{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_anpx678pdsby","handle":"threat-zone-mcp-server","url":"https://wellknown.network/agents/threat-zone-mcp-server","links":{"self":"https://wellknown.network/agents/threat-zone-mcp-server/record.json","html":"https://wellknown.network/agents/threat-zone-mcp-server","markdown":"https://wellknown.network/agents/threat-zone-mcp-server/record.md","api":"https://wellknown.network/api/v1/agents/threat-zone-mcp-server","status":"https://wellknown.network/api/v1/agents/threat-zone-mcp-server/status","claim":"https://wellknown.network/agents/threat-zone-mcp-server/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/threat-zone-mcp-server/claim.json","badge":"https://wellknown.network/agents/threat-zone-mcp-server/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/threat-zone-mcp-server/history","tools":"https://wellknown.network/api/v1/agents/threat-zone-mcp-server/tools"},"ard":{"identifier":"urn:air:app.threat.zone:server:threat-zone-mcp-server","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"Threat.Zone MCP Server","summary":"Submit files and URLs to the Threat.Zone malware sandbox, read verdicts, IOCs, MITRE ATT&CK mappings and network traffic, and drive the live sandbox VM.","description":"Submit files and URLs to the Threat.Zone malware sandbox, read verdicts, IOCs, MITRE ATT&CK mappings and network traffic, and drive the live sandbox VM.","publisher":{"name":"threat.zone","url":"https://threat.zone"},"homepage":"https://github.com/Malwation/threatzone-mcp-server","repository":"https://github.com/Malwation/threatzone-mcp-server","version":null,"license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://app.threat.zone/mcp","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"ard":{"type":"application/mcp-server-card+json","metadata":null,"identifier":"urn:air:threat.zone:mcp:threatzone","artifactUrl":"https://threat.zone/.well-known/mcp/server-card.json","representativeQueries":["analyze this suspicious file in a malware sandbox","is this url malicious","get the iocs and mitre att&ck techniques for a malware sample","download the pcap from a sandbox run","disarm this document with cdr"]}},"attribution":{"kind":"ard_catalog","name":"ard_catalog","repoUrl":"ard_catalog","summary":"ard_catalog","description":"ard_catalog","homepageUrl":"ard_catalog","publisherUrl":"ard_catalog","publisherName":"ard_catalog"}},"derived":{"capabilities":[{"slug":"dev.terminal","name":"Terminal & Shell","confidence":1,"provenance":"derived"},{"slug":"infra.desktop","name":"Desktop Control","confidence":1,"provenance":"derived"},{"slug":"data.database","name":"Databases","confidence":0.992,"provenance":"derived"},{"slug":"code.execution","name":"Code Execution","confidence":0.911,"provenance":"derived"},{"slug":"dev.filesystem","name":"Filesystem","confidence":0.859,"provenance":"derived"},{"slug":"code.security-review","name":"Security Review","confidence":0.583,"provenance":"derived"},{"slug":"dev.docs-lookup","name":"Documentation Lookup","confidence":0.54,"provenance":"derived"},{"slug":"content.writing","name":"Writing & Editing","confidence":0.51,"provenance":"derived"}],"categories":["code","content","data","dev","infra"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 4h ago.","lastOkAt":"2026-10-23T20:25:27.894Z","lastProbedAt":"2026-10-23T20:25:27.894Z","statusComputedAt":"2026-10-23T20:27:41.367Z","reliability30d":{"probes":83,"successRate":1,"p50Ms":67,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":83,"ok":83,"authBoundaryOk":0,"serviceOk":83,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-10-23T20:25:27.894Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":107,"error":null,"detail":{"tools":[{"name":"connect","description":"Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL"},{"name":"disconnect","description":"Disconnect from a VNC session"},{"name":"screenshot","description":"Capture the current VNC screen as an image"},{"name":"send_key","description":"Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers."},{"name":"type_text","description":"Type a string of text character by character"},{"name":"mouse_click","description":"Click the mouse at a specific position"},{"name":"mouse_move","description":"Move the mouse cursor to a specific position"},{"name":"mouse_drag","description":"Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints."},{"name":"scroll","description":"Scroll the mouse wheel at a specific position"},{"name":"get_screen_size","description":"Get the VNC screen dimensions"},{"name":"wait_for_screen_change","description":"Wait until the remote screen content changes or timeout"},{"name":"file_upload","description":"Upload a base64-encoded file to the remote machine via clipboard + shell commands"},{"name":"file_download","description":"Download a file from the remote machine as base64 via clipboard + shell commands"},{"name":"clipboard_write","description":"Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)"},{"name":"device_button","description":"Press an Android device button (RTC sessions only)"},{"name":"clipboard_read","description":"Read the last clipboard text received from the remote machine"},{"name":"tz_me","description":"Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co"},{"name":"tz_config_metafields","description":"All available metafield options across all submission types"},{"name":"tz_config_metafields_sandbox","description":"Sandbox-specific metafield options"},{"name":"tz_config_metafields_static","description":"Static analysis metafield options"},{"name":"tz_config_metafields_cdr","description":"CDR metafield options"},{"name":"tz_config_metafields_url","description":"URL analysis metafield options"},{"name":"tz_config_metafields_open_in_browser","description":"Open-in-browser metafield options"},{"name":"tz_config_environments","description":"Available sandbox OS environments and their feature flags"},{"name":"tz_network_configs_list","description":"Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig"},{"name":"tz_submissions_list","description":"List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with "},{"name":"tz_submission_get","description":"Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator "},{"name":"tz_submission_search_sha256","description":"Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi"},{"name":"tz_submission_summary","description":"High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count."},{"name":"tz_submission_indicators","description":"Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate."},{"name":"tz_submission_iocs","description":"Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages"},{"name":"tz_submission_yara_rules","description":"YARA rule hits during analysis. Paginated — does NOT auto-paginate."},{"name":"tz_submission_artifacts","description":"Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si"},{"name":"tz_submission_mitre","description":"MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped."},{"name":"tz_submission_extracted_configs","description":"Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors."},{"name":"tz_submission_eml_analysis","description":"EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions."},{"name":"tz_submission_processes","description":"Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime."},{"name":"tz_submission_process_tree","description":"Process spawn tree (parent–child relationships) captured during dynamic analysis."},{"name":"tz_submission_behaviours","description":"Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate."},{"name":"tz_submission_syscalls","description":"Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate."},{"name":"tz_submission_static_scan","description":"Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures."},{"name":"tz_submission_cdr","description":"CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u"},{"name":"tz_submission_signature_check","description":"Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level."},{"name":"tz_network_summary","description":"Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup."},{"name":"tz_network_dns","description":"DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro"},{"name":"tz_network_http","description":"HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` "},{"name":"tz_network_tcp","description":"TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_udp","description":"UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_threats","description":"Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass "},{"name":"tz_submission_url_analysis","description":"Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi"},{"name":"tz_submission_media_list","description":"List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64."},{"name":"tz_download_sample","description":"Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f"},{"name":"tz_download_artifact","description":"Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil"},{"name":"tz_download_pcap","description":"Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path."},{"name":"tz_download_yara_rule","description":"Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64."},{"name":"tz_download_html_report","description":"Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review."},{"name":"tz_download_cdr","description":"Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat"},{"name":"tz_download_screenshot","description":"Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc"},{"name":"tz_download_media","description":"Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return"},{"name":"tz_submit_sandbox","description":"Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call "},{"name":"tz_submit_static","description":"Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get."},{"name":"tz_submit_cdr","description":"Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm"},{"name":"tz_submit_url","description":"Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have "},{"name":"tz_submit_open_in_browser","description":"Create an \"open in browser\" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages"}],"toolCount":64,"toolsHash":"e683b1b224451f2ef58c708e5d5fedd85d8b853964418723ec4a2521b9d0ea27","serverName":"threatzone-mcp","capabilities":["tools"],"serverVersion":"1.3.