Cyberbro MCP Server

io.github.stanfrbdPublished by GitHub account stanfrbdv0.0.6Updated Oct 24, 2026

MCP server for Cyberbro IOC extraction, enrichment and reputation analysis.

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

MCP server that lets an assistant submit indicators of compromise to a Cyberbro instance and read back enrichment and reputation results.

What you can do
  • Submit observables such as IPs, domains, URLs and hashes for analysis through Cyberbro engines
  • Check whether a submitted analysis has finished
  • Retrieve the analysis results for an observable
  • List the available Cyberbro engines
  • Get a web URL for viewing the analysis
When to use it
Useful when you already run a Cyberbro instance and want threat-intelligence lookups, IOC triage or OSINT-style investigation of suspicious domains, IPs, URLs and file hashes from inside an MCP-capable assistant.
Requirements
Runs locally as a Python package (uvx or pip install mcp-cyberbro), or as a Docker image. Requires a reachable Cyberbro instance, set via the required CYBERBRO_URL variable; API_PREFIX, SSL_VERIFY and MCP transport/host/port/path variables are optional. No authentication is declared.
Before you install
Observables you submit are sent to the configured Cyberbro instance and on to whichever engines it queries, so avoid pasting sensitive internal addresses or confidential data. Setting SSL_VERIFY to false disables certificate checks for Cyberbro API calls. Analysis requests consume the Cyberbro instance's engine quota.

Installation

In SourceWeft

  1. Open Cyberbro MCP Server in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[MseeP.ai Security Assessment Badge]

Cyberbro MCP Server

[Image]
Extract IoCs from messy text and analyze them with Cyberbro.
🌐 demo.cyberbro.net

[mcp-cyberbro-demo]

Model Context Protocol server for Cyberbro.

This project is packaged as a standard Python distribution and can be launched with:

  • uvx mcp-cyberbro
  • pip install mcp-cyberbro then mcp-cyberbro

Why this server

  • Analyze observables (IP, domain, URL, hash, etc.) via Cyberbro engines.
  • Integrate threat-analysis actions directly in MCP-capable assistants.
  • Run with stdio, sse, or streamable-http transports.
  • Compatible with any MCP client that supports one of these transports.

Installation

Use with uvx (standalone)

bash
uvx mcp-cyberbro --cyberbro_url http://localhost:5000

Use with pip

bash
pip install mcp-cyberbromcp-cyberbro --cyberbro_url http://localhost:5000

Local development

bash
pip install -e .mcp-cyberbro --cyberbro_url http://localhost:5000

Docker

Default container command starts in streamable-http mode on port 8000.

bash
docker run --rm -p 8000:8000 \  -e CYBERBRO_URL=http://host.docker.internal:5000 \  ghcr.io/stanfrbd/mcp-cyberbro:latest

To run in stdio mode, a custom Dockerfile is required:

dockerfile
FROM ghcr.io/stanfrbd/mcp-cyberbro:latestCMD ["mcp-cyberbro", "--transport", "stdio"]

Build and use it:

bash
docker build -t mcp-cyberbro-stdio .docker run -i --rm -e CYBERBRO_URL=http://host.docker.internal:5000 mcp-cyberbro-stdio

Configuration

Copy .env.example and set at least:

  • CYBERBRO_URL (required)

Supported environment variables:

  • CYBERBRO_URL
  • API_PREFIX (default: api)
  • SSL_VERIFY (true/false)
  • MCP_TRANSPORT (stdio, sse, streamable-http)
  • MCP_HOST
  • MCP_PORT
  • MCP_MOUNT_PATH
  • MCP_SSE_PATH
  • MCP_STREAMABLE_HTTP_PATH

CLI flags are also available and override env values.

MCP Client Integration

You can use this server with Claude Desktop, Claude Code, Cursor, OpenAI-compatible MCP clients, or any other MCP client.

Example config using uvx:

json
{  "mcpServers": {    "cyberbro": {      "command": "uvx",      "args": ["mcp-cyberbro"],      "env": {        "CYBERBRO_URL": "http://localhost:5000"      }    }  }}

To use Docker with stdio transport (required by some MCP clients), build a custom image as shown in the Docker section above, then reference it:

json
{  "mcpServers": {    "cyberbro": {      "command": "docker",      "args": ["run", "-i", "--rm", "-e", "CYBERBRO_URL", "mcp-cyberbro-stdio"],      "env": {        "CYBERBRO_URL": "http://localhost:5000"      }    }  }}

Usage in VSCode - Example

Create .vscode/mcp.json

json
{	"servers": {		"mcp-cyberbro": {			"type": "stdio",			"command": "uvx",			"args": [				"mcp-cyberbro"			],			"env": {				"CYBERBRO_URL": "http://127.0.0.1:5000"			}		}	}}

MCP Registry Metadata

server.json is included for MCP Registry publication and points to PyPI package mcp-cyberbro.

Release Pipelines

Release-created workflows:

  • .github/workflows/publish-test-pypi.yml
  • .github/workflows/publish-pypi.yml
  • .github/workflows/publish-mcp-plugin.yml

Available Tools

  • analyze_observable
  • is_analysis_complete
  • get_analysis_results
  • get_engines
  • get_web_url

Example Prompts

Here are practical prompt examples you can use with any MCP-capable assistant connected to Cyberbro.

Getting Indicator Details

  • Cyberbro: Check indicators for target.com
  • Can you check this IP reputation with Cyberbro? 192.168.1.1. Use github, google and virustotal engines.
  • I want to analyze the domain example.com. What can Cyberbro tell me about it? Use max 3 engines.
  • Analyze these observables with Cyberbro: suspicious-domain.com, 8.8.8.8, and 44d88612fea8a8f36de82e1278abb02f. Use all available engines.

Observable Analysis

  • I found this (hash|domain|url|ip|extension). Can you submit it for analysis to Cyberbro and analyze the results?

OSINT Investigation

  • Create an OSINT report for the domain example.com using Cyberbro. Use all available engines and pivot on the results for more information. Use a maximum of 10 analysis requests.

Acknowledgements

License

MIT

Source: README.md at commit 1e2676d

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.0.6LatestOct 18, 2026
  2. v0.0.5Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts