mlab.sh

sh.mlab由 mlab.sh 發布官方發布者v1.2.0更新於 Nov 6, 2026

Threat intel and DFIR: IOCs, CVEs, actors, SBOMs, domain scans, cases, memory, Kubernetes, Proxmox.

已驗證Streamable HTTP可網頁執行資料庫雲端與基礎設施安全與監控

概覽

AI 產生的概覽

遠端威脅情報與數位鑑識伺服器，讓助理查詢 IOC、CVE 與威脅行為者，掃描網域與 SBOM，並存取 SOC 案件和受監控工作區。

可以做什麼
  • 辨識並補充指標資訊：判斷 IOC 類型，掃描 IP 與 CIDR 網段、URL、雜湊、加密貨幣地址、電子郵件、電話號碼與 MAC 位址
  • 掃描網域的 DNS、子網域、憑證與 security.txt，並對 shell 指令碼和鎖定檔或 SBOM 做靜態分析以找出漏洞
  • 檢索 CVE 的 CVSS、EPSS 與 KEV 資訊，查詢威脅行為者及其 MITRE ATT&CK 技術
  • 讀寫 SOC 案件：列出與建立案件、登錄指標、新增評論
  • 檢視受監控工作區：記憶體鑑識傾印、Kubernetes 叢集與 Proxmox VE 虛擬機，包含執行期事件與 YARA 掃描
  • 查看帳戶方案、剩餘配額、掃描歷史與書籤
適用情境
適合 SOC 分析師、事件應變人員與資安工程師，讓助理不必切換工具就能研判指標、核查 CVE 與相依套件漏洞，或從案件與受監控基礎設施取得背景資訊。若只需要一般網頁搜尋或程式開發協助，則幫助不大。
執行需求
遠端 Streamable HTTP 端點 mlab.sh/mcp，不需在本機安裝套件。建議使用 OAuth 2.1 登入，不必複製權杖；否則需在帳戶設定建立靜態 MCP 權杖，並透過 Authorization 標頭以 Bearer 方式送出。案件與工作區功能需要付費方案，配額以組織為單位計算。
安裝前請注意
權杖屬於個人憑證，會以你在組織中的角色行事，應妥善保管並設定有效期限。掃描 IP、網域、加密貨幣地址與檔案會消耗組織共用配額，新啟動的網域掃描會主動連線目標。案件工具會建立與修改資料。工作區回傳的資料來自主機，可能夾帶攻擊者植入的文字，且回答會送往你的大型語言模型供應商。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 mlab.sh，將其新增到工作區。
  2. 連接 所需的 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
  3. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/sh.mlab%2Fmcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。 客戶端會在首次連接時完成 OAuth 登入。

{
  "mcpServers": {
    "mlab-sh": {
      "type": "http",
      "url": "https://mlab.sh/mcp"
    }
  }
}

README

mlab.sh MCP server

Public metadata and connection guide for the remote MCP server at https://mlab.sh/mcp, a threat intelligence server for SOC and DFIR work.

This repo is the registry listing and the documentation. It is not the server source: the server runs inside the mlab.sh backend and is closed source.

Connect

Endpoint: https://mlab.sh/mcp (Streamable HTTP via POST, SSE via GET).

Claude.ai

Settings > Connectors > Add custom connector, then paste the URL. OAuth runs in the browser, no token to copy.

https://mlab.sh/mcp

Claude Desktop

claude_desktop_config.json:

json
{  "mcpServers": {    "mlab": {      "command": "npx",      "args": [        "-y",        "mcp-remote",        "https://mlab.sh/mcp",        "--header",        "Authorization: Bearer mcp_xxx"      ]    }  }}

Drop the --header pair to use OAuth instead of a static token.

Cursor

~/.cursor/mcp.json:

json
{  "mcpServers": {    "mlab": {      "url": "https://mlab.sh/mcp",      "headers": {        "Authorization": "Bearer mcp_xxx"      }    }  }}

VS Code

.vscode/mcp.json:

json
{  "servers": {    "mlab": {      "type": "http",      "url": "https://mlab.sh/mcp",      "headers": {        "Authorization": "Bearer mcp_xxx"      }    }  }}

curl

bash
curl -sS -X POST https://mlab.sh/mcp \  -H "Authorization: Bearer mcp_xxx" \  -H "Content-Type: application/json" \  -H "Accept: application/json, text/event-stream" \  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0.0"}}}'

Ready to paste versions of these four configs live in examples/.

