{
  "markdown": "# mlab.sh MCP server\n\nPublic metadata and connection guide for the remote MCP server at `https://mlab.sh/mcp`, a threat intelligence server for SOC and DFIR work.\n\nThis repo is the registry listing and the documentation. It is not the server source: the server runs inside the mlab.sh backend and is closed source.\n\n## Connect\n\nEndpoint: `https://mlab.sh/mcp` (Streamable HTTP via POST, SSE via GET).\n\n### Claude.ai\n\nSettings > Connectors > Add custom connector, then paste the URL. OAuth runs in the browser, no token to copy.\n\n```\nhttps://mlab.sh/mcp\n```\n\n### Claude Desktop\n\n`claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"mlab\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"mcp-remote\",\n        \"https://mlab.sh/mcp\",\n        \"--header\",\n        \"Authorization: Bearer mcp_xxx\"\n      ]\n    }\n  }\n}\n```\n\nDrop the `--header` pair to use OAuth instead of a static token.\n\n### Cursor\n\n`~/.cursor/mcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"mlab\": {\n      \"url\": \"https://mlab.sh/mcp\",\n      \"headers\": {\n        \"Authorization\": \"Bearer mcp_xxx\"\n      }\n    }\n  }\n}\n```\n\n### VS Code\n\n`.vscode/mcp.json`:\n\n```json\n{\n  \"servers\": {\n    \"mlab\": {\n      \"type\": \"http\",\n      \"url\": \"https://mlab.sh/mcp\",\n      \"headers\": {\n        \"Authorization\": \"Bearer mcp_xxx\"\n      }\n    }\n  }\n}\n```\n\n### curl\n\n```bash\ncurl -sS -X POST https://mlab.sh/mcp \\\n  -H \"Authorization: Bearer mcp_xxx\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Accept: application/json, text/event-stream\" \\\n  -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"curl\",\"version\":\"1.0.0\"}}}'\n```\n\nReady to paste versions of these four configs live in [`examples/`](examples).\n\nOfficially supported clients are Claude.ai and Claude Desktop. Other MCP clients (Cursor, VS Code, Windsurf and friends) work but are best effort.\n\n## Tools\n\n### IOC enrichment\n\n| Tool | Purpose |\n| --- | --- |\n| `detect_ioc` | Auto detect the IOC type of a value and return relevant threat intel |\n| `scan_ip` | Threat intel for an IPv4 or IPv6 address |\n| `scan_url` | Static analysis of a URL without visiting it |\n| `scan_hash` | File hash lookup (MD5, SHA1, SHA256) in CIRCL hashlookup |\n| `scan_crypto` | Threat intel for a blockchain address: labels, sanctions, risk score, 18 chains |\n| `scan_email` | Offline style analysis of an email address |\n| `scan_phone` | Offline style analysis of a phone number |\n| `scan_mac` | Offline style analysis of a MAC address |\n| `smishing_risk` | Score an SMS for smishing |\n\n### Vulnerabilities and actors\n\n| Tool | Purpose |\n| --- | --- |\n| `cve_search` | Search CVEs |\n| `cve_detail` | Full CVE record |\n| `actors_by_cve` | Threat actors known to exploit a CVE |\n| `search_actors` | Search threat actors |\n| `get_actor` | Full threat actor profile |\n\n### Scanning\n\n| Tool | Purpose |\n| --- | --- |\n| `start_domain_scan` | Launch a domain scan: DNS, subdomains, SSL, security.txt, robots.txt |\n| `get_domain_scan_results` | Poll the results of a domain scan |\n| `scan_bash` | Static analysis of an inline shell script |\n| `scan_sbom` | Scan a dependency lockfile or SBOM for known CVEs |\n\n### Account\n\n| Tool | Purpose |\n| --- | --- |\n| `get_scan_history` | Past scans for the account |\n| `get_scan_limits` | Current quotas and remaining scans |\n| `get_account_info` | Account details |\n| `add_bookmark` | Bookmark an IOC |\n| `remove_bookmark` | Remove a bookmarked IOC |\n| `get_bookmarks` | List bookmarked IOCs |\n| `hello_world` | Connectivity check |\n\n## Authentication\n\nOAuth 2.1 is the recommended path: authorization code with PKCE S256, dynamic client registration, CIMD supported. The server advertises its metadata at `https://mlab.sh/.well-known/oauth-authorization-server`, so a compliant client only needs the endpoint URL.\n\nIf your client does not speak OAuth, create a static token in Account > Settings > MCP Tokens and send it as `Authorization: Bearer mcp_xxx`.\n\nFull details: https://doc.mlab.sh/docs/mlab.sh/integrations/mcp\n\n## Rate limits and quotas\n\nLimits follow your mlab.sh account plan. Call `get_scan_limits` to read the quotas and remaining budget that apply to your account.\n\n## Registry\n\nPublished to the official MCP Registry as `sh.mlab/mcp`.\n\nhttps://registry.modelcontextprotocol.io/v0.1/servers?search=sh.mlab\n\n## Other public servers\n\n`https://news.mlab.sh/mcp` is a separate, unauthenticated, read only MCP server exposing a cyber news index. It is not published from this repo.\n\n## Security\n\nReport vulnerabilities to security@mlab.sh. See https://mlab.sh/security.txt and [SECURITY.md](SECURITY.md).\n\n## License\n\nMIT, see [LICENSE](LICENSE).\n",
  "bytes": 4688,
  "sha": "3143ae2cc681f94024b9253e4c07a660de1fb999f8e1b5b1d9c65bb05c639f6d",
  "repo_slug": "mlab-sh/mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_sh_mlab_mcp_dfdddeff/readme"
}