mlab-sh

Threat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs

CommunityOnlineNo sign-inGlobalFreeRead-only

What it can do

  • Hello World: Returns a greeting with your account information
  • Get Account Info: Returns information about the authenticated user, their organization, and subscription plan
  • Get Scan Limits: Returns the remaining scan quotas for your organization (IP, domain, file, and crypto scans). Limits are per-day and shared across all organization members.

What data it sees

Do you need an account

No: the server works without sign-in

Threat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs

How to connect

How to connect mlab-sh to Claude

The server address to paste into Claude settings:

https://mlab-sh--mlab.run.tools

  1. Open Claude (claude.ai or the desktop app).
  2. Go to Settings → Connectors.
  3. Click Add custom connector.
  4. Paste the server address copied below into Remote MCP server URL and click Add.
  5. In a chat, click + → Connectors and switch the new connector on.

Custom connectors are available on Free, Pro, Max, Team and Enterprise plans (Free is limited to one). On Team and Enterprise an organization Owner adds the connector first under Organization settings → Connectors.

Authorization

After you click Add, a sign-in window for the service opens. Sign in with your own account and approve access. Claude never sees your password.

How to connect mlab-sh to ChatGPT

The server address to paste into ChatGPT settings:

https://mlab-sh--mlab.run.tools

  1. Open ChatGPT in a browser (chatgpt.com). A Plus, Pro, Business, Enterprise or Edu plan is required.
  2. Turn on developer mode once: Settings → Apps → Advanced settings → Developer mode.
  3. Open Settings → Connectors and click Create.
  4. Fill in the form: Name (anything), Description (one line about what the service does), MCP server URL (copy it below).
  5. Under Authentication choose OAuth if the service requires sign-in, otherwise None. Click Create.
  6. In a new chat open + → Apps/Connectors and enable the connector.

OpenAI has renamed this section before (Connectors → Apps/Plugins). If the label differs, search settings for "developer mode". On Business/Enterprise workspaces an admin must allow custom connectors first.

Authorization

On first use ChatGPT opens the service's sign-in window. Sign in and approve access.

How to connect mlab-sh to Cursor

The server address to paste into Cursor settings:

https://mlab-sh--mlab.run.tools

Fastest: click Open in Cursor below and confirm the prompt.

Manually:

  1. In Cursor open Settings → Cursor Settings → MCP and click Add new global MCP server.
  2. Paste the JSON copied below into ~/.cursor/mcp.json (per project: .cursor/mcp.json in the repo root).
  3. Save the file. The server appears in the MCP list; authorize it there if asked.

Authorization

If the service needs sign-in, an authorize button appears next to the server in the MCP list.

Server tool list (25)

Raw names from tools/list. Only developers need these.

