{
  "data": {
    "tool": {
      "category": "guardrails",
      "endpoint": "https://api.malwaretracker.com/mcp",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/malwaretracker-mcp.json",
      "kind": "mcp",
      "listed": "indexed",
      "liveUrl": "https://www.anchorterminal.com/api/v1/live/malwaretracker-mcp.json",
      "markdownUrl": "https://www.anchorterminal.com/tools/malwaretracker-mcp.md",
      "mcpTools": {
        "check": {
          "checker": "anchor-check/1.0",
          "totalTokens": 1143,
          "counts": {
            "error": 0,
            "note": 1,
            "warn": 0
          },
          "findings": [
            {
              "rule": "TC24",
              "severity": "note",
              "message": "5 of 5 tools have no outputSchema",
              "fix": "Declare outputSchema for tools that return structured data, and return structuredContent that matches it."
            }
          ]
        },
        "checkedAt": "2026-11-14T03:33:29Z",
        "count": 5,
        "note": "answered without the initialize handshake",
        "schemaTokens": 1143,
        "status": "ok",
        "tools": [
          {
            "name": "quicksand_scan_document",
            "title": "Scan Document for Malware \u0026 Prompt Injection",
            "description": "Scan a PDF, Office document (DOC/DOCX/XLS/XLSX/PPT/PPTX/RTF/OneNote), email, archive, URL, or extracted text in under 100ms for embedded malware exploits, macros, CVEs, and hidden AI/RAG prompt-injection payloads (3 Tr invisible PDF text, zero-point fonts, hidden OOXML vanish runs, spoofed tool-call tags, and markdown exfiltration beacons) with zero file retention. IMPORTANT: Pass 'text_content' (raw/extracted text, Markdown, or HTML), 'content_base64' (base64 file bytes or data URI), or 'url' (public https:// link). Do not pass container-local '/mnt/user-data' file paths directly.",
            "inputSchema": {
              "properties": {
                "api_key": {
                  "description": "Optional MalwareTracker API key (mt_live_...) if not authenticated via OAuth or headers.",
                  "type": "string"
                },
                "content_base64": {
                  "description": "Base64-encoded bytes (or data:...;base64, URI) of the document to inspect.",
                  "type": "string"
                },
                "filename": {
                  "default": "document.pdf",
                  "description": "Original filename (e.g. 'invoice.pdf' or 'resume.docx').",
                  "type": "string"
                },
                "password": {
                  "description": "Optional password for decrypting protected Office documents.",
                  "type": "string"
                },
                "text_content": {
                  "description": "Raw UTF-8 text, extracted document text, Markdown, or HTML to inspect.",
                  "type": "string"
                },
                "url": {
                  "description": "Public https:// URL to download and scan the document from.",
                  "type": "string"
                }
              },
              "type": "object"
            },
            "annotations": {
              "destructiveHint": false,
              "idempotentHint": true,
              "openWorldHint": false,
              "readOnlyHint": true,
              "title": "Scan Document for Malware \u0026 Prompt Injection"
            }
          },
          {
            "name": "quicksand_triage_document",
            "title": "SOAR Tier-0 Document Triage",
            "description": "Fast Tier-0 SOAR phishing \u0026 attachment triage. Evaluates a document in milliseconds and returns verdict ('clean' | 'suspicious' | 'malicious'), recommended_action ('allow' | 'detonate_in_sandbox' | 'quarantine_and_detonate'), escalate_to_sandbox, matched CVEs, MITRE ATT\u0026CK techniques, and AI prompt-injection findings. Pass 'text_content', 'content_base64', or 'url' (https://).",
            "inputSchema": {
              "properties": {
                "api_key": {
                  "description": "Optional MalwareTracker API key (mt_live_...) if not authenticated via OAuth or headers.",
                  "type": "string"
                },
                "content_base64": {
                  "description": "Base64-encoded bytes (or data:...;base64, URI) of the attachment to triage.",
                  "type": "string"
                },
                "filename": {
                  "default": "attachment.doc",
                  "description": "Attachment filename (e.g. 'reported_phish.doc').",
                  "type": "string"
                },
                "text_content": {
                  "description": "Raw UTF-8 text/HTML body to triage if binary bytes are unavailable.",
                  "type": "string"
                },
                "url": {
                  "description": "Public https:// URL of the attachment to triage.",
                  "type": "string"
                }
              },
              "type": "object"
            },
            "annotations": {
              "destructiveHint": false,
              "idempotentHint": true,
              "openWorldHint": false,
              "readOnlyHint": true,
              "title": "SOAR Tier-0 Document Triage"
            }
          },
          {
            "name": "malwaretracker_lookup_hash",
            "title": "Lookup Document Threat Report by Hash",
            "description": "Look up a previously analyzed document malware \u0026 stream report by MD5, SHA1, SHA256, or SHA512 hash. Does not consume monthly scan quota.",
            "inputSchema": {
              "properties": {
                "hash": {
                  "description": "Hexadecimal MD5, SHA1, SHA256, or SHA512 file hash.",
                  "type": "string"
                }
              },
              "required": [
                "hash"
              ],
              "type": "object"
            },
            "annotations": {
              "destructiveHint": false,
              "idempotentHint": true,
              "openWorldHint": false,
              "readOnlyHint": true,
              "title": "Lookup Document Threat Report by Hash"
            }
          },
          {
            "name": "malwaretracker_list_yara_catalog",
            "title": "Search YARA \u0026 CVE Detection Catalog",
            "description": "List or filter MalwareTracker's QuickSand YARA signature catalog, covered CVEs, MITRE ATT\u0026CK techniques, and AI/RAG prompt-injection detection rules. Requires no API key.",
            "inputSchema": {
              "properties": {
                "category": {
                  "description": "Optional rule category filter (e.g. 'ai_safety', 'exploit', 'pdf', 'exe').",
                  "type": "string"
                },
                "cve": {
                  "description": "Optional CVE filter (e.g. 'CVE-2023-38831' or 'CVE-2024-21413').",
                  "type": "string"
                },
                "search": {
                  "description": "Optional keyword to match rule names or descriptions.",
                  "type": "string"
                }
              },
              "type": "object"
            },
            "annotations": {
              "destructiveHint": false,
              "idempotentHint": true,
              "openWorldHint": false,
              "readOnlyHint": true,
              "title": "Search YARA \u0026 CVE Detection Catalog"
            }
          },
          {
            "name": "malwaretracker_get_quota",
            "title": "Check MalwareTracker API Quota",
            "description": "Check current MalwareTracker API plan, monthly scan usage, and remaining quota.",
            "inputSchema": {
              "properties": {},
              "type": "object"
            },
            "annotations": {
              "destructiveHint": false,
              "idempotentHint": true,
              "openWorldHint": false,
              "readOnlyHint": true,
              "title": "Check MalwareTracker API Quota"
            }
          }
        ]
      },
      "name": "MalwareTracker Document Malware \u0026 AI Safety Scanner",
      "note": "Indexed from the official MCP registry: facts and our own checks, not reviewed, so no score, grade or rank.",
      "packages": [
        {
          "registryType": "pypi",
          "identifier": "malwaretracker-mcp",
          "version": "2.3.0",
          "transport": "stdio"
        }
      ],
      "pageJsonUrl": "https://www.anchorterminal.com/tools/malwaretracker-mcp.json",
      "popularity": {
        "githubStars": 0,
        "pypiWeekly": 96
      },
      "registryName": "com.malwaretracker/mcp",
      "remotes": [
        {
          "type": "streamable-http",
          "url": "https://api.malwaretracker.com/mcp"
        }
      ],
      "repository": "https://github.com/tylabs/malwaretracker-mcp",
      "reviewed": false,
      "slug": "malwaretracker-mcp",
      "source": "the official MCP registry",
      "sourceUrl": "https://registry.modelcontextprotocol.io/v0.1/servers?search=com.malwaretracker/mcp",
      "summary": "Scan PDFs, Office docs, and RAG files for malware exploits, macros, CVEs, and AI prompt injection.",
      "updatedAt": "2026-11-12T21:35:47Z",
      "url": "https://www.anchorterminal.com/tools/malwaretracker-mcp",
      "vendor": "malwaretracker.com",
      "vendorUrl": "https://malwaretracker.com/api.html#mcp",
      "version": "2.3.0",
      "websiteUrl": "https://malwaretracker.com/api.html#mcp",
      "where": "both",
      "why": [
        "vendor"
