OLETools Secure MCP Server

OLETools Secure MCP server is a locally run integration for AI assistants that speak the Model Context Protocol. Secure MCP server for analyzing Excel files with oletools.

What you get

This project provides a secure microservice using FastMCP to analyze Microsoft Office documents (Excel, Word, PowerPoint) and related file types (like XLL add-ins) for potential malicious content using static analysis techniques. It leverages external tools like oletools, XLMMacroDeobfuscator, and pefile.

• Analyzes VBA Macros (olevba)
• Detects XLM Macros (XLMMacroDeobfuscator, olevba)
• Checks for DDE Links (msodde)
• Extracts embedded OLE Objects (oleobj)
• Analyzes XLL file exports for suspicious functions (pefile)
• Extracts IOCs (URLs, IPs, Hashes, Emails) using iocextract

Setting it up

The server ships on PyPI as oletools, so your MCP client can launch it on demand — there is no separate build step. Add the server block to your client's configuration, restart it, and the tools register themselves.

Configuration and credentials

• Python 3.6+ - OLETools: Install via pip install oletools - XLMMacroDeobfuscator: Install via pip install XLMMacroDeobfuscator - python-magic: Install via pip install python-magic-bin (Windows) - iocextract (optional): Install via pip install iocextract for advanced IOC extraction - Claude Desktop application

Choosing this one

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. It is maintained by pradeep895; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.

Before you rely on it

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the oletools secure mcp server does with a few real requests.