{
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "attributionRequired": true,
    "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-11-14",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.8",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run",
    "terms": "https://www.anchorterminal.com/terms/#data"
  },
  "tool": {
    "category": "guardrails",
    "endpoint": "https://api.malwaretracker.com/mcp",
    "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/malwaretracker-mcp.json",
    "kind": "mcp",
    "listed": "indexed",
    "liveUrl": "https://www.anchorterminal.com/api/v1/live/malwaretracker-mcp.json",
    "markdownUrl": "https://www.anchorterminal.com/tools/malwaretracker-mcp.md",
    "mcpTools": {
      "check": {
        "checker": "anchor-check/1.0",
        "totalTokens": 1143,
        "counts": {
          "error": 0,
          "note": 1,
          "warn": 0
        },
        "findings": [
          {
            "rule": "TC24",
            "severity": "note",
            "message": "5 of 5 tools have no outputSchema",
            "fix": "Declare outputSchema for tools that return structured data, and return structuredContent that matches it."
          }
        ]
      },
      "checkedAt": "2026-11-14T03:33:29Z",
      "count": 5,
      "note": "answered without the initialize handshake",
      "schemaTokens": 1143,
      "status": "ok",
      "tools": [
        {
          "name": "quicksand_scan_document",
          "title": "Scan Document for Malware \u0026 Prompt Injection",
          "description": "Scan a PDF, Office document (DOC/DOCX/XLS/XLSX/PPT/PPTX/RTF/OneNote), email, archive, URL, or extracted text in under 100ms for embedded malware exploits, macros, CVEs, and hidden AI/RAG prompt-injection payloads (3 Tr invisible PDF text, zero-point fonts, hidden OOXML vanish runs, spoofed tool-call tags, and markdown exfiltration beacons) with zero file retention. IMPORTANT: Pass 'text_content' (raw/extracted text, Markdown, or HTML), 'content_base64' (base64 file bytes or data URI), or 'url' (public https:// link). Do not pass container-local '/mnt/user-data' file paths directly.",
          "inputSchema": {
            "properties": {
              "api_key": {
                "description": "Optional MalwareTracker API key (mt_live_...) if not authenticated via OAuth or headers.",
                "type": "string"
              },
              "content_base64": {
                "description": "Base64-encoded bytes (or data:...;base64, URI) of the document to inspect.",
                "type": "string"
              },
              "filename": {
                "default": "document.pdf",
                "description": "Original filename (e.g. 'invoice.pdf' or 'resume.docx').",
                "type": "string"
              },
              "password": {
                "description": "Optional password for decrypting protected Office documents.",
                "type": "string"
              },
              "text_content": {
                "description": "Raw UTF-8 text, extracted document text, Markdown, or HTML to inspect.",
                "type": "string"
              },
              "url": {
                "description": "Public https:// URL to download and scan the document from.",
                "type": "string"
              }
            },
            "type": "object"
          },
          "annotations": {
            "destructiveHint": false,
            "idempotentHint": true,
            "openWorldHint": false,
            "readOnlyHint": true,
            "title": "Scan Document for Malware \u0026 Prompt Injection"
          }
        },
        {
          "name": "quicksand_triage_document",
          "title": "SOAR Tier-0 Document Triage",
          "description": "Fast Tier-0 SOAR phishing \u0026 attachment triage. Evaluates a document in milliseconds and returns verdict ('clean' | 'suspicious' | 'malicious'), recommended_action ('allow' | 'detonate_in_sandbox' | 'quarantine_and_detonate'), escalate_to_sandbox, matched CVEs, MITRE ATT\u0026CK techniques, and AI prompt-injection findings. Pass 'text_content', 'content_base64', or 'url' (https://).",
          "inputSchema": {
            "properties": {
              "api_key": {
                "description": "Optional MalwareTracker API key (mt_live_...) if not authenticated via OAuth or headers.",
                "type": "string"
              },
              "content_base64": {
                "description": "Base64-encoded bytes (or data:...;base64, URI) of the attachment to triage.",
                "type": "string"
              },
              "filename": {
                "default": "attachment.doc",
                "description": "Attachment filename (e.g. 'reported_phish.doc').",
                "type": "string"
              },
              "text_content": {
                "description": "Raw UTF-8 text/HTML body to triage if binary bytes are unavailable.",
                "type": "string"
              },
              "url": {
                "description": "Public https:// URL of the attachment to triage.",
                "type": "string"
              }
            },
            "type": "object"
          },
          "annotations": {
            "destructiveHint": false,
            "idempotentHint": true,
            "openWorldHint": false,
            "readOnlyHint": true,
            "title": "SOAR Tier-0 Document Triage"
          }
        },
        {
          "name": "malwaretracker_lookup_hash",
          "title": "Lookup Document Threat Report by Hash",
          "description": "Look up a previously analyzed document malware \u0026 stream report by MD5, SHA1, SHA256, or SHA512 hash. Does not consume monthly scan quota.",
          "inputSchema": {
            "properties": {
              "hash": {
                "description": "Hexadecimal MD5, SHA1, SHA256, or SHA512 file hash.",
                "type": "string"
              }
            },
            "required": [
              "hash"
            ],
            "type": "object"
          },
          "annotations": {
            "destructiveHint": false,
            "idempotentHint": true,
            "openWorldHint": false,
            "readOnlyHint": true,
            "title": "Lookup Document Threat Report by Hash"
          }
        },
        {
          "name": "malwaretracker_list_yara_catalog",
          "title": "Search YARA \u0026 CVE Detection Catalog",
          "description": "List or filter MalwareTracker's QuickSand YARA signature catalog, covered CVEs, MITRE ATT\u0026CK techniques, and AI/RAG prompt-injection detection rules. Requires no API key.",
          "inputSchema": {
            "properties": {
              "category": {
                "description": "Optional rule category filter (e.g. 'ai_safety', 'exploit', 'pdf', 'exe').",
                "type": "string"
              },
              "cve": {
                "description": "Optional CVE filter (e.g. 'CVE-2023-38831' or 'CVE-2024-21413').",
                "type": "string"
              },
              "search": {
                "description": "Optional keyword to match rule names or descriptions.",
                "type": "string"
              }
            },
            "type": "object"
          },
          "annotations": {
            "destructiveHint": false,
            "idempotentHint": true,
            "openWorldHint": false,
            "readOnlyHint": true,
            "title": "Search YARA \u0026 CVE Detection Catalog"
          }
        },
        {
          "name": "malwaretracker_get_quota",
          "title": "Check MalwareTracker API Quota",
          "description": "Check current MalwareTracker API plan, monthly scan usage, and remaining quota.",
          "inputSchema": {
            "properties": {},
            "type": "object"
          },
          "annotations": {
            "destructiveHint": false,
            "idempotentHint": true,
            "openWorldHint": false,
            "readOnlyHint": true,
            "title": "Check MalwareTracker API Quota"
          }
        }
      ]
    },
    "name": "MalwareTracker Document Malware \u0026 AI Safety Scanner",
    "note": "Indexed from the official MCP registry: facts and our own checks, not reviewed, so no score, grade or rank.",
    "packages": [
      {
        "registryType": "pypi",
        "identifier": "malwaretracker-mcp",
        "version": "2.3.0",
        "transport": "stdio"
      }
    ],
    "pageJsonUrl": "https://www.anchorterminal.com/tools/malwaretracker-mcp.json",
    "popularity": {
      "githubStars": 0,
      "pypiWeekly": 96
    },
    "registryName": "com.malwaretracker/mcp",
    "remotes": [
      {
        "type": "streamable-http",
        "url": "https://api.malwaretracker.com/mcp"
      }
    ],
    "repository": "https://github.com/tylabs/malwaretracker-mcp",
    "reviewed": false,
    "slug": "malwaretracker-mcp",
    "source": "the official MCP registry",
    "sourceUrl": "https://registry.modelcontextprotocol.io/v0.1/servers?search=com.malwaretracker/mcp",
    "summary": "Scan PDFs, Office docs, and RAG files for malware exploits, macros, CVEs, and AI prompt injection.",
    "updatedAt": "2026-11-12T21:35:47Z",
    "url": "https://www.anchorterminal.com/tools/malwaretracker-mcp",
    "vendor": "malwaretracker.com",
    "vendorUrl": "https://malwaretracker.com/api.html#mcp",
    "version": "2.3.0",
    "websiteUrl": "https://malwaretracker.com/api.html#mcp",
    "where": "both",
    "why": [
      "vendor"
    ]
  }
}