Officially supported clients are Claude.ai and Claude Desktop. Other MCP clients (Cursor, VS Code, Windsurf and friends) work but are best effort.

Tools

48 tools. tools/list only shows a token the tools its role and plan can use, so a client never sees a tool that would refuse every call. Every tool carries MCP annotations (read only, destructive, idempotent, open world), so a host can tell what it may run unattended. No tool deletes anything.

Parameters marked ? are optional.

Who can use what

GroupPlanRole
IOC lookups, domain scans, scan_bash, scan_sbomAnyOwner, admin, member (viewers cannot spend quota)
CVEs, actors, account, bookmarks, historyAnyAny, viewer included
Cases: reading (list_cases, get_case)Team, EnterpriseAny, viewer included
Cases: writing (create_case, add_case_indicators, add_case_comment)Team, EnterpriseOwner, admin, member
WorkspacesTeam (1 workspace), Enterprise (up to 20)Any; members only see the workspaces they were added to, owners and admins see all

Quotas are counted per organization over a rolling 24 hour window. get_scan_limits reads what is left.

IOC lookups

ToolParametersWhat it returns
detect_iocvalueDetects the type of an indicator (IPv4, IPv6, CIDR, domain, URL, MD5/SHA1/SHA256/SHA512 hash, email, MAC) and returns the relevant intel. A domain is typed, not scanned: use start_domain_scan for that. An IP spends IP quota
scan_ipipFor an address: geolocation, ISP, ASN, datacenter / proxy / VPN / mobile network, TOR consensus status, forward confirmed reverse DNS, RDAP record with the abuse contact. For a CIDR range: network, broadcast, host window, netmask, size, reserved blocks. Addresses spend IP quota (cached 7 days); ranges are free
scan_urlurl, resolve?Static analysis without visiting: scheme, host with its Unicode and punycode forms, IP literal hosts, credentials in the URL, dangerous extensions, shorteners, embedded redirect targets, and what a past domain scan recorded about the host. resolve follows the link to its real destination, the only part that visits anything. No quota
scan_hashhashMD5, SHA1 or SHA256 against CIRCL hashlookup (NIST NSRL): known good, known malicious or unknown, each feed's own answer, malware family, product and file name, CIRCL trust score, and mlab_sample when mlab analysed the file itself. unknown is not the same as safe. No quota
scan_cryptoaddress, chain?Labels, sanctions, risk score and address type across 18 chains (Bitcoin, Ethereum and 12 other EVM chains, Tron, Solana, TON, Dogecoin), with a checksum check. EVM addresses do not reveal their chain: pass chain when you know it. Spends crypto quota
scan_emailemailMailbox type (disposable, role, consumer, standard), SPF / DKIM / DMARC spoofability of its domain, MX presence, domain age when scanned, and a 0 to 100 score with its weighted reasons. No quota
scan_phonenumberE.164 number: validity, country, line type, allocated operator, formatting and scam shaped findings. Offline, no quota
scan_macmacOUI vendor, unicast or multicast, universal or local administration, randomized or virtual interface, EUI-64 IPv6, other formats. Offline, no quota

Domain scans and code

ToolParametersWhat it returns
start_domain_scandomainReturns a recent completed scan right away, or launches a new one and returns {"status": "started"}. A new scan contacts the target and spends domain scan quota
get_domain_scan_resultsdomainResults of a domain scan: DNS records, subdomains, SSL certificates, security.txt, robots.txt. Call again while the status is pending or scanning
scan_bashcontent, filename?Static analysis of an inline shell script: sha256, every IOC it holds, and well known suspicious constructs (download piped to a shell, base64 decoding, /dev/tcp reverse shells, persistence, anti forensics, destructive deletes). Nothing runs or is stored. No quota
scan_sbomcontent, format?Known vulnerabilities in a lockfile or SBOM (npm, yarn, pnpm, Cargo, pip, Poetry, uv, PDM, Pipfile, Composer, Gem, Go, Maven, Gradle, NuGet, pub, Hex, mise, CycloneDX, SPDX), one finding per package and CVE, worst first, with the fixed version and what the scan could not cover. Matched server side on vuln.mlab.sh (OSV, NVD for CPE only components). 2 MB at most; format defaults to auto

