dyussekeyev/jumal-mcp
AI-powered malware static analysis orchestrator using Model Context Protocol (MCP). Automates file triage, PE analysis, YARA scanning, string extraction, and VirusTotal enrichment through an isolated Docker worker.
Platform-specific configuration:
{
"mcpServers": {
"jumal-mcp": {
"command": "npx",
"args": [
"-y",
"jumal-mcp"
]
}
}
}Add the config above to .claude/settings.json under the mcpServers key.
An MCP (Model Context Protocol) server for automated basic static malware analysis. It exposes analysis capabilities to LLM clients (e.g. Claude Desktop) while keeping all file processing isolated inside a Docker container.
┌─────────────────────────────┐ ┌──────────────────────────────────┐
│ Host Machine │ │ Docker Container │
│ │ │ │
│ LLM Client (Claude etc.) │ │ Analysis Worker (FastAPI) │
│ │ stdio │ │ │
│ ▼ │ HTTP │ POST /api/v1/triage │
│ bridge/bridge.py ────────┼───────►│ POST /api/v1/pe-info │
│ (FastMCP server) │ │ POST /api/v1/yara │
│ │ │ POST /api/v1/strings │
└─────────────────────────────┘ │ │
│ Reads from /samples (read-only) │
│ Reads from /rules (read-only) │
└──────────────────────────────────┘check_virustotal toolgit clone https://github.com/dyussekeyev/jumal-mcp.git
cd jumal-mcpmkdir -p malware_samples yara_rules
# Place malware samples in malware_samples/
# Place YARA rule files (*.yar or *.yara) in yara_rules/docker compose up -dLoading reviews...