Name: Threat.Zone MCP Server
Author: threat.zone

Tools observed via MCP handshake

connect — Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL
disconnect — Disconnect from a VNC session
screenshot — Capture the current VNC screen as an image
send_key — Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers.
type_text — Type a string of text character by character
mouse_click — Click the mouse at a specific position
mouse_move — Move the mouse cursor to a specific position
mouse_drag — Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints.
scroll — Scroll the mouse wheel at a specific position
get_screen_size — Get the VNC screen dimensions
wait_for_screen_change — Wait until the remote screen content changes or timeout
file_upload — Upload a base64-encoded file to the remote machine via clipboard + shell commands
file_download — Download a file from the remote machine as base64 via clipboard + shell commands
clipboard_write — Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)
device_button — Press an Android device button (RTC sessions only)
clipboard_read — Read the last clipboard text received from the remote machine
tz_me — Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co
tz_config_metafields — All available metafield options across all submission types
tz_config_metafields_sandbox — Sandbox-specific metafield options
tz_config_metafields_static — Static analysis metafield options
tz_config_metafields_cdr — CDR metafield options
tz_config_metafields_url — URL analysis metafield options
tz_config_metafields_open_in_browser — Open-in-browser metafield options
tz_config_environments — Available sandbox OS environments and their feature flags
tz_network_configs_list — Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig
tz_submissions_list — List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with
tz_submission_get — Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator
tz_submission_search_sha256 — Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi
tz_submission_summary — High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count.
tz_submission_indicators — Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate.
tz_submission_iocs — Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages
tz_submission_yara_rules — YARA rule hits during analysis. Paginated — does NOT auto-paginate.
tz_submission_artifacts — Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si
tz_submission_mitre — MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped.
tz_submission_extracted_configs — Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors.
tz_submission_eml_analysis — EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions.
tz_submission_processes — Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime.
tz_submission_process_tree — Process spawn tree (parent–child relationships) captured during dynamic analysis.
tz_submission_behaviours — Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate.
tz_submission_syscalls — Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate.
tz_submission_static_scan — Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures.
tz_submission_cdr — CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u
tz_submission_signature_check — Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level.
tz_network_summary — Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup.
tz_network_dns — DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro
tz_network_http — HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N`
tz_network_tcp — TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`.
tz_network_udp — UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`.
tz_network_threats — Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass
tz_submission_url_analysis — Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi
tz_submission_media_list — List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64.
tz_download_sample — Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f
tz_download_artifact — Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil
tz_download_pcap — Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path.
tz_download_yara_rule — Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64.
tz_download_html_report — Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review.
tz_download_cdr — Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat
tz_download_screenshot — Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc
tz_download_media — Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return
tz_submit_sandbox — Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call
tz_submit_static — Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get.
tz_submit_cdr — Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm
tz_submit_url — Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have
tz_submit_open_in_browser — Create an "open in browser" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages

when	check	result	http	latency	detail
3 h ago	mcp initialize	ok	200	107 ms	server threatzone-mcp 1.3.0 · protocol 2025-06-18 · 64 tools
10 h ago	mcp initialize	ok	200	130 ms	server threatzone-mcp 1.3.0 · protocol 2025-06-18 · 64 tools
16 h ago	mcp initialize	ok	200	68 ms	server threatzone-mcp 1.3.0 · protocol 2025-06-18 · 64 tools
22 h ago	mcp initialize	ok	200	81 ms	server threatzone-mcp 1.3.0 · protocol 2025-06-18 · 64 tools
29 h ago	mcp initialize	ok	200	49 ms	server threatzone-mcp 1.3.0 · protocol 2025-06-18 · 64 tools
2 d ago	mcp initialize	ok	200	82 ms	server threatzone-mcp 1.3.0 · protocol 2025-06-18 · 64 tools
2 d ago	mcp initialize	ok	200	83 ms	server threatzone-mcp 1.3.0 · protocol 2025-06-18 · 64 tools
2 d ago	mcp initialize	ok	200	127 ms	server threatzone-mcp 1.3.0 · protocol 2025-06-18 · 64 tools
3 d ago	mcp initialize	ok	200	67 ms	server threatzone-mcp 1.3.0 · protocol 2025-06-18 · 64 tools
3 d ago	mcp initialize	ok	200	73 ms	server threatzone-mcp 1.3.0 · protocol 2025-06-18 · 64 tools

Threat.Zone MCP Server

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from