CVEs and threat actors

ToolParametersWhat it returns
cve_searchquery, severity?, date_start?, date_end?, limit?, page?CVEs by keyword, product, vendor or ID, filtered by severity (CRITICAL, HIGH, MEDIUM, LOW) and publication date, with CVSS, EPSS and KEV status
cve_detailcve_idThe full record: CVSS vector breakdown, affected products, references, CWEs, EPSS, CISA KEV status
search_actorsquery, origin?, motivation?, sector?, limit?Threat actors by name or alias from the MISP Galaxy cluster (CC0), narrowed by origin, incident type or targeted sector. Returns the slug for get_actor
get_actorslugMISP Galaxy profile (origin, suspected sponsor, synonyms, targeted countries and sectors, references) with the MITRE ATT&CK tools and techniques attributed to it. Keep the sources block when quoting: it carries MITRE's notice

Cases

Team and Enterprise. Each call goes through the same checks as the case pages.

ToolParametersWhat it returns
list_casesnoneThe organization's cases, open ones first, with indicator and comment counts
get_caseuuidTitle, summary, status, every indicator with a link to its analysis, and the comment thread
create_casetitle, summary?Opens a case and returns the uuid the other case tools take
add_case_indicatorsuuid, indicatorsFiles a paste of indicators (one per line, or comma or space separated, mixed types), typed automatically; anything mlab cannot look up comes back in skipped with the reason
add_case_commentuuid, body, indicator_uuid?A note on the case, or on one of its indicators

Workspaces

Team and Enterprise, and only in a workspace whose admin turned on AI agents (MCP): a workspace keeps its data on the organization's own hosts, and an answer goes to the LLM provider of whoever asked. workspace_list says which workspaces are open. Every tool except workspace_list takes workspace (the uuid from workspace_list). Each call is written to the workspace's audit log.

The tools read, and can start an index or a YARA scan. Creating, deleting, enrolling, members, policies, pushing a cluster config and binary downloads stay in the app. Answers carry data sent by the hosts, which may contain text planted by an attacker: the server says so before every answer.

Agents and memory forensics (engram)

ToolParametersWhat it returns
workspace_listnoneThe workspaces you can open, whether AI agents may read them, agents online and the tools they run
workspace_agentsworkspaceThe workspace's agents: live state, version, the tools each one reports
workspace_memory_dumpsworkspaceMemory dumps on the engram agents, and which ones are indexed. Asks every agent: allow a few seconds
workspace_memory_indexworkspace, agent, dumpStarts indexing a dump on its host, in the background. Follow it with workspace_memory_dumps
workspace_memory_overviewworkspace, agent, dumpA dump's index: system, process tree, findings (injected code and other anomalies), registry hives
workspace_memory_processworkspace, agent, dump, pidOne process in full: command line, environment, modules, memory regions, handles, findings
workspace_memory_readworkspace, agent, dump, address, len?, space?, pid?Up to 4 KiB read live from the dump, as hex and text. space is virtual (needs pid, the default) or physical
workspace_memory_registryworkspace, agent, dump, hive, path?One registry key: values, subkeys, last write time
workspace_memory_yaraworkspace, agent, dump, rules, pids?Runs YARA rules over the dump's processes on the host. Usually returns a job, a new one each call
workspace_memory_yara_statusworkspace, agent, jobProgress of a YARA scan, and its matches once done

Kubernetes clusters (k3sec)

