JoesandboxMCP MCP Server

Joesandboxmcp mcp server lets Claude, Cursor and other MCP clients work with JoesandboxMCP directly. A Model Context Protocol (MCP) server for interacting with Joe Sandbox Cloud. This server exposes rich analysis and IOC extraction capabilities from Joe Sandbox and integrates cleanly into any MCP-compatible application (e.g. Claude Desktop, Glama, or custom LLM.

What JoesandboxMCP does

A Model Context Protocol (MCP) server for interacting with Joe Sandbox Cloud. This server exposes rich analysis and IOC extraction capabilities from Joe Sandbox and integrates cleanly into any MCP-compatible application (e.g. Claude Desktop, Glama, or custom LLM agents).

Key capabilities

• Flexible Submission — Submit local files, remote URLs, websites, or command lines for dynamic analysis
• IOC Extraction — Retrieve indicators of compromise for dropped files, IPs, domains, and URLs
• Signature Detections — Retrieve and extract actionable evidence from sandbox signatures
• Process Trees — Visualize full execution hierarchies, including command lines and parent-child relationships
• Unpacked PE Files — Download in-memory unpacked binaries extracted during execution, often revealing runtime payloads
• PCAP Downloads — Retrieve the full network traffic capture (PCAP) recorded during analysis for offline inspection
• LLM-Suitable Responses — All results are structured for clear consumption by language models, with truncation and relevant filtering

Installing the joesandboxmcp mcp server

Setup follows the standard MCP pattern: clone or install the server, then register it in your client's configuration file and restart the client. The configuration snippets on this page cover Claude Desktop, Claude Code and Cursor.

Configuration

Before the server will start you need to supply 2 environment variables: JBXAPIKEY, ACCEPTTAC. Keep credentials in your client's env block or a secrets manager rather than committing them.

Where it fits

AI-service servers chain other models into your assistant, turning a single chat into a small production pipeline. JoesandboxMCP sits in that group. Worth comparing against the other ai services servers in this directory before you commit to one, since several overlap in scope but differ sharply in setup cost and permissions.

Practical notes

• This server runs locally, so it operates with whatever access your machine and its credentials already have. Scope that deliberately rather than by default.
• It will not start until its required credentials are present, so set those before wondering why the tools never appear.
• Maintained by joesecurity.
• MCP clients ask for confirmation before each tool call by default. Keep that on while you learn what the joesandboxmcp mcp server actually does with your data.
• Every entry in this directory is reviewed by hand before it goes live, and details are checked against the project's own documentation.