threatzone-mcp
# Or directly with Python
python -m threatzone_mcp.server
scan_urlscan_file_sandbox - Advanced sandbox analysis with full configurationscan_file_sandbox_simple - Simple sandbox analysis with default settingsscan_file_static - Static file analysisscan_file_cdr - Content Disarm and Reconstructionget_submission, get_submission_status_summaryget_submission_indicators, get_submission_iocsget_submission_yara_rules, get_submission_varist_resultsget_submission_dns, get_submission_http, get_submission_tcp, get_submission_udp, get_submission_network_threatsget_submission_artifacts, get_submission_config_extractorinterpret_status, interpret_threat_levelget_metafields, get_levels, get_statuses, get_sample_metafieldget_user_infoget_my_submissions, get_public_submissionssearch_by_hashdownload_sanitized_file (CDR-cleaned files)download_html_report (detailed analysis reports)The scan_file_sandbox tool supports comprehensive configuration options:
w7_x64, w10_x64, w11_x64macosandroidlinuxdesktop, root, %AppData%, windows, tempSimple Analysis:
# Use default settings
await client.call_tool("scan_file_sandbox_simple", {
"file_path": "/path/to/file.exe"
})
Advanced Analysis:
# Full configuration control
await client.call_tool("scan_file_sandbox", {
"file_path": "/path/to/file.exe",
"environment": "w11_x64",
"timeout": 300,
"internet_connection": True,
"https_inspection": True,
"raw_logs": True,
"modules": ["csi", "cdr"]
})
| Value | Status | Description |
|---|---|---|
| 1 | File received | File has been uploaded and queued for analysis |
| 2 | Submission failed | Analysis failed due to error or timeout |
| 3 | Submission running | Analysis is currently in progress |
| 4 | Submission VM ready | Virtual machine is prepared and starting analysis |
| 5 | Submission finished | Analysis completed successfully |
| Value | Level | Description |
|---|---|---|
| 0 | Unknown | Unable to determine threat level |
| 1 | Informative | File appears benign with some notable behaviors |
| 2 | Suspicious | File exhibits potentially malicious characteristics |
| 3 | Malicious | File confirmed as malware or highly dangerous |
"Server not found" error:
"API key required" error:
"Permission denied" error:
Python import errors:
To add this MCP server to Claude Code, run this command in your terminal:
claude mcp add-json "threatzone" '{"command":"python","args":["-m","threatzone_mcp.server"],"env":{"THREATZONE_API_KEY":"your_api_key_here"}}'See the official Claude Code MCP documentation for more details.
There are two ways to add an MCP server to Cursor. The most common way is to add the server globally in the ~/.cursor/mcp.json file so that it is available in all of your projects.
If you only need the server in a single project, you can add it to the project instead by creating or adding it to the .cursor/mcp.json file.
To add a global MCP server go to Cursor Settings > Tools & Integrations and click "New MCP Server".
When you click that button the ~/.cursor/mcp.json file will be opened and you can add your server like this:
{
"mcpServers": {
"threatzone": {
"command": "python",
"args": [
"-m",
"threatzone_mcp.server"
],
"env": {
"THREATZONE_API_KEY": "your_api_key_here"
}
}
}
}To add an MCP server to a project you can create a new .cursor/mcp.json file or add it to the existing one. This will look exactly the same as the global MCP server example above.
Once the server is installed, you might need to head back to Settings > MCP and click the refresh button.
The Cursor agent will then be able to see the available tools the added MCP server has available and will call them when it needs to.
You can also explicitly ask the agent to use the tool by mentioning the tool name and describing what the function does.
To add this MCP server to Claude Desktop:
1. Find your configuration file:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json~/.config/Claude/claude_desktop_config.json2. Add this to your configuration file:
{
"mcpServers": {
"threatzone": {
"command": "python",
"args": [
"-m",
"threatzone_mcp.server"
],
"env": {
"THREATZONE_API_KEY": "your_api_key_here"
}
}
}
}3. Restart Claude Desktop for the changes to take effect