hello_worldReturns a greeting with your account information
get_account_infoReturns information about the authenticated user, their organization, and subscription plan
get_scan_limitsReturns the remaining scan quotas for your organization (IP, domain, file, and crypto scans). Limits are per-day and shared across all organization members.
get_scan_historyReturns the recent scan history for your account. Optionally filter by scan type (ip, domain, file) and limit the number of results.
get_bookmarksReturns the saved scan bookmarks for your account (IPs, domains, and file hashes you bookmarked).
scan_ipLook up threat intelligence data for an IP address (IPv4 or IPv6). Returns geolocation, ISP, ASN, and reputation data. Results are cached and refreshed after 30 days.
start_domain_scanStart a domain scan. If a recent completed scan already exists it returns the results immediately. Otherwise it launches the scan and returns {"status": "started"} — you should then call get_domain_scan_results to retrieve results once ready.
get_domain_scan_resultsGet the results of a domain scan started with start_domain_scan. If status is 'pending' or 'scanning', the scan is still running — call this tool again in a few seconds until status is 'completed'. Returns DNS records, subdomains, SSL certificates, security.txt, and robots.txt.
add_bookmarkSave an IP address, domain, or file hash to your bookmarks.
remove_bookmarkRemove an IP address, domain, or file hash from your bookmarks.
detect_iocAuto-detect the type of an indicator of compromise (IOC) and return relevant threat intelligence. Supports: IPv4, IPv6, CIDR ranges, domains, URLs, file hashes (MD5/SHA1/SHA256/SHA512), email addresses, MAC addresses. For IPs it returns geolocation and reputation data. For domains it returns the detected type without scanning (use start_domain_scan for a full scan). For hashes, it identifies the hash type.
scan_cryptoLook up threat intelligence for a blockchain address. Returns labels, sanctions status, risk scoring, and address type. Supports EVM chains (ETH, BSC, Polygon, Arbitrum, etc.), Bitcoin, Tron, Solana, TON, and Dogecoin.
cve_searchSearch CVEs by keyword, product, vendor, or CVE ID. Supports filtering by severity (CRITICAL/HIGH/MEDIUM/LOW) and publication date range. Returns CVSS scores, descriptions, affected products, EPSS scores, and KEV status.
cve_detailRetrieve the full record for a specific CVE by its ID (e.g. CVE-2024-3094). Returns CVSS vector breakdown, affected products, references, CWE weaknesses, EPSS exploitation probability, and CISA KEV status.
get_actorRetrieve the full record for a specific threat actor by its slug (e.g. 'apt28', 'lazarus-group'). Returns the actor profile (description, suspected origin, motivations, targeted countries and sectors, TLP, first seen), known aliases, CVEs exploited by the actor, tools and techniques attributed to it, external references, and bibliography.
actors_by_cveReverse lookup: list every threat actor known to exploit a given CVE. Returns each matching actor's slug, primary name, suspected origin, and the intelligence sources that link them to the vulnerability. Use this for attribution after triaging a CVE (e.g. from cve_detail or cve_search).
search_actorsSearch threat actors by name (free-text, case-insensitive substring match on primary name). Optionally narrow by suspected origin, motivation, or targeted sector. Returns matching actors with slug, primary name, suspected origin, motivations and targeted sectors. Use the returned slug with get_actor to fetch the full profile (including aliases).
scan_emailAnalyze an email address: mailbox type (disposable / role / consumer / standard), and — when the domain has a completed domain scan — its mail spoofability verdict (SPF/DKIM/DMARC), MX presence and domain age. Offline lookup, no scan quota consumed.
scan_phoneAnalyze a phone number (E.164 form, e.g. +33612345678): validity, country/region, line type (mobile/fixed/VoIP...), allocated operator, formatting, and scam-shape findings. Offline numbering-plan lookup, no scan quota consumed.
scan_macAnalyze a MAC address: vendor via OUI, unicast/multicast, universal/local administration, randomized/virtual interface detection, EUI-64 IPv6, and alternate formats. Pure offline lookup, no scan quota consumed.
scan_urlStatically analyze a URL without visiting it: scheme, host (with the Unicode/punycode form the victim actually sees), IP-literal host, credentials-in-URL, dangerous file extensions, known shorteners, and embedded redirect targets to pivot on. Returns phishing/abuse findings. Offline, no scan quota consumed.
scan_hashLook up a file hash (MD5, SHA1 or SHA256) in CIRCL hashlookup (NIST NSRL and other feeds) to tell whether it is a known-good legitimate binary, known-malicious, or unknown. Returns the matched source, product/file name and CIRCL trust score. Offline lookup, no scan quota consumed.
scan_bashStatically analyze a shell script (.sh) supplied inline: computes its sha256, extracts every IOC (URLs, IPs, domains, emails, hashes, wallets), and flags well-known suspicious constructs (download-piped-to-shell, base64 decode, /dev/tcp reverse shells, persistence, anti-forensics, destructive deletes). Nothing is executed or persisted. No scan quota consumed.
smishing_riskScore an SMS / text message for smishing (SMS phishing). Returns a 0-100 risk score, a band (clean/suspect/high/critical), a recommended filter action (allow/quarantine/drop), the weighted reasons behind the score, and the IOCs extracted from the message. `country` selects the keyword/brand pack (default: fr). Offline scorer, no scan quota consumed.
scan_sbomScan a dependency lockfile / SBOM for known vulnerabilities. Paste the raw lockfile content (e.g. Cargo.lock, package-lock.json, requirements.txt, go.sum, composer.lock, Gemfile.lock, or a CycloneDX SBOM) and get back the resolved packages and their OSV/CVE advisories. Parsing and matching happen server-side on vuln.mlab.sh — nothing is installed locally.