Malwagon

com.malwagonPublished by malwagon.comOfficial publisherv1.1.0Updated Oct 24, 2026

Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Malwagon is a remote malware-analysis service that lets an assistant submit hashes, URLs, commands or packages for sandbox scanning, poll results and read scan,

What you can do
Look up existing scans by SHA-256 hash and see your own and publicly shared analyses of those bytes. Retrieve a scan's derived report with verdict, capabilities, behaviour summary, observed operations and defanged indicators. Search scans by exact indicator such as IP, domain, URL, mutex, registry key, hash or JA3/JA4 fingerprint. Queue a new analysis of a hash, URL, command or package and poll its status until a report is available.
When to use it
Useful when triaging suspicious files, links, commands or packages and you want an assistant to check prior analyses, pull a verdict and indicators, or start a new sandbox scan and follow it to completion.
Requirements
A remote streamable HTTP endpoint at malwagon.com; no local runtime or package. Requires a Malwagon API key issued in the console, sent as a bearer token in the Authorization header. Network access to the service.
Before you install
The API key in the Authorization header is a secret and grants access to the account's scans. submit_scan spends the account's own credits and is subject to plan limits, so avoid triggering scans unintentionally. Submitting a URL, command or package sends that target to a third-party service. File upload is not possible over MCP.

Installation

In SourceWeft

  1. Open Malwagon in the dashboard and add it to a workspace.
  2. Connect Authorization token credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.malwagon%2Fmalwagon/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "malwagon": {
      "type": "http",
      "url": "https://malwagon.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

Tools

5

lookup_hash

Look up a SHA-256

Find analyses of a known SHA-256 digest. Returns the caller's own scans of those bytes plus any publicly shared scan of them. Sends nothing anywhere: this searches scans that already exist on this platform. Answers with an empty list when the hash is unknown or not visible to this token, without distinguishing the two.

Parameterssha256required

get_report

Read an analysis report

The derived analysis report for one scan: verdict, capabilities, behaviour summary, observed operations and defanged indicators. Derived data only - it never contains the sample's bytes, its decompiled source, a download link or an artifact reference. Every list in the result reports what was returned, counted and truncated. Answers 'not found' for a scan that does not exist and for one this token may not read, identically.

Parametersscan_idrequired

search_indicator

Search for an indicator

Find scans where an indicator was observed: an IP, a domain, a URL, a mutex, a registry key, a hash or a JA3/JA4 fingerprint. The indicator is matched exactly; defanged input such as 'evil[.]com' is refanged first. Only scans this token may read are searched.

Parameterstypeindicatorrequired

poll_scan

Poll a scan's progress

The current status of one scan, for polling after submit_scan. Cheap enough to call in a loop. 'terminal' means the scan will not change again; 'report_available' means get_report will return a full report. Answers 'not found' for an unknown scan and an unreadable one identically.

Parametersscan_idrequired

submit_scan

Submit a scan

Queue a new analysis of a target that can be named as text: a SHA-256 to look up, a URL to visit, a command to run, or a package to install. Uploading a file or a document is not possible over MCP. This spends the account's own credits and is subject to its plan limits. Poll the returned scan_id with poll_scan, then read it with get_report.

Parametersmodulerequiredtargetrequiredprivate

Version history

1
  1. v1.1.0LatestSep 16, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.