ToolParametersWhat it returns
workspace_cluster_listworkspaceClusters reporting to the workspace: nodes online, images, vulnerabilities in packages really loaded, recent detections
workspace_cluster_imagesworkspace, clusterRunning images with their vulnerabilities, loaded ones first
workspace_cluster_imageworkspace, cluster, digestOne image: findings and packages, with which are loaded in memory
workspace_cluster_eventsworkspace, cluster, source?, kind?, namespace?, min_severity?, q?, before?, limit?Runtime events, newest first: Kubernetes events, eBPF activity, YARA detections, with cached reputation of destinations and binaries. 200 at most per call; before pages back
workspace_cluster_configworkspace, clusterWhat k3sec collects on each node, and the ceiling the nodes' local policies allow

Proxmox VE (virtsec)

ToolParametersWhat it returns
workspace_virt_listworkspaceProxmox clusters: nodes online, LXC and VM guests, guests with weakened isolation, vulnerabilities in loaded packages, critical events of the last 24 h
workspace_virt_guestsworkspace, clusterGuests and nodes: status, isolation risks from their config (privileged, host bind mounts, passthrough), vulnerabilities
workspace_virt_guestworkspace, cluster, key, agent?One guest by vmid, or a node (key = node with its agent): isolation risks, findings, packages
workspace_virt_eventsworkspace, cluster, source?, kind?, min_severity?, q?, vmid?, before?, limit?Runtime events, newest first: executions in guests, outbound connections, sensitive writes, VM escape signals, PVE logins, auth failures, tasks, guest config changes. 200 at most per call
workspace_virt_configworkspace, clusterWhat virtsec collects on each node, and the ceiling the local policies allow
workspace_virt_auditworkspace, clusterSecurity posture per node: failed checks (PVE firewall off, users without a second factor, root SSH with a password, unreachable or test repositories, guests without backup, isolation risks, pending restarts), each with a fix

Account, bookmarks and history

ToolParametersWhat it returns
get_account_infononeThe authenticated user, their organization and plan
get_scan_limitsnoneRemaining IP, domain, file and crypto quotas of the organization, over a rolling 24 hours shared by all members
get_scan_historytype?, limit?Recent scans of the account, filtered by ip, domain or file
get_bookmarkslimit?Your bookmarked indicators
add_bookmarkvalueBookmarks an IP, domain, URL, hash, crypto address, email, phone number or MAC address
remove_bookmarkvalueRemoves a bookmark

Authentication

OAuth 2.1 is the recommended path: authorization code with PKCE S256, dynamic client registration, CIMD supported. The server advertises its metadata at https://mlab.sh/.well-known/oauth-authorization-server, so a compliant client only needs the endpoint URL. A token issued this way is listed in Account > Settings as OAuth: <client name>; reconnecting the same client replaces its previous token instead of piling up new ones.

If your client does not speak OAuth, create a static token in Account > Settings > MCP Tokens and send it as Authorization: Bearer mcp_xxx. At creation you pick its lifetime: 30, 90 or 365 days, or never. A token can be renamed and revoked at any time from the same page.

MCP tokens are personal: they act as you, with your role in the organization. Organization API key permissions do not apply to them. Up to 5 active tokens, 100 on Team and Enterprise.

Full details: https://doc.mlab.sh/docs/mlab.sh/integrations/mcp

Rate limits and quotas

Limits follow your organization's plan and are counted over a rolling 24 hour window, shared by every member. A spent quota returns an error that says which one and when it frees up. Call get_scan_limits to read what is left.

Registry

Published to the official MCP Registry as sh.mlab/mcp.

https://registry.modelcontextprotocol.io/v0.1/servers?search=sh.mlab

Other public servers

https://news.mlab.sh/mcp is a separate, unauthenticated, read only MCP server exposing a cyber news index. It is not published from this repo.

Security

Report vulnerabilities to [email protected]. See https://mlab.sh/security.txt and SECURITY.md.

License

MIT, see LICENSE.

來源：README.md，提交 42d416c

工具

0
該伺服器需要登入，因此 SourceWeft 無法在沒有帳號的情況下讀取其工具，也未收錄。已連接帳號所能看到的內容可能因帳號及其權限而異。

版本歷史

2
  1. v1.2.0最新Nov 6, 2026
  2. v1.0.0Sep 16, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分