Mlab.sh

What mlab.sh does

mlab.sh provides a remote MCP interface for SOC and DFIR workflows. It enriches indicators such as IP addresses, CIDR ranges, domains, URLs, hashes, email addresses, phone numbers, MAC addresses, and cryptocurrency addresses. It also searches CVEs and threat actors, scans dependency manifests and SBOMs, and supports case records for organizing investigation data.

The service includes workspace tools for organizations using AI agents with engram. These tools can inspect agent state, memory dumps, processes, registry keys, memory regions, and YARA findings on authorized workspace hosts.

How it works

Clients connect to https://mlab.sh/mcp using Streamable HTTP with POST requests or SSE with GET requests. Authentication can use browser-based OAuth or an Authorization: Bearer token. The server exposes tools according to the caller's role and plan, so tools/list may show only operations available to that account.

Most lookups return structured results directly. Domain scans can launch asynchronously: start_domain_scan may return a started status, after which get_domain_scan_results should be called again while the scan is pending or running. Workspace operations require a workspace identifier and are recorded in the workspace audit log.

Setup and configuration

Add the remote endpoint to a compatible MCP client. Claude Desktop can use mcp-remote with a bearer token, or the header can be omitted to use OAuth. Cursor and VS Code accept the endpoint directly with an authorization header. Claude.ai supports adding the URL as a custom connector, with OAuth handled in the browser.

A direct HTTP client can initialize an MCP session by POSTing JSON-RPC to the endpoint with suitable Accept and Content-Type headers. The repository also provides ready-to-use configuration examples for the documented clients.

Tools and capabilities

• Inspect indicators with detect_ioc, then use specialized scans for IPs, URLs, hashes, email, phone, MAC, and cryptocurrency addresses.
• Start domain reconnaissance and retrieve DNS records, subdomains, certificates, security.txt, and robots.txt.
• Analyze shell scripts without executing or storing them, including embedded IOCs and suspicious constructs.
• Scan supported lockfiles and SBOM formats for package vulnerabilities, affected CVEs, remediation versions, and coverage gaps.
• Search CVEs by product, vendor, keyword, or ID, with severity and date filters; retrieve detailed CVSS, EPSS, CWE, reference, and KEV data.
• Find MISP Galaxy threat actors and retrieve associated MITRE ATT&CK tools and techniques.
• Create and update investigation cases, including indicators and comments.
• Inspect authorized workspace agents and memory dumps, start indexing, read limited memory, and run YARA scans.

Limitations and notes

Quota usage varies by operation. IP and cryptocurrency scans consume quota; domain scans consume domain-scan quota; URL, hash, email, phone, MAC, shell, and SBOM operations have the stated no-quota behavior. IP results are cached for seven days, and CIDR range scans are free.

URL analysis is static unless resolve is enabled, which follows the link to its destination. Domain scans contact the target. Hash results marked unknown should not be treated as safe. SBOM input is limited to 2 MB. EVM cryptocurrency addresses require a chain when the chain is known because the address alone does not identify it.

Cases require Team or Enterprise access for reading and writing, while workspace features require an enabled AI-agents workspace. Workspace tools do not create or delete workspace resources; those actions remain in the application.