# mlab.sh [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/mlab-sh/mcp  
**GitHub Stars:** 2  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mlab-sh

## Description
Threat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs.

## Tools
Capabilities this server exposes over MCP:

- **detect_ioc** — Detects the type of an indicator (IPv4, IPv6, CIDR, domain, URL, MD5/SHA1/SHA256/SHA512 hash, email, MAC) and returns the relevant intel. A domain is typed, not scanned: use `start_domain_scan` for that. An IP spends IP quota
- **scan_ip** — For an address: geolocation, ISP, ASN, datacenter / proxy / VPN / mobile network, TOR consensus status, forward confirmed reverse DNS, RDAP record with the abuse contact. For a CIDR range: network, broadcast, host window, netmask, size, reserved blocks. Addresses spend IP quota (cached 7 days); ran…
- **scan_url** — Static analysis without visiting: scheme, host with its Unicode and punycode forms, IP literal hosts, credentials in the URL, dangerous extensions, shorteners, embedded redirect targets, and what a past domain scan recorded about the host. `resolve` follows the link to its real destination, the onl…
- **scan_hash** — MD5, SHA1 or SHA256 against CIRCL hashlookup (NIST NSRL): known good, known malicious or unknown, each feed's own answer, malware family, product and file name, CIRCL trust score, and `mlab_sample` when mlab analysed the file itself. `unknown` is not the same as safe. No quota
- **scan_crypto** — Labels, sanctions, risk score and address type across 18 chains (Bitcoin, Ethereum and 12 other EVM chains, Tron, Solana, TON, Dogecoin), with a checksum check. EVM addresses do not reveal their chain: pass `chain` when you know it. Spends crypto quota
- **scan_email** — Mailbox type (disposable, role, consumer, standard), SPF / DKIM / DMARC spoofability of its domain, MX presence, domain age when scanned, and a 0 to 100 score with its weighted reasons. No quota
- **scan_phone** — E.164 number: validity, country, line type, allocated operator, formatting and scam shaped findings. Offline, no quota
- **scan_mac** — OUI vendor, unicast or multicast, universal or local administration, randomized or virtual interface, EUI-64 IPv6, other formats. Offline, no quota
- **start_domain_scan** — Returns a recent completed scan right away, or launches a new one and returns `{"status": "started"}`. A new scan contacts the target and spends domain scan quota
- **get_domain_scan_results** — Results of a domain scan: DNS records, subdomains, SSL certificates, security.txt, robots.txt. Call again while the status is `pending` or `scanning
- **scan_bash** — Static analysis of an inline shell script: sha256, every IOC it holds, and well known suspicious constructs (download piped to a shell, base64 decoding, `/dev/tcp` reverse shells, persistence, anti forensics, destructive deletes). Nothing runs or is stored. No quota
- **scan_sbom** — Known vulnerabilities in a lockfile or SBOM (npm, yarn, pnpm, Cargo, pip, Poetry, uv, PDM, Pipfile, Composer, Gem, Go, Maven, Gradle, NuGet, pub, Hex, mise, CycloneDX, SPDX), one finding per package and CVE, worst first, with the fixed version and what the scan could not cover. Matched server side…
- **cve_search** — CVEs by keyword, product, vendor or ID, filtered by severity (CRITICAL, HIGH, MEDIUM, LOW) and publication date, with CVSS, EPSS and KEV status
- **cve_detail** — The full record: CVSS vector breakdown, affected products, references, CWEs, EPSS, CISA KEV status
- **search_actors** — Threat actors by name or alias from the MISP Galaxy cluster (CC0), narrowed by origin, incident type or targeted sector. Returns the slug for `get_actor
- **get_actor** — MISP Galaxy profile (origin, suspected sponsor, synonyms, targeted countries and sectors, references) with the MITRE ATT&CK tools and techniques attributed to it. Keep the `sources` block when quoting: it carries MITRE's notice
- **list_cases** — The organization's cases, open ones first, with indicator and comment counts
- **get_case** — Title, summary, status, every indicator with a link to its analysis, and the comment thread
- **create_case** — Opens a case and returns the uuid the other case tools take
- **add_case_indicators** — Files a paste of indicators (one per line, or comma or space separated, mixed types), typed automatically; anything mlab cannot look up comes back in `skipped` with the reason
- **add_case_comment** — A note on the case, or on one of its indicators
- **workspace_list** — The workspaces you can open, whether AI agents may read them, agents online and the tools they run
- **workspace_agents** — The workspace's agents: live state, version, the tools each one reports
- **workspace_memory_dumps** — Memory dumps on the engram agents, and which ones are indexed. Asks every agent: allow a few seconds
- **workspace_memory_index** — Starts indexing a dump on its host, in the background. Follow it with `workspace_memory_dumps
- **workspace_memory_overview** — A dump's index: system, process tree, findings (injected code and other anomalies), registry hives
- **workspace_memory_process** — One process in full: command line, environment, modules, memory regions, handles, findings
- **workspace_memory_read** — Up to 4 KiB read live from the dump, as hex and text. `space` is `virtual` (needs `pid`, the default) or `physical
- **workspace_memory_registry** — One registry key: values, subkeys, last write time
- **workspace_memory_yara** — Runs YARA rules over the dump's processes on the host. Usually returns a job, a new one each call
- **workspace_memory_yara_status** — Progress of a YARA scan, and its matches once done
- **workspace_cluster_list** — Clusters reporting to the workspace: nodes online, images, vulnerabilities in packages really loaded, recent detections
- **workspace_cluster_images** — Running images with their vulnerabilities, loaded ones first
- **workspace_cluster_image** — One image: findings and packages, with which are loaded in memory
- **workspace_cluster_events** — Runtime events, newest first: Kubernetes events, eBPF activity, YARA detections, with cached reputation of destinations and binaries. 200 at most per call; `before` pages back
- **workspace_cluster_config** — What k3sec collects on each node, and the ceiling the nodes' local policies allow
- **workspace_virt_list** — Proxmox clusters: nodes online, LXC and VM guests, guests with weakened isolation, vulnerabilities in loaded packages, critical events of the last 24 h
- **workspace_virt_guests** — Guests and nodes: status, isolation risks from their config (privileged, host bind mounts, passthrough), vulnerabilities
- **workspace_virt_guest** — One guest by vmid, or a node (`key` = `node` with its `agent`): isolation risks, findings, packages
- **workspace_virt_events** — Runtime events, newest first: executions in guests, outbound connections, sensitive writes, VM escape signals, PVE logins, auth failures, tasks, guest config changes. 200 at most per call
- **workspace_virt_config** — What virtsec collects on each node, and the ceiling the local policies allow
- **workspace_virt_audit** — Security posture per node: failed checks (PVE firewall off, users without a second factor, root SSH with a password, unreachable or test repositories, guests without backup, isolation risks, pending restarts), each with a fix
- **get_account_info** — The authenticated user, their organization and plan
- **get_scan_limits** — Remaining IP, domain, file and crypto quotas of the organization, over a rolling 24 hours shared by all members
- **get_scan_history** — Recent scans of the account, filtered by `ip`, `domain` or `file
- **get_bookmarks** — Your bookmarked indicators
- **add_bookmark** — Bookmarks an IP, domain, URL, hash, crypto address, email, phone number or MAC address
- **remove_bookmark** — Removes a bookmark

