mlab-sh

Name: mlab-sh
Author: mlab

Threat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs

От сообществаРаботаетБез входаГлобальныйБесплатноТолько чтение

Что умеет

Hello World: Returns a greeting with your account information
Get Account Info: Returns information about the authenticated user, their organization, and subscription plan
Get Scan Limits: Returns the remaining scan quotas for your organization (IP, domain, file, and crypto scans). Limits are per-day and shared across all organization members.

Какие данные видит

Нужен ли аккаунт

Не нужен: сервер работает без входа

Threat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs

Список инструментов сервера (25)

Технические названия из tools/list. Нужны только разработчикам.

hello_world	Returns a greeting with your account information
get_account_info	Returns information about the authenticated user, their organization, and subscription plan
get_scan_limits	Returns the remaining scan quotas for your organization (IP, domain, file, and crypto scans). Limits are per-day and shared across all organization members.
get_scan_history	Returns the recent scan history for your account. Optionally filter by scan type (ip, domain, file) and limit the number of results.
get_bookmarks	Returns the saved scan bookmarks for your account (IPs, domains, and file hashes you bookmarked).
scan_ip	Look up threat intelligence data for an IP address (IPv4 or IPv6). Returns geolocation, ISP, ASN, and reputation data. Results are cached and refreshed after 30 days.
start_domain_scan	Start a domain scan. If a recent completed scan already exists it returns the results immediately. Otherwise it launches the scan and returns {"status": "started"} — you should then call get_domain_scan_results to retrieve results once ready.
get_domain_scan_results	Get the results of a domain scan started with start_domain_scan. If status is 'pending' or 'scanning', the scan is still running — call this tool again in a few seconds until status is 'completed'. Returns DNS records, subdomains, SSL certificates, security.txt, and robots.txt.
add_bookmark	Save an IP address, domain, or file hash to your bookmarks.
remove_bookmark	Remove an IP address, domain, or file hash from your bookmarks.
detect_ioc	Auto-detect the type of an indicator of compromise (IOC) and return relevant threat intelligence. Supports: IPv4, IPv6, CIDR ranges, domains, URLs, file hashes (MD5/SHA1/SHA256/SHA512), email addresses, MAC addresses. For IPs it returns geolocation and reputation data. For domains it returns the detected type without scanning (use start_domain_scan for a full scan). For hashes, it identifies the hash type.
scan_crypto	Look up threat intelligence for a blockchain address. Returns labels, sanctions status, risk scoring, and address type. Supports EVM chains (ETH, BSC, Polygon, Arbitrum, etc.), Bitcoin, Tron, Solana, TON, and Dogecoin.
cve_search	Search CVEs by keyword, product, vendor, or CVE ID. Supports filtering by severity (CRITICAL/HIGH/MEDIUM/LOW) and publication date range. Returns CVSS scores, descriptions, affected products, EPSS scores, and KEV status.
cve_detail	Retrieve the full record for a specific CVE by its ID (e.g. CVE-2024-3094). Returns CVSS vector breakdown, affected products, references, CWE weaknesses, EPSS exploitation probability, and CISA KEV status.
get_actor	Retrieve the full record for a specific threat actor by its slug (e.g. 'apt28', 'lazarus-group'). Returns the actor profile (description, suspected origin, motivations, targeted countries and sectors, TLP, first seen), known aliases, CVEs exploited by the actor, tools and techniques attributed to it, external references, and bibliography.
actors_by_cve	Reverse lookup: list every threat actor known to exploit a given CVE. Returns each matching actor's slug, primary name, suspected origin, and the intelligence sources that link them to the vulnerability. Use this for attribution after triaging a CVE (e.g. from cve_detail or cve_search).
search_actors	Search threat actors by name (free-text, case-insensitive substring match on primary name). Optionally narrow by suspected origin, motivation, or targeted sector. Returns matching actors with slug, primary name, suspected origin, motivations and targeted sectors. Use the returned slug with get_actor to fetch the full profile (including aliases).
scan_email	Analyze an email address: mailbox type (disposable / role / consumer / standard), and — when the domain has a completed domain scan — its mail spoofability verdict (SPF/DKIM/DMARC), MX presence and domain age. Offline lookup, no scan quota consumed.
scan_phone	Analyze a phone number (E.164 form, e.g. +33612345678): validity, country/region, line type (mobile/fixed/VoIP...), allocated operator, formatting, and scam-shape findings. Offline numbering-plan lookup, no scan quota consumed.
scan_mac	Analyze a MAC address: vendor via OUI, unicast/multicast, universal/local administration, randomized/virtual interface detection, EUI-64 IPv6, and alternate formats. Pure offline lookup, no scan quota consumed.
scan_url	Statically analyze a URL without visiting it: scheme, host (with the Unicode/punycode form the victim actually sees), IP-literal host, credentials-in-URL, dangerous file extensions, known shorteners, and embedded redirect targets to pivot on. Returns phishing/abuse findings. Offline, no scan quota consumed.
scan_hash	Look up a file hash (MD5, SHA1 or SHA256) in CIRCL hashlookup (NIST NSRL and other feeds) to tell whether it is a known-good legitimate binary, known-malicious, or unknown. Returns the matched source, product/file name and CIRCL trust score. Offline lookup, no scan quota consumed.
scan_bash	Statically analyze a shell script (.sh) supplied inline: computes its sha256, extracts every IOC (URLs, IPs, domains, emails, hashes, wallets), and flags well-known suspicious constructs (download-piped-to-shell, base64 decode, /dev/tcp reverse shells, persistence, anti-forensics, destructive deletes). Nothing is executed or persisted. No scan quota consumed.
smishing_risk	Score an SMS / text message for smishing (SMS phishing). Returns a 0-100 risk score, a band (clean/suspect/high/critical), a recommended filter action (allow/quarantine/drop), the weighted reasons behind the score, and the IOCs extracted from the message. `country` selects the keyword/brand pack (default: fr). Offline scorer, no scan quota consumed.
scan_sbom	Scan a dependency lockfile / SBOM for known vulnerabilities. Paste the raw lockfile content (e.g. Cargo.lock, package-lock.json, requirements.txt, go.sum, composer.lock, Gemfile.lock, or a CycloneDX SBOM) and get back the resolved packages and their OSV/CVE advisories. Parsing and matching happen server-side on vuln.mlab.sh — nothing is installed locally.