      ]
    }
  },
  "kind": "anchor.page",
  "links": {
    "api": "https://www.anchorterminal.com/api/v1/index.json",
    "html": "https://www.anchorterminal.com/tools/malwaretracker-mcp",
    "json": "https://www.anchorterminal.com/tools/malwaretracker-mcp.json",
    "llms": "https://www.anchorterminal.com/llms.txt",
    "markdown": "https://www.anchorterminal.com/tools/malwaretracker-mcp.md",
    "mcp": "https://www.anchorterminal.com/mcp",
    "slim": "https://www.anchorterminal.com/tools/malwaretracker-mcp.min.md"
  },
  "markdown": "# MalwareTracker Document Malware \u0026 AI Safety Scanner\n\n\u003e Indexed, not reviewed: facts from the official MCP registry and our own checks. No score, grade or rank, and not in the rankings until the panel reviews it. How the index works: https://www.anchorterminal.com/indexed/\n\n- Kind: MCP server, by malwaretracker.com (https://malwaretracker.com/api.html#mcp)\n- Category: Guardrails \u0026 safety filters (https://www.anchorterminal.com/categories/guardrails.md)\n- Listed because: It's published in the registry under malwaretracker.com, a namespace the registry only gives to whoever proves they control that domain.\n- What the official MCP registry says: Scan PDFs, Office docs, and RAG files for malware exploits, macros, CVEs, and AI prompt injection.\n\n## Facts\n\n- MCP registry: `com.malwaretracker/mcp` 2.3.0\n- Endpoint: https://api.malwaretracker.com/mcp (streamable HTTP)\n- Package: pypi `malwaretracker-mcp` (stdio)\n- Source: https://github.com/tylabs/malwaretracker-mcp\n- Website: https://malwaretracker.com/api.html#mcp\n- PyPI downloads a week: 96\n- GitHub stars: 0\n- Registry entry updated: 2026-11-12\n\n## Tools\n\n- Tools it lists (5, about 1,143 tokens of context, `tools/list` without credentials, checked 2026-11-14 03:33 UTC):\n  - `quicksand_scan_document` (read-only): Scan a PDF, Office document (DOC/DOCX/XLS/XLSX/PPT/PPTX/RTF/OneNote), email, archive, URL, or extracted text in under 100ms for embedded malware exploits,…\n  - `quicksand_triage_document` (read-only): Fast Tier-0 SOAR phishing \u0026 attachment triage. Evaluates a document in milliseconds and returns verdict ('clean' | 'suspicious' | 'malicious'),…\n  - `malwaretracker_lookup_hash` (read-only): Look up a previously analyzed document malware \u0026 stream report by MD5, SHA1, SHA256, or SHA512 hash. Does not consume monthly scan quota.\n  - `malwaretracker_list_yara_catalog` (read-only): List or filter MalwareTracker's QuickSand YARA signature catalog, covered CVEs, MITRE ATT\u0026CK techniques, and AI/RAG prompt-injection detection rules. Requires…\n  - `malwaretracker_get_quota` (read-only): Check current MalwareTracker API plan, monthly scan usage, and remaining quota.\n- How its tools read to an agent (0 errors, 0 warnings, 1 note, about 1,143 tokens; rules at https://www.anchorterminal.com/check.md; not part of the score):\n  - note TC24 server: 5 of 5 tools have no outputSchema\n\n- JSON: https://www.anchorterminal.com/api/v1/tools/malwaretracker-mcp.json\n- Being indexed says nothing about quality, and nobody can pay for it. Ask for a review: https://www.anchorterminal.com/builders/#claiming\n",
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "attributionRequired": true,
    "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-11-14",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.8",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run",
    "terms": "https://www.anchorterminal.com/terms/#data"
  },
  "page": {
    "breadcrumbs": [
      {
        "name": "Home",
        "url": "https://www.anchorterminal.com/"
      },
      {
        "name": "Terminal",
        "url": "https://www.anchorterminal.com/tools/"
      },
      {
        "name": "Indexed",
        "url": "https://www.anchorterminal.com/indexed/"
      },
      {
        "name": "MalwareTracker Document Malware \u0026 AI Safety Scanner",
        "url": ""
      }
    ],
    "description": "MalwareTracker Document Malware \u0026 AI Safety Scanner, an MCP server by malwaretracker.com, listed from the official MCP registry. Indexed, not reviewed: facts and our own checks, no score or ranking. Scan PDFs, Office docs, and RAG files for malware exploits, macros, CVEs, and AI…",
    "facts": [
      "not reviewed",
      "not ranked",
      "facts only"
    ],
    "h1": "MalwareTracker Document Malware \u0026 AI Safety Scanner",
    "image": "https://www.anchorterminal.com/assets/og/indexed.png",
    "path": "/tools/malwaretracker-mcp",
    "published": "",
    "section": "indexed",
    "title": "MalwareTracker Document Malware \u0026 AI Safety Scanner | Anchor Terminal",
    "toc": null,
    "updated": "2026-11-14",
    "url": "https://www.anchorterminal.com/tools/malwaretracker-mcp"
  },
  "tokens": {
    "markdown": 800,
    "slim": 730
  },
  "version": 1
}