For malware analysis, REMnux is the primary toolkit: a curated Linux distribution of community tools for reverse-engineering and analyzing malicious software, usable hands-on or via its MCP server 1. Complementary options include ContrastAPI for hash and threat-intel lookups against MalwareBazaar and URLhaus 313, Google Threat Intelligence and VirusTotal for file analysis and malware family search 414, and Trail of Bits' Ghidra-based reverse-engineering skills 616.
- 1
- 2
ContrastAPIcontrastcyber.comverified and signed
Queries MalwareBazaar for a file hash to return malware family, file type, and first/last seen data, and checks domains against abuse.ch URLhaus for malware-distribution URLs 13.
official:MCP server · ContrastAPI
for agents: hash_lookup · threat_intel · Threat Intel
- 3
Google Threat Intelligencegoogle.comfound in code, not yet checked
Uploads and analyses files in VirusTotal and searches malware families and software toolkits in the Google Threat Intelligence platform 14.
official:MCP server · mcp-securityskill · gke-platform-securityskill · gke-securityskill · gke-workload-security
for agents: analyse_file · search_software_toolkits · search_malware_families
- 4
- 5
Malwagonmalwagon.comwebsite read, tools not yet checked
A malware analysis sandbox where files, hashes or commands are detonated in a VM and analysed from the hypervisor layer, with an API for automated submissions.
official:MCP server · Malwagon
Sources
- 1REMnux: A Linux Toolkit for Malware Analysis | REMnux Documentationdocs.remnux.org · read 2026-10-29
- 2Malware Analysis Sandbox at the Hypervisor Layer | Malwagonmalwagon.com · read 2026-10-29
- 3ContrastAPI — Security Intelligence APIapi.contrastcyber.com · read 2026-10-29
- 4AI and Cloud Computing Services | Google Cloudcloud.google.com · read 2026-10-29
- 6Trail of Bits: Security Research, Audits, and Toolstrailofbits.com · read 2026-10-29
- 13ContrastAPI: declares "hash_lookup" (the record we read and signed)unfragile.ai · read 2026-10-24
- 14mcp-security: declares "analyse_file" (the record we read)github.com · read 2026-10-24
- 16trailmark: declares "trailmark" (the record we read and signed)unfragile.ai · read 2026-10-24
For agents: the 10 actions behind this answer
· REMnux Documentation website read, tools not yet checked
REMnux Documentation
· Malwagon website read, tools not yet checked
Automated malware analysis sandbox. A file, hash or command detonates in a VM we run, with memory and kernel state read from outside. 3 free scans a day.
hash_lookup · ContrastAPI verified and signed
Query MalwareBazaar for file hash (MD5/SHA1/SHA256): malware family, file type, size, tags, first/last seen, download count. Use to check if file hash is known malware; use ioc_lookup for auto-detection of all IOC types. Companion malware-investigation tools: ioc_lookup (multi-source: ThreatFox + Fe
analyse_file · mcp-security found in code, not yet checked
Upload and analyse the file in VirusTotal.
· ScanMalware website read, tools not yet checked
Scan any URL for free. We inspect its scripts, network activity and content, and an AI verdict tells you if it's malware, phishing or a scam.
trailmark · trailmark verified and signed
Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, structural traversal, graph diffs, audit aug
ghidra · ghidra verified and signed
Reverse engineer binaries using Ghidra's headless analyzer. Decompile executables, extract functions, strings, symbols, and analyze call graphs without GUI.
· Joern website read, tools not yet checked
· Rizin website read, tools not yet checked
Rizin is a free and Open Source Reverse Engineering Framework
· ClamAVNet website read, tools not yet checked
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.