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T13:28:18.198Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":130,"error":null,"detail":{"tools":[{"name":"connect","description":"Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL"},{"name":"disconnect","description":"Disconnect from a VNC session"},{"name":"screenshot","description":"Capture the current VNC screen as an image"},{"name":"send_key","description":"Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers."},{"name":"type_text","description":"Type a string of text character by character"},{"name":"mouse_click","description":"Click the mouse at a specific position"},{"name":"mouse_move","description":"Move the mouse cursor to a specific position"},{"name":"mouse_drag","description":"Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints."},{"name":"scroll","description":"Scroll the mouse wheel at a specific position"},{"name":"get_screen_size","description":"Get the VNC screen dimensions"},{"name":"wait_for_screen_change","description":"Wait until the remote screen content changes or timeout"},{"name":"file_upload","description":"Upload a base64-encoded file to the remote machine via clipboard + shell commands"},{"name":"file_download","description":"Download a file from the remote machine as base64 via clipboard + shell commands"},{"name":"clipboard_write","description":"Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)"},{"name":"device_button","description":"Press an Android device button (RTC sessions only)"},{"name":"clipboard_read","description":"Read the last clipboard text received from the remote machine"},{"name":"tz_me","description":"Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co"},{"name":"tz_config_metafields","description":"All available metafield options across all submission types"},{"name":"tz_config_metafields_sandbox","description":"Sandbox-specific metafield options"},{"name":"tz_config_metafields_static","description":"Static analysis metafield options"},{"name":"tz_config_metafields_cdr","description":"CDR metafield options"},{"name":"tz_config_metafields_url","description":"URL analysis metafield options"},{"name":"tz_config_metafields_open_in_browser","description":"Open-in-browser metafield options"},{"name":"tz_config_environments","description":"Available sandbox OS environments and their feature flags"},{"name":"tz_network_configs_list","description":"Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig"},{"name":"tz_submissions_list","description":"List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with "},{"name":"tz_submission_get","description":"Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator "},{"name":"tz_submission_search_sha256","description":"Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi"},{"name":"tz_submission_summary","description":"High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count."},{"name":"tz_submission_indicators","description":"Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate."},{"name":"tz_submission_iocs","description":"Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages"},{"name":"tz_submission_yara_rules","description":"YARA rule hits during analysis. Paginated — does NOT auto-paginate."},{"name":"tz_submission_artifacts","description":"Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si"},{"name":"tz_submission_mitre","description":"MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped."},{"name":"tz_submission_extracted_configs","description":"Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors."},{"name":"tz_submission_eml_analysis","description":"EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions."},{"name":"tz_submission_processes","description":"Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime."},{"name":"tz_submission_process_tree","description":"Process spawn tree (parent–child relationships) captured during dynamic analysis."},{"name":"tz_submission_behaviours","description":"Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate."},{"name":"tz_submission_syscalls","description":"Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate."},{"name":"tz_submission_static_scan","description":"Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures."},{"name":"tz_submission_cdr","description":"CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u"},{"name":"tz_submission_signature_check","description":"Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level."},{"name":"tz_network_summary","description":"Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup."},{"name":"tz_network_dns","description":"DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro"},{"name":"tz_network_http","description":"HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` "},{"name":"tz_network_tcp","description":"TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_udp","description":"UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_threats","description":"Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass "},{"name":"tz_submission_url_analysis","description":"Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi"},{"name":"tz_submission_media_list","description":"List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64."},{"name":"tz_download_sample","description":"Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f"},{"name":"tz_download_artifact","description":"Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil"},{"name":"tz_download_pcap","description":"Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path."},{"name":"tz_download_yara_rule","description":"Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64."},{"name":"tz_download_html_report","description":"Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review."},{"name":"tz_download_cdr","description":"Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat"},{"name":"tz_download_screenshot","description":"Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc"},{"name":"tz_download_media","description":"Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return"},{"name":"tz_submit_sandbox","description":"Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call "},{"name":"tz_submit_static","description":"Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get."},{"name":"tz_submit_cdr","description":"Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm"},{"name":"tz_submit_url","description":"Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have "},{"name":"tz_submit_open_in_browser","description":"Create an \"open in browser\" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages"}],"toolCount":64,"toolsHash":"e683b1b224451f2ef58c708e5d5fedd85d8b853964418723ec4a2521b9d0ea27","serverName":"threatzone-mcp","capabilities":["tools"],"serverVersion":"1.3.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T07:29:06.818Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":68,"error":null,"detail":{"tools":[{"name":"connect","description":"Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL"},{"name":"disconnect","description":"Disconnect from a VNC session"},{"name":"screenshot","description":"Capture the current VNC screen as an image"},{"name":"send_key","description":"Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers."},{"name":"type_text","description":"Type a string of text character by character"},{"name":"mouse_click","description":"Click the mouse at a specific position"},{"name":"mouse_move","description":"Move the mouse cursor to a specific position"},{"name":"mouse_drag","description":"Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints."},{"name":"scroll","description":"Scroll the mouse wheel at a specific position"},{"name":"get_screen_size","description":"Get the VNC screen dimensions"},{"name":"wait_for_screen_change","description":"Wait until the remote screen content changes or timeout"},{"name":"file_upload","description":"Upload a base64-encoded file to the remote machine via clipboard + shell commands"},{"name":"file_download","description":"Download a file from the remote machine as base64 via clipboard + shell commands"},{"name":"clipboard_write","description":"Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)"},{"name":"device_button","description":"Press an Android device button (RTC sessions only)"},{"name":"clipboard_read","description":"Read the last clipboard text received from the remote machine"},{"name":"tz_me","description":"Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co"},{"name":"tz_config_metafields","description":"All available metafield options across all submission types"},{"name":"tz_config_metafields_sandbox","description":"Sandbox-specific metafield options"},{"name":"tz_config_metafields_static","description":"Static analysis metafield options"},{"name":"tz_config_metafields_cdr","description":"CDR metafield options"},{"name":"tz_config_metafields_url","description":"URL analysis metafield options"},{"name":"tz_config_metafields_open_in_browser","description":"Open-in-browser metafield options"},{"name":"tz_config_environments","description":"Available sandbox OS environments and their feature flags"},{"name":"tz_network_configs_list","description":"Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig"},{"name":"tz_submissions_list","description":"List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with "},{"name":"tz_submission_get","description":"Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator "},{"name":"tz_submission_search_sha256","description":"Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi"},{"name":"tz_submission_summary","description":"High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count."},{"name":"tz_submission_indicators","description":"Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate."},{"name":"tz_submission_iocs","description":"Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages"},{"name":"tz_submission_yara_rules","description":"YARA rule hits during analysis. Paginated — does NOT auto-paginate."},{"name":"tz_submission_artifacts","description":"Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si"},{"name":"tz_submission_mitre","description":"MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped."},{"name":"tz_submission_extracted_configs","description":"Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors."},{"name":"tz_submission_eml_analysis","description":"EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions."},{"name":"tz_submission_processes","description":"Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime."},{"name":"tz_submission_process_tree","description":"Process spawn tree (parent–child relationships) captured during dynamic analysis."},{"name":"tz_submission_behaviours","description":"Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate."},{"name":"tz_submission_syscalls","description":"Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate."},{"name":"tz_submission_static_scan","description":"Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures."},{"name":"tz_submission_cdr","description":"CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u"},{"name":"tz_submission_signature_check","description":"Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level."},{"name":"tz_network_summary","description":"Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup."},{"name":"tz_network_dns","description":"DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro"},{"name":"tz_network_http","description":"HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` "},{"name":"tz_network_tcp","description":"TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_udp","description":"UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_threats","description":"Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass "},{"name":"tz_submission_url_analysis","description":"Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi"},{"name":"tz_submission_media_list","description":"List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64."},{"name":"tz_download_sample","description":"Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f"},{"name":"tz_download_artifact","description":"Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil"},{"name":"tz_download_pcap","description":"Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path."},{"name":"tz_download_yara_rule","description":"Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64."},{"name":"tz_download_html_report","description":"Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review."},{"name":"tz_download_cdr","description":"Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat"},{"name":"tz_download_screenshot","description":"Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc"},{"name":"tz_download_media","description":"Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return"},{"name":"tz_submit_sandbox","description":"Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call "},{"name":"tz_submit_static","description":"Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get."},{"name":"tz_submit_cdr","description":"Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm"},{"name":"tz_submit_url","description":"Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have "},{"name":"tz_submit_open_in_browser","description":"Create an \"open in browser\" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages"}],"toolCount":64,"toolsHash":"e683b1b224451f2ef58c708e5d5fedd85d8b853964418723ec4a2521b9d0ea27","serverName":"threatzone-mcp","capabilities":["tools"],"serverVersion":"1.3.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T01:30:10.686Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":81,"error":null,"detail":{"tools":[{"name":"connect","description":"Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL"},{"name":"disconnect","description":"Disconnect from a VNC session"},{"name":"screenshot","description":"Capture the current VNC screen as an image"},{"name":"send_key","description":"Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers."},{"name":"type_text","description":"Type a string of text character by character"},{"name":"mouse_click","description":"Click the mouse at a specific position"},{"name":"mouse_move","description":"Move the mouse cursor to a specific position"},{"name":"mouse_drag","description":"Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints."},{"name":"scroll","description":"Scroll the mouse wheel at a specific position"},{"name":"get_screen_size","description":"Get the VNC screen dimensions"},{"name":"wait_for_screen_change","description":"Wait until the remote screen content changes or timeout"},{"name":"file_upload","description":"Upload a base64-encoded file to the remote machine via clipboard + shell commands"},{"name":"file_download","description":"Download a file from the remote machine as base64 via clipboard + shell commands"},{"name":"clipboard_write","description":"Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)"},{"name":"device_button","description":"Press an Android device button (RTC sessions only)"},{"name":"clipboard_read","description":"Read the last clipboard text received from the remote machine"},{"name":"tz_me","description":"Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co"},{"name":"tz_config_metafields","description":"All available metafield options across all submission types"},{"name":"tz_config_metafields_sandbox","description":"Sandbox-specific metafield options"},{"name":"tz_config_metafields_static","description":"Static analysis metafield options"},{"name":"tz_config_metafields_cdr","description":"CDR metafield options"},{"name":"tz_config_metafields_url","description":"URL analysis metafield options"},{"name":"tz_config_metafields_open_in_browser","description":"Open-in-browser metafield options"},{"name":"tz_config_environments","description":"Available sandbox OS environments and their feature flags"},{"name":"tz_network_configs_list","description":"Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig"},{"name":"tz_submissions_list","description":"List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with "},{"name":"tz_submission_get","description":"Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator "},{"name":"tz_submission_search_sha256","description":"Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi"},{"name":"tz_submission_summary","description":"High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count."},{"name":"tz_submission_indicators","description":"Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate."},{"name":"tz_submission_iocs","description":"Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages"},{"name":"tz_submission_yara_rules","description":"YARA rule hits during analysis. Paginated — does NOT auto-paginate."},{"name":"tz_submission_artifacts","description":"Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si"},{"name":"tz_submission_mitre","description":"MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped."},{"name":"tz_submission_extracted_configs","description":"Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors."},{"name":"tz_submission_eml_analysis","description":"EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions."},{"name":"tz_submission_processes","description":"Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime."},{"name":"tz_submission_process_tree","description":"Process spawn tree (parent–child relationships) captured during dynamic analysis."},{"name":"tz_submission_behaviours","description":"Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate."},{"name":"tz_submission_syscalls","description":"Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate."},{"name":"tz_submission_static_scan","description":"Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures."},{"name":"tz_submission_cdr","description":"CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u"},{"name":"tz_submission_signature_check","description":"Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level."},{"name":"tz_network_summary","description":"Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup."},{"name":"tz_network_dns","description":"DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro"},{"name":"tz_network_http","description":"HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` "},{"name":"tz_network_tcp","description":"TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_udp","description":"UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_threats","description":"Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass "},{"name":"tz_submission_url_analysis","description":"Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi"},{"name":"tz_submission_media_list","description":"List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64."},{"name":"tz_download_sample","description":"Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f"},{"name":"tz_download_artifact","description":"Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil"},{"name":"tz_download_pcap","description":"Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path."},{"name":"tz_download_yara_rule","description":"Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64."},{"name":"tz_download_html_report","description":"Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review."},{"name":"tz_download_cdr","description":"Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat"},{"name":"tz_download_screenshot","description":"Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc"},{"name":"tz_download_media","description":"Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return"},{"name":"tz_submit_sandbox","description":"Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call "},{"name":"tz_submit_static","description":"Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get."},{"name":"tz_submit_cdr","description":"Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm"},{"name":"tz_submit_url","description":"Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have "},{"name":"tz_submit_open_in_browser","description":"Create an \"open in browser\" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages"}],"toolCount":64,"toolsHash":"e683b1b224451f2ef58c708e5d5fedd85d8b853964418723ec4a2521b9d0ea27","serverName":"threatzone-mcp","capabilities":["tools"],"serverVersion":"1.3.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T18:33:02.129Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":49,"error":null,"detail":{"tools":[{"name":"connect","description":"Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL"},{"name":"disconnect","description":"Disconnect from a VNC session"},{"name":"screenshot","description":"Capture the current VNC screen as an image"},{"name":"send_key","description":"Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers."},{"name":"type_text","description":"Type a string of text character by character"},{"name":"mouse_click","description":"Click the mouse at a specific position"},{"name":"mouse_move","description":"Move the mouse cursor to a specific position"},{"name":"mouse_drag","description":"Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints."},{"name":"scroll","description":"Scroll the mouse wheel at a specific position"},{"name":"get_screen_size","description":"Get the VNC screen dimensions"},{"name":"wait_for_screen_change","description":"Wait until the remote screen content changes or timeout"},{"name":"file_upload","description":"Upload a base64-encoded file to the remote machine via clipboard + shell commands"},{"name":"file_download","description":"Download a file from the remote machine as base64 via clipboard + shell commands"},{"name":"clipboard_write","description":"Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)"},{"name":"device_button","description":"Press an Android device button (RTC sessions only)"},{"name":"clipboard_read","description":"Read the last clipboard text received from the remote machine"},{"name":"tz_me","description":"Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co"},{"name":"tz_config_metafields","description":"All available metafield options across all submission types"},{"name":"tz_config_metafields_sandbox","description":"Sandbox-specific metafield options"},{"name":"tz_config_metafields_static","description":"Static analysis metafield options"},{"name":"tz_config_metafields_cdr","description":"CDR metafield options"},{"name":"tz_config_metafields_url","description":"URL analysis metafield options"},{"name":"tz_config_metafields_open_in_browser","description":"Open-in-browser metafield options"},{"name":"tz_config_environments","description":"Available sandbox OS environments and their feature flags"},{"name":"tz_network_configs_list","description":"Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig"},{"name":"tz_submissions_list","description":"List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with "},{"name":"tz_submission_get","description":"Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator "},{"name":"tz_submission_search_sha256","description":"Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi"},{"name":"tz_submission_summary","description":"High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count."},{"name":"tz_submission_indicators","description":"Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate."},{"name":"tz_submission_iocs","description":"Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages"},{"name":"tz_submission_yara_rules","description":"YARA rule hits during analysis. Paginated — does NOT auto-paginate."},{"name":"tz_submission_artifacts","description":"Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si"},{"name":"tz_submission_mitre","description":"MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped."},{"name":"tz_submission_extracted_configs","description":"Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors."},{"name":"tz_submission_eml_analysis","description":"EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions."},{"name":"tz_submission_processes","description":"Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime."},{"name":"tz_submission_process_tree","description":"Process spawn tree (parent–child relationships) captured during dynamic analysis."},{"name":"tz_submission_behaviours","description":"Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate."},{"name":"tz_submission_syscalls","description":"Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate."},{"name":"tz_submission_static_scan","description":"Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures."},{"name":"tz_submission_cdr","description":"CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u"},{"name":"tz_submission_signature_check","description":"Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level."},{"name":"tz_network_summary","description":"Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup."},{"name":"tz_network_dns","description":"DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro"},{"name":"tz_network_http","description":"HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` "},{"name":"tz_network_tcp","description":"TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_udp","description":"UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_threats","description":"Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass "},{"name":"tz_submission_url_analysis","description":"Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi"},{"name":"tz_submission_media_list","description":"List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64."},{"name":"tz_download_sample","description":"Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f"},{"name":"tz_download_artifact","description":"Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil"},{"name":"tz_download_pcap","description":"Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path."},{"name":"tz_download_yara_rule","description":"Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64."},{"name":"tz_download_html_report","description":"Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review."},{"name":"tz_download_cdr","description":"Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat"},{"name":"tz_download_screenshot","description":"Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc"},{"name":"tz_download_media","description":"Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return"},{"name":"tz_submit_sandbox","description":"Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call "},{"name":"tz_submit_static","description":"Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get."},{"name":"tz_submit_cdr","description":"Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm"},{"name":"tz_submit_url","description":"Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have "},{"name":"tz_submit_open_in_browser","description":"Create an \"open in browser\" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages"}],"toolCount":64,"toolsHash":"e683b1b224451f2ef58c708e5d5fedd85d8b853964418723ec4a2521b9d0ea27","serverName":"threatzone-mcp","capabilities":["tools"],"serverVersion":"1.3.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T11:34:28.096Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":82,"error":null,"detail":{"tools":[{"name":"connect","description":"Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL"},{"name":"disconnect","description":"Disconnect from a VNC session"},{"name":"screenshot","description":"Capture the current VNC screen as an image"},{"name":"send_key","description":"Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers."},{"name":"type_text","description":"Type a string of text character by character"},{"name":"mouse_click","description":"Click the mouse at a specific position"},{"name":"mouse_move","description":"Move the mouse cursor to a specific position"},{"name":"mouse_drag","description":"Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints."},{"name":"scroll","description":"Scroll the mouse wheel at a specific position"},{"name":"get_screen_size","description":"Get the VNC screen dimensions"},{"name":"wait_for_screen_change","description":"Wait until the remote screen content changes or timeout"},{"name":"file_upload","description":"Upload a base64-encoded file to the remote machine via clipboard + shell commands"},{"name":"file_download","description":"Download a file from the remote machine as base64 via clipboard + shell commands"},{"name":"clipboard_write","description":"Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)"},{"name":"device_button","description":"Press an Android device button (RTC sessions only)"},{"name":"clipboard_read","description":"Read the last clipboard text received from the remote machine"},{"name":"tz_me","description":"Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co"},{"name":"tz_config_metafields","description":"All available metafield options across all submission types"},{"name":"tz_config_metafields_sandbox","description":"Sandbox-specific metafield options"},{"name":"tz_config_metafields_static","description":"Static analysis metafield options"},{"name":"tz_config_metafields_cdr","description":"CDR metafield options"},{"name":"tz_config_metafields_url","description":"URL analysis metafield options"},{"name":"tz_config_metafields_open_in_browser","description":"Open-in-browser metafield options"},{"name":"tz_config_environments","description":"Available sandbox OS environments and their feature flags"},{"name":"tz_network_configs_list","description":"Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig"},{"name":"tz_submissions_list","description":"List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with "},{"name":"tz_submission_get","description":"Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator "},{"name":"tz_submission_search_sha256","description":"Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi"},{"name":"tz_submission_summary","description":"High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count."},{"name":"tz_submission_indicators","description":"Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate."},{"name":"tz_submission_iocs","description":"Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages"},{"name":"tz_submission_yara_rules","description":"YARA rule hits during analysis. Paginated — does NOT auto-paginate."},{"name":"tz_submission_artifacts","description":"Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si"},{"name":"tz_submission_mitre","description":"MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped."},{"name":"tz_submission_extracted_configs","description":"Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors."},{"name":"tz_submission_eml_analysis","description":"EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions."},{"name":"tz_submission_processes","description":"Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime."},{"name":"tz_submission_process_tree","description":"Process spawn tree (parent–child relationships) captured during dynamic analysis."},{"name":"tz_submission_behaviours","description":"Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate."},{"name":"tz_submission_syscalls","description":"Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate."},{"name":"tz_submission_static_scan","description":"Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures."},{"name":"tz_submission_cdr","description":"CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u"},{"name":"tz_submission_signature_check","description":"Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level."},{"name":"tz_network_summary","description":"Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup."},{"name":"tz_network_dns","description":"DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro"},{"name":"tz_network_http","description":"HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` "},{"name":"tz_network_tcp","description":"TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_udp","description":"UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_threats","description":"Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass "},{"name":"tz_submission_url_analysis","description":"Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi"},{"name":"tz_submission_media_list","description":"List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64."},{"name":"tz_download_sample","description":"Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f"},{"name":"tz_download_artifact","description":"Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil"},{"name":"tz_download_pcap","description":"Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path."},{"name":"tz_download_yara_rule","description":"Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64."},{"name":"tz_download_html_report","description":"Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review."},{"name":"tz_download_cdr","description":"Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat"},{"name":"tz_download_screenshot","description":"Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc"},{"name":"tz_download_media","description":"Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return"},{"name":"tz_submit_sandbox","description":"Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call "},{"name":"tz_submit_static","description":"Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get."},{"name":"tz_submit_cdr","description":"Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm"},{"name":"tz_submit_url","description":"Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have "},{"name":"tz_submit_open_in_browser","description":"Create an \"open in browser\" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages"}],"toolCount":64,"toolsHash":"e683b1b224451f2ef58c708e5d5fedd85d8b853964418723ec4a2521b9d0ea27","serverName":"threatzone-mcp","capabilities":["tools"],"serverVersion":"1.3.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T04:27:08.689Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":83,"error":null,"detail":{"tools":[{"name":"connect","description":"Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL"},{"name":"disconnect","description":"Disconnect from a VNC session"},{"name":"screenshot","description":"Capture the current VNC screen as an image"},{"name":"send_key","description":"Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers."},{"name":"type_text","description":"Type a string of text character by character"},{"name":"mouse_click","description":"Click the mouse at a specific position"},{"name":"mouse_move","description":"Move the mouse cursor to a specific position"},{"name":"mouse_drag","description":"Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints."},{"name":"scroll","description":"Scroll the mouse wheel at a specific position"},{"name":"get_screen_size","description":"Get the VNC screen dimensions"},{"name":"wait_for_screen_change","description":"Wait until the remote screen content changes or timeout"},{"name":"file_upload","description":"Upload a base64-encoded file to the remote machine via clipboard + shell commands"},{"name":"file_download","description":"Download a file from the remote machine as base64 via clipboard + shell commands"},{"name":"clipboard_write","description":"Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)"},{"name":"device_button","description":"Press an Android device button (RTC sessions only)"},{"name":"clipboard_read","description":"Read the last clipboard text received from the remote machine"},{"name":"tz_me","description":"Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co"},{"name":"tz_config_metafields","description":"All available metafield options across all submission types"},{"name":"tz_config_metafields_sandbox","description":"Sandbox-specific metafield options"},{"name":"tz_config_metafields_static","description":"Static analysis metafield options"},{"name":"tz_config_metafields_cdr","description":"CDR metafield options"},{"name":"tz_config_metafields_url","description":"URL analysis metafield options"},{"name":"tz_config_metafields_open_in_browser","description":"Open-in-browser metafield options"},{"name":"tz_config_environments","description":"Available sandbox OS environments and their feature flags"},{"name":"tz_network_configs_list","description":"Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig"},{"name":"tz_submissions_list","description":"List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with "},{"name":"tz_submission_get","description":"Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator "},{"name":"tz_submission_search_sha256","description":"Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi"},{"name":"tz_submission_summary","description":"High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count."},{"name":"tz_submission_indicators","description":"Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate."},{"name":"tz_submission_iocs","description":"Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages"},{"name":"tz_submission_yara_rules","description":"YARA rule hits during analysis. Paginated — does NOT auto-paginate."},{"name":"tz_submission_artifacts","description":"Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si"},{"name":"tz_submission_mitre","description":"MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped."},{"name":"tz_submission_extracted_configs","description":"Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors."},{"name":"tz_submission_eml_analysis","description":"EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions."},{"name":"tz_submission_processes","description":"Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime."},{"name":"tz_submission_process_tree","description":"Process spawn tree (parent–child relationships) captured during dynamic analysis."},{"name":"tz_submission_behaviours","description":"Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate."},{"name":"tz_submission_syscalls","description":"Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate."},{"name":"tz_submission_static_scan","description":"Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures."},{"name":"tz_submission_cdr","description":"CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u"},{"name":"tz_submission_signature_check","description":"Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level."},{"name":"tz_network_summary","description":"Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup."},{"name":"tz_network_dns","description":"DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro"},{"name":"tz_network_http","description":"HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` "},{"name":"tz_network_tcp","description":"TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_udp","description":"UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_threats","description":"Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass "},{"name":"tz_submission_url_analysis","description":"Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi"},{"name":"tz_submission_media_list","description":"List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64."},{"name":"tz_download_sample","description":"Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f"},{"name":"tz_download_artifact","description":"Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil"},{"name":"tz_download_pcap","description":"Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path."},{"name":"tz_download_yara_rule","description":"Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64."},{"name":"tz_download_html_report","description":"Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review."},{"name":"tz_download_cdr","description":"Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat"},{"name":"tz_download_screenshot","description":"Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc"},{"name":"tz_download_media","description":"Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return"},{"name":"tz_submit_sandbox","description":"Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call "},{"name":"tz_submit_static","description":"Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get."},{"name":"tz_submit_cdr","description":"Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm"},{"name":"tz_submit_url","description":"Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have "},{"name":"tz_submit_open_in_browser","description":"Create an \"open in browser\" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages"}],"toolCount":64,"toolsHash":"e683b1b224451f2ef58c708e5d5fedd85d8b853964418723ec4a2521b9d0ea27","serverName":"threatzone-mcp","capabilities":["tools"],"serverVersion":"1.3.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-21T21:33:31.423Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":127,"error":null,"detail":{"tools":[{"name":"connect","description":"Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL"},{"name":"disconnect","description":"Disconnect from a VNC session"},{"name":"screenshot","description":"Capture the current VNC screen as an image"},{"name":"send_key","description":"Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers."},{"name":"type_text","description":"Type a string of text character by character"},{"name":"mouse_click","description":"Click the mouse at a specific position"},{"name":"mouse_move","description":"Move the mouse cursor to a specific position"},{"name":"mouse_drag","description":"Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints."},{"name":"scroll","description":"Scroll the mouse wheel at a specific position"},{"name":"get_screen_size","description":"Get the VNC screen dimensions"},{"name":"wait_for_screen_change","description":"Wait until the remote screen content changes or timeout"},{"name":"file_upload","description":"Upload a base64-encoded file to the remote machine via clipboard + shell commands"},{"name":"file_download","description":"Download a file from the remote machine as base64 via clipboard + shell commands"},{"name":"clipboard_write","description":"Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)"},{"name":"device_button","description":"Press an Android device button (RTC sessions only)"},{"name":"clipboard_read","description":"Read the last clipboard text received from the remote machine"},{"name":"tz_me","description":"Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co"},{"name":"tz_config_metafields","description":"All available metafield options across all submission types"},{"name":"tz_config_metafields_sandbox","description":"Sandbox-specific metafield options"},{"name":"tz_config_metafields_static","description":"Static analysis metafield options"},{"name":"tz_config_metafields_cdr","description":"CDR metafield options"},{"name":"tz_config_metafields_url","description":"URL analysis metafield options"},{"name":"tz_config_metafields_open_in_browser","description":"Open-in-browser metafield options"},{"name":"tz_config_environments","description":"Available sandbox OS environments and their feature flags"},{"name":"tz_network_configs_list","description":"Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig"},{"name":"tz_submissions_list","description":"List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with "},{"name":"tz_submission_get","description":"Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator "},{"name":"tz_submission_search_sha256","description":"Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi"},{"name":"tz_submission_summary","description":"High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count."},{"name":"tz_submission_indicators","description":"Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate."},{"name":"tz_submission_iocs","description":"Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages"},{"name":"tz_submission_yara_rules","description":"YARA rule hits during analysis. Paginated — does NOT auto-paginate."},{"name":"tz_submission_artifacts","description":"Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si"},{"name":"tz_submission_mitre","description":"MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped."},{"name":"tz_submission_extracted_configs","description":"Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors."},{"name":"tz_submission_eml_analysis","description":"EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions."},{"name":"tz_submission_processes","description":"Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime."},{"name":"tz_submission_process_tree","description":"Process spawn tree (parent–child relationships) captured during dynamic analysis."},{"name":"tz_submission_behaviours","description":"Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate."},{"name":"tz_submission_syscalls","description":"Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate."},{"name":"tz_submission_static_scan","description":"Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures."},{"name":"tz_submission_cdr","description":"CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u"},{"name":"tz_submission_signature_check","description":"Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level."},{"name":"tz_network_summary","description":"Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup."},{"name":"tz_network_dns","description":"DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro"},{"name":"tz_network_http","description":"HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` "},{"name":"tz_network_tcp","description":"TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_udp","description":"UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_threats","description":"Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass "},{"name":"tz_submission_url_analysis","description":"Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi"},{"name":"tz_submission_media_list","description":"List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64."},{"name":"tz_download_sample","description":"Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f"},{"name":"tz_download_artifact","description":"Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil"},{"name":"tz_download_pcap","description":"Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path."},{"name":"tz_download_yara_rule","description":"Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64."},{"name":"tz_download_html_report","description":"Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review."},{"name":"tz_download_cdr","description":"Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat"},{"name":"tz_download_screenshot","description":"Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc"},{"name":"tz_download_media","description":"Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return"},{"name":"tz_submit_sandbox","description":"Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call "},{"name":"tz_submit_static","description":"Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get."},{"name":"tz_submit_cdr","description":"Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm"},{"name":"tz_submit_url","description":"Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have "},{"name":"tz_submit_open_in_browser","description":"Create an \"open in browser\" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages"}],"toolCount":64,"toolsHash":"e683b1b224451f2ef58c708e5d5fedd85d8b853964418723ec4a2521b9d0ea27","serverName":"threatzone-mcp","capabilities":["tools"],"serverVersion":"1.3.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-21T11:26:30.494Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":67,"error":null,"detail":{"tools":[{"name":"connect","description":"Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL"},{"name":"disconnect","description":"Disconnect from a VNC session"},{"name":"screenshot","description":"Capture the current VNC screen as an image"},{"name":"send_key","description":"Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers."},{"name":"type_text","description":"Type a string of text character by character"},{"name":"mouse_click","description":"Click the mouse at a specific position"},{"name":"mouse_move","description":"Move the mouse cursor to a specific position"},{"name":"mouse_drag","description":"Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints."},{"name":"scroll","description":"Scroll the mouse wheel at a specific position"},{"name":"get_screen_size","description":"Get the VNC screen dimensions"},{"name":"wait_for_screen_change","description":"Wait until the remote screen content changes or timeout"},{"name":"file_upload","description":"Upload a base64-encoded file to the remote machine via clipboard + shell commands"},{"name":"file_download","description":"Download a file from the remote machine as base64 via clipboard + shell commands"},{"name":"clipboard_write","description":"Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)"},{"name":"device_button","description":"Press an Android device button (RTC sessions only)"},{"name":"clipboard_read","description":"Read the last clipboard text received from the remote machine"},{"name":"tz_me","description":"Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co"},{"name":"tz_config_metafields","description":"All available metafield options across all submission types"},{"name":"tz_config_metafields_sandbox","description":"Sandbox-specific metafield options"},{"name":"tz_config_metafields_static","description":"Static analysis metafield options"},{"name":"tz_config_metafields_cdr","description":"CDR metafield options"},{"name":"tz_config_metafields_url","description":"URL analysis metafield options"},{"name":"tz_config_metafields_open_in_browser","description":"Open-in-browser metafield options"},{"name":"tz_config_environments","description":"Available sandbox OS environments and their feature flags"},{"name":"tz_network_configs_list","description":"Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig"},{"name":"tz_submissions_list","description":"List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with "},{"name":"tz_submission_get","description":"Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator "},{"name":"tz_submission_search_sha256","description":"Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi"},{"name":"tz_submission_summary","description":"High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count."},{"name":"tz_submission_indicators","description":"Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate."},{"name":"tz_submission_iocs","description":"Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages"},{"name":"tz_submission_yara_rules","description":"YARA rule hits during analysis. Paginated — does NOT auto-paginate."},{"name":"tz_submission_artifacts","description":"Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si"},{"name":"tz_submission_mitre","description":"MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped."},{"name":"tz_submission_extracted_configs","description":"Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors."},{"name":"tz_submission_eml_analysis","description":"EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions."},{"name":"tz_submission_processes","description":"Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime."},{"name":"tz_submission_process_tree","description":"Process spawn tree (parent–child relationships) captured during dynamic analysis."},{"name":"tz_submission_behaviours","description":"Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate."},{"name":"tz_submission_syscalls","description":"Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate."},{"name":"tz_submission_static_scan","description":"Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures."},{"name":"tz_submission_cdr","description":"CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u"},{"name":"tz_submission_signature_check","description":"Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level."},{"name":"tz_network_summary","description":"Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup."},{"name":"tz_network_dns","description":"DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro"},{"name":"tz_network_http","description":"HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` "},{"name":"tz_network_tcp","description":"TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_udp","description":"UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_threats","description":"Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass "},{"name":"tz_submission_url_analysis","description":"Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi"},{"name":"tz_submission_media_list","description":"List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64."},{"name":"tz_download_sample","description":"Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f"},{"name":"tz_download_artifact","description":"Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil"},{"name":"tz_download_pcap","description":"Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path."},{"name":"tz_download_yara_rule","description":"Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64."},{"name":"tz_download_html_report","description":"Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review."},{"name":"tz_download_cdr","description":"Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat"},{"name":"tz_download_screenshot","description":"Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc"},{"name":"tz_download_media","description":"Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return"},{"name":"tz_submit_sandbox","description":"Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call "},{"name":"tz_submit_static","description":"Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get."},{"name":"tz_submit_cdr","description":"Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm"},{"name":"tz_submit_url","description":"Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have "},{"name":"tz_submit_open_in_browser","description":"Create an \"open in browser\" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages"}],"toolCount":64,"toolsHash":"e683b1b224451f2ef58c708e5d5fedd85d8b853964418723ec4a2521b9d0ea27","serverName":"threatzone-mcp","capabilities":["tools"],"serverVersion":"1.3.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-21T02:27:49.483Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":73,"error":null,"detail":{"tools":[{"name":"connect","description":"Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL"},{"name":"disconnect","description":"Disconnect from a VNC session"},{"name":"screenshot","description":"Capture the current VNC screen as an image"},{"name":"send_key","description":"Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers."},{"name":"type_text","description":"Type a string of text character by character"},{"name":"mouse_click","description":"Click the mouse at a specific position"},{"name":"mouse_move","description":"Move the mouse cursor to a specific position"},{"name":"mouse_drag","description":"Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints."},{"name":"scroll","description":"Scroll the mouse wheel at a specific position"},{"name":"get_screen_size","description":"Get the VNC screen dimensions"},{"name":"wait_for_screen_change","description":"Wait until the remote screen content changes or timeout"},{"name":"file_upload","description":"Upload a base64-encoded file to the remote machine via clipboard + shell commands"},{"name":"file_download","description":"Download a file from the remote machine as base64 via clipboard + shell commands"},{"name":"clipboard_write","description":"Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)"},{"name":"device_button","description":"Press an Android device button (RTC sessions only)"},{"name":"clipboard_read","description":"Read the last clipboard text received from the remote machine"},{"name":"tz_me","description":"Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co"},{"name":"tz_config_metafields","description":"All available metafield options across all submission types"},{"name":"tz_config_metafields_sandbox","description":"Sandbox-specific metafield options"},{"name":"tz_config_metafields_static","description":"Static analysis metafield options"},{"name":"tz_config_metafields_cdr","description":"CDR metafield options"},{"name":"tz_config_metafields_url","description":"URL analysis metafield options"},{"name":"tz_config_metafields_open_in_browser","description":"Open-in-browser metafield options"},{"name":"tz_config_environments","description":"Available sandbox OS environments and their feature flags"},{"name":"tz_network_configs_list","description":"Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig"},{"name":"tz_submissions_list","description":"List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with "},{"name":"tz_submission_get","description":"Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator "},{"name":"tz_submission_search_sha256","description":"Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi"},{"name":"tz_submission_summary","description":"High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count."},{"name":"tz_submission_indicators","description":"Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate."},{"name":"tz_submission_iocs","description":"Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages"},{"name":"tz_submission_yara_rules","description":"YARA rule hits during analysis. Paginated — does NOT auto-paginate."},{"name":"tz_submission_artifacts","description":"Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si"},{"name":"tz_submission_mitre","description":"MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped."},{"name":"tz_submission_extracted_configs","description":"Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors."},{"name":"tz_submission_eml_analysis","description":"EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions."},{"name":"tz_submission_processes","description":"Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime."},{"name":"tz_submission_process_tree","description":"Process spawn tree (parent–child relationships) captured during dynamic analysis."},{"name":"tz_submission_behaviours","description":"Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate."},{"name":"tz_submission_syscalls","description":"Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate."},{"name":"tz_submission_static_scan","description":"Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures."},{"name":"tz_submission_cdr","description":"CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u"},{"name":"tz_submission_signature_check","description":"Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level."},{"name":"tz_network_summary","description":"Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup."},{"name":"tz_network_dns","description":"DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro"},{"name":"tz_network_http","description":"HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` "},{"name":"tz_network_tcp","description":"TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_udp","description":"UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_threats","description":"Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass "},{"name":"tz_submission_url_analysis","description":"Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi"},{"name":"tz_submission_media_list","description":"List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64."},{"name":"tz_download_sample","description":"Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f"},{"name":"tz_download_artifact","description":"Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil"},{"name":"tz_download_pcap","description":"Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path."},{"name":"tz_download_yara_rule","description":"Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64."},{"name":"tz_download_html_report","description":"Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review."},{"name":"tz_download_cdr","description":"Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat"},{"name":"tz_download_screenshot","description":"Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc"},{"name":"tz_download_media","description":"Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return"},{"name":"tz_submit_sandbox","description":"Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call "},{"name":"tz_submit_static","description":"Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get."},{"name":"tz_submit_cdr","description":"Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm"},{"name":"tz_submit_url","description":"Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have "},{"name":"tz_submit_open_in_browser","description":"Create an \"open in browser\" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages"}],"toolCount":64,"toolsHash":"e683b1b224451f2ef58c708e5d5fedd85d8b853964418723ec4a2521b9d0ea27","serverName":"threatzone-mcp","capabilities":["tools"],"serverVersion":"1.3.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"connect","description":"Connect to a Threat.Zone session by submission UUID, submission URL, cloudvnc URL, or raw websockify URL"},{"name":"disconnect","description":"Disconnect from a VNC session"},{"name":"screenshot","description":"Capture the current VNC screen as an image"},{"name":"send_key","description":"Send a keyboard key press. Supports key names (Return, Escape, F1, a), hex keysyms (0xff0d), and modifiers."},{"name":"type_text","description":"Type a string of text character by character"},{"name":"mouse_click","description":"Click the mouse at a specific position"},{"name":"mouse_move","description":"Move the mouse cursor to a specific position"},{"name":"mouse_drag","description":"Drag the mouse from one position to another with button held. Supports bezier curves via controlPoints."