YaraFlux MCP Server

A Model Context Protocol (MCP) server for YARA scanning, providing LLMs with capabilities to analyze files with YARA rules.

Local serverstdioPython

What is the YaraFlux MCP Server?

A Model Context Protocol (MCP) server for YARA scanning, providing LLMs with capabilities to analyze files with YARA rules.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

ToolWhat it does
list_yara_rulesList available YARA rules with filtering options
get_yara_ruleGet a specific YARA rule's content and metadata
validate_yara_ruleValidate YARA rule syntax with detailed error reporting
add_yara_ruleCreate a new YARA rule
update_yara_ruleUpdate an existing YARA rule
delete_yara_ruleDelete a YARA rule
import_threatflux_rulesImport rules from ThreatFlux GitHub repository
scan_urlScan content from a URL with specified YARA rules
scan_dataScan provided data (base64 encoded) with specified rules
get_scan_resultRetrieve detailed results from a previous scan
upload_fileUpload a file for analysis or scanning
get_file_infoGet metadata about an uploaded file
list_filesList uploaded files with pagination and sorting
delete_fileDelete an uploaded file

Configuration

VariableDescriptionRequired
JWT_SECRET_KEYCredential the server authenticates with.Yes

Example prompts to try

  • “Use YaraFlux to list yara rules.”
  • “Use YaraFlux to get yara rule.”
  • “Use YaraFlux to validate yara rule.”

Frequently asked questions

A Model Context Protocol (MCP) server for YARA scanning, providing LLMs with capabilities to analyze files with YARA rules. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.