Cyberbro MCP Server

A simple application that extracts your IoCs from garbage input and checks their reputation using multiple services.

🌐 demo.cyberbro.net

A Model Context Protocol (MCP) server for Cyberbro that provides a comprehensive interface for extracting and analyzing Indicators of Compromise (IoCs) from unstructured input, and checking their reputation using multiple threat intelligence services.

Checkout Cyberbro repository for more information about the platform.

Overview

This MCP server enables interaction with the Cyberbro platform through the Model Context Protocol. MCP is a standard that allows applications to provide context and functionality to Large Language Models (LLMs) in a secure, standardized way—similar to a web API, but designed for LLM integrations.

MCP servers can:

• Expose data through Resources (to load information into the LLM's context)
• Provide functionality through Tools (to execute code or perform actions)
• Define interaction patterns through Prompts (reusable templates for LLM interactions)

This server implements the Tools functionality of MCP, offering a suite of tools for extracting IoCs from text, analyzing them, and checking their reputation across various threat intelligence sources. It allows AI systems like Claude to retrieve, analyze, and act on threat intelligence in real-time.

Features

• Multi-Service Reputation Checks: Query IPs, domains, hashes, URLs, and Chrome extension IDs across many threat intelligence sources.
• Integrated Reporting: Get detailed, exportable reports and analysis history.
• Platform Integrations: Supports Microsoft Defender for Endpoint, CrowdStrike, OpenCTI, and more.
• Advanced Search & Visualization: Search with Grep.App, check for breaches, and visualize results.

Why Use Cyberbro with LLMs

• LLM-Ready: Designed for seamless use via MCP with Claude or other LLMs—no manual UI needed.
• Beginner-Friendly: Simple, accessible, and easy to deploy.
• Unique Capabilities: Chrome extension ID lookups, advanced TLD handling, and pragmatic intelligence gathering.
• Comprehensive CTI Access: Leverages multiple sources and integrates CTI reports for enriched context.

Installation

Option 1: Using Docker (Recommended)

1. Export your Cyberbro config as an environment variable:

    export CYBERBRO_URL=http://localhost:5000
   

2. Pull the Docker image from GitHub Container Registry (careful, you must be logged in):

   docker pull ghcr.io/stanfrbd/mcp-cyberbro:latest
   

Option 2: Local Installation

1. Clone this repository:

   git clone https://github.com/stanfrbd/mcp-cyberbro.git
   cd mcp-cyberbro
   

2. Install the required dependencies:

   uv run pip install -r requirements.txt
   

3. Set environment variables for MCP configuration or provide them as CLI arguments:

   Option A: Using environment variables

   export CYBERBRO_URL=http://localhost:5000
   

   Option B: Using CLI arguments

   uv run mcp-cyberbro-server.py --cyberbro_url http://localhost:5000
   

4. Start the MCP server:

   uv run mcp-cyberbro-server.py # env variables already set
   

   The server will listen for MCP protocol messages on stdin/stdout and use the environment variables as shown in the Claude Desktop configuration example.

Optional environment variables

• SSL_VERIFY: Set to false to disable SSL verification for the Cyberbro URL. This is useful for self-signed certificates or local testing.
• API_PREFIX: Set to a custom prefix for the Cyberbro API. This is useful if you have a custom API prefix in your Cyberbro instance.

Optional arguments

• --no_ssl_verify: Disable SSL verification for the Cyberbro URL. This is useful for self-signed certificates or local testing.
• --api_prefix: Set a custom prefix for the Cyberbro API. This is useful if you have a custom API prefix in your Cyberbro instance.

Usage

Using with Claude Desktop (Docker) - Recommended

[!NOTE] In this configuration, make sure Docker is installed and running on your machine (e.g., Docker Desktop).

To use this MCP server with Claude Desktop, add the following to your Claude Desktop config file (claude_desktop_config.json):

"mcpServers": {
  "cyberbro": {
    "command": "docker",
    "args": [
      "run",
      "-i",
      "--rm",
      "-e",
      "CYBERBRO_URL",
      "-