## Claude Desktop Quick Installation
Remote MCP endpoint (confidence: high). Install path detected from listing signals. Add as a URL/SSE server in your client:

```json
"mcpServers": {
  "mlab-sh": {
    "url": "https://mlab.sh/mcp"
  }
}
```

## Documentation

## What mlab.sh does

mlab.sh provides a remote MCP interface for SOC and DFIR workflows. It enriches indicators such as IP addresses, CIDR ranges, domains, URLs, hashes, email addresses, phone numbers, MAC addresses, and cryptocurrency addresses. It also searches CVEs and threat actors, scans dependency manifests and SBOMs, and supports case records for organizing investigation data.

The service includes workspace tools for organizations using AI agents with engram. These tools can inspect agent state, memory dumps, processes, registry keys, memory regions, and YARA findings on authorized workspace hosts.

## How it works

Clients connect to `https://mlab.sh/mcp` using Streamable HTTP with POST requests or SSE with GET requests. Authentication can use browser-based OAuth or an `Authorization: Bearer` token. The server exposes tools according to the caller's role and plan, so `tools/list` may show only operations available to that account.

Most lookups return structured results directly. Domain scans can launch asynchronously: `start_domain_scan` may return a started status, after which `get_domain_scan_results` should be called again while the scan is pending or running. Workspace operations require a workspace identifier and are recorded in the workspace audit log.

## Setup and configuration

Add the remote endpoint to a compatible MCP client. Claude Desktop can use `mcp-remote` with a bearer token, or the header can be omitted to use OAuth. Cursor and VS Code accept the endpoint directly with an authorization header. Claude.ai supports adding the URL as a custom connector, with OAuth handled in the browser.

A direct HTTP client can initialize an MCP session by POSTing JSON-RPC to the endpoint with suitable `Accept` and `Content-Type` headers. The repository also provides ready-to-use configuration examples for the documented clients.

## Tools and capabilities

- Inspect indicators with `detect_ioc`, then use specialized scans for IPs, URLs, hashes, email, phone, MAC, and cryptocurrency addresses.
- Start domain reconnaissance and retrieve DNS records, subdomains, certificates, `security.txt`, and `robots.txt`.
- Analyze shell scripts without executing or storing them, including embedded IOCs and suspicious constructs.
- Scan supported lockfiles and SBOM formats for package vulnerabilities, affected CVEs, remediation versions, and coverage gaps.
- Search CVEs by product, vendor, keyword, or ID, with severity and date filters; retrieve detailed CVSS, EPSS, CWE, reference, and KEV data.
- Find MISP Galaxy threat actors and retrieve associated MITRE ATT&CK tools and techniques.
- Create and update investigation cases, including indicators and comments.
- Inspect authorized workspace agents and memory dumps, start indexing, read limited memory, and run YARA scans.

## Limitations and notes

Quota usage varies by operation. IP and cryptocurrency scans consume quota; domain scans consume domain-scan quota; URL, hash, email, phone, MAC, shell, and SBOM operations have the stated no-quota behavior. IP results are cached for seven days, and CIDR range scans are free.

URL analysis is static unless `resolve` is enabled, which follows the link to its destination. Domain scans contact the target. Hash results marked unknown should not be treated as safe. SBOM input is limited to 2 MB. EVM cryptocurrency addresses require a chain when the chain is known because the address alone does not identify it.

Cases require Team or Enterprise access for reading and writing, while workspace features require an enabled AI-agents workspace. Workspace tools do not create or delete workspace resources; those actions remain in the application.

_Full upstream README: https://allmcps.com/mcp/mlab-sh/readme_