},{"name":"scroll","description":"Scroll the mouse wheel at a specific position"},{"name":"get_screen_size","description":"Get the VNC screen dimensions"},{"name":"wait_for_screen_change","description":"Wait until the remote screen content changes or timeout"},{"name":"file_upload","description":"Upload a base64-encoded file to the remote machine via clipboard + shell commands"},{"name":"file_download","description":"Download a file from the remote machine as base64 via clipboard + shell commands"},{"name":"clipboard_write","description":"Send text to the remote machine's clipboard (UTF-8 with Extended Clipboard, Latin-1 fallback)"},{"name":"device_button","description":"Press an Android device button (RTC sessions only)"},{"name":"clipboard_read","description":"Read the last clipboard text received from the remote machine"},{"name":"tz_me","description":"Get account information for the authenticated API token: user details, workspace, subscription plan, current usage counters (API requests, daily submissions, co"},{"name":"tz_config_metafields","description":"All available metafield options across all submission types"},{"name":"tz_config_metafields_sandbox","description":"Sandbox-specific metafield options"},{"name":"tz_config_metafields_static","description":"Static analysis metafield options"},{"name":"tz_config_metafields_cdr","description":"CDR metafield options"},{"name":"tz_config_metafields_url","description":"URL analysis metafield options"},{"name":"tz_config_metafields_open_in_browser","description":"Open-in-browser metafield options"},{"name":"tz_config_environments","description":"Available sandbox OS environments and their feature flags"},{"name":"tz_network_configs_list","description":"Workspace network configurations (proxy/VPN profiles); use the returned ObjectId in tz_submit_sandbox/tz_submit_open_in_browser configurations.networkConfig"},{"name":"tz_submissions_list","description":"List submissions in your workspace with rich filtering. Returns paginated `{ items, total, page, limit, totalPages }`. Does NOT auto-paginate — call again with "},{"name":"tz_submission_get","description":"Get full submission detail by UUID: file metadata, hashes, verdict level, all attached reports (dynamic/static/cdr/url_analysis) with status + score, indicator "},{"name":"tz_submission_search_sha256","description":"Find submissions matching the exact SHA256 hash (across your workspace + public submissions from other workspaces), in reverse creation order. Returns `Submissi"},{"name":"tz_submission_summary","description":"High-level submission verdict rollup: overall analysis status, per-module score and verdict counts, indicator level rollup, and matched MITRE technique count."},{"name":"tz_submission_indicators","description":"Behavioural detection indicators from dynamic analysis, paginated. Returns `{ items, total, page, limit, totalPages }` — does NOT auto-paginate."},{"name":"tz_submission_iocs","description":"Indicators of Compromise extracted from analysis: IPs, domains, URLs, hashes, registry keys, file paths, etc. Paginated `{ items, total, page, limit, totalPages"},{"name":"tz_submission_yara_rules","description":"YARA rule hits during analysis. Paginated — does NOT auto-paginate."},{"name":"tz_submission_artifacts","description":"Full artifact list for the submission: original sample, dropped files, memory dumps, PCAPs, generated YARA rules, and CDR-sanitized variants. NOT paginated — si"},{"name":"tz_submission_mitre","description":"MITRE ATT&CK technique mappings observed during dynamic analysis. Returns an empty techniques array if none mapped."},{"name":"tz_submission_extracted_configs","description":"Extracted malware configuration data (C2 endpoints, encryption keys, family-specific config) parsed by family-aware extractors."},{"name":"tz_submission_eml_analysis","description":"EML/MSG email analysis results: headers, attachments, embedded URLs, sender reputation. Returns 409 DYNAMIC_REPORT_UNAVAILABLE for non-email submissions."},{"name":"tz_submission_processes","description":"Flat process list captured during dynamic analysis: PID, parent PID, image path, command line, lifetime."},{"name":"tz_submission_process_tree","description":"Process spawn tree (parent–child relationships) captured during dynamic analysis."},{"name":"tz_submission_behaviours","description":"Behaviour events captured during dynamic analysis (file/registry/network/process/mutex). Paginated — does NOT auto-paginate."},{"name":"tz_submission_syscalls","description":"Raw syscall trace from dynamic analysis. Paginated with default `limit=500` — does NOT auto-paginate."},{"name":"tz_submission_static_scan","description":"Static analysis scan results per artifact: PE info, embedded strings, sections, imports/exports, signatures."},{"name":"tz_submission_cdr","description":"CDR (Content Disarm & Reconstruction) analysis metadata: threat level, disarmed element counts, per-element details. To download the sanitized CDR output FILE u"},{"name":"tz_submission_signature_check","description":"Code-signing signature verification per artifact: signer info, certificate chain, validity, and trust level."},{"name":"tz_network_summary","description":"Network activity summary captured during dynamic analysis: per-protocol counts (DNS, HTTP, TCP, UDP) and threat detection rollup."},{"name":"tz_network_dns","description":"DNS queries observed during dynamic analysis (query, response, type). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` to advance thro"},{"name":"tz_network_http","description":"HTTP request endpoints observed during dynamic analysis (method, URL, status, host). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass `skip: N` "},{"name":"tz_network_tcp","description":"TCP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_udp","description":"UDP connections observed during dynamic analysis (source IP/port, destination IP/port, byte counts). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`."},{"name":"tz_network_threats","description":"Suricata-style network threat detections from dynamic analysis (signature, severity, src/dst). Uses `limit`/`skip` offset pagination — NOT `page`/`limit`. Pass "},{"name":"tz_submission_url_analysis","description":"Full URL analysis report (page screenshot reference, certificate, redirect chain, threat verdict). Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submi"},{"name":"tz_submission_media_list","description":"List media files (screenshots, videos) captured during dynamic analysis. Use `tz_download_media` (Task 11) to fetch individual files as base64."},{"name":"tz_download_sample","description":"Download the original submission sample as a password-protected ZIP. The ZIP password is `infected` (industry standard for malware sandboxing). Returns base64 f"},{"name":"tz_download_artifact","description":"Download a specific artifact (dropped file, memory dump, etc.) by its MongoDB ObjectId. Get the artifact_id from tz_submission_artifacts. Returns base64 for fil"},{"name":"tz_download_pcap","description":"Download the network packet capture (PCAP) from dynamic analysis. PCAPs can be very large for long analyses — recommend passing save_to with an absolute path."},{"name":"tz_download_yara_rule","description":"Download the auto-generated YARA rule file produced from the analysis. Small text payload — typically returned inline as base64."},{"name":"tz_download_html_report","description":"Download the full HTML analysis report (rendered, ready to share). Useful for archival or human review."},{"name":"tz_download_cdr","description":"Download the CDR (Content Disarm & Reconstruction) sanitized output file — the reconstructed safe version of the input document. To get the CDR analysis metadat"},{"name":"tz_download_screenshot","description":"Download the URL analysis screenshot as PNG. Returns 409 URL_ANALYSIS_REPORT_UNAVAILABLE for non-URL submissions. For sandbox/open-in-browser media (multiple sc"},{"name":"tz_download_media","description":"Download a specific media file (screenshot or video clip) captured during dynamic analysis by its file_id. Get the file_id from tz_submission_media_list. Return"},{"name":"tz_submit_sandbox","description":"Create a sandbox analysis submission (full static + dynamic). Consumes one daily submission slot from your plan. Returns the submission UUID and message — call "},{"name":"tz_submit_static","description":"Create a static-only analysis submission. Faster than sandbox (no dynamic execution). Returns the submission UUID and message — poll with tz_submission_get."},{"name":"tz_submit_cdr","description":"Create a CDR (Content Disarm & Reconstruction) submission. The output is a sanitized version of the input document with active content removed. Returns the subm"},{"name":"tz_submit_url","description":"Create a URL analysis submission. The crawler fetches the URL, captures screenshot, follows redirects, checks certs and threat lists. Only submit URLs you have "},{"name":"tz_submit_open_in_browser","description":"Create an \"open in browser\" submission. The URL becomes the entrypoint for a sandboxed browser session — useful for credential-harvesting kits and exploit pages"}],"package":null,"toolSurface":{"id":"ts_zsgqetp4kmmw","endpointId":"ep_ewggnfwbwsmu","hash":"e683b1b224451f2ef58c708e5d5fedd85d8b853964418723ec4a2521b9d0ea27","toolCount":64,"serverName":"threatzone-mcp","serverVersion":"1.3.0","protocolVersion":"2025-06-18","firstSeenAt":"2026-10-01T00:32:12.989Z","lastSeenAt":"2026-10-23T20:25:27.894Z","observations":83,"toolNames":["connect","disconnect","screenshot","send_key","type_text","mouse_click","mouse_move","mouse_drag","scroll","get_screen_size","wait_for_screen_change","file_upload","file_download","clipboard_write","device_button","clipboard_read","tz_me","tz_config_metafields","tz_config_metafields_sandbox","tz_config_metafields_static","tz_config_metafields_cdr","tz_config_metafields_url","tz_config_metafields_open_in_browser","tz_config_environments","tz_network_configs_list","tz_submissions_list","tz_submission_get","tz_submission_search_sha256","tz_submission_summary","tz_submission_indicators","tz_submission_iocs","tz_submission_yara_rules","tz_submission_artifacts","tz_submission_mitre","tz_submission_extracted_configs","tz_submission_eml_analysis","tz_submission_processes","tz_submission_process_tree","tz_submission_behaviours","tz_submission_syscalls","tz_submission_static_scan","tz_submission_cdr","tz_submission_signature_check","tz_network_summary","tz_network_dns","tz_network_http","tz_network_tcp","tz_network_udp","tz_network_threats","tz_submission_url_analysis","tz_submission_media_list","tz_download_sample","tz_download_artifact","tz_download_pcap","tz_download_yara_rule","tz_download_html_report","tz_download_cdr","tz_download_screenshot","tz_download_media","tz_submit_sandbox","tz_submit_static","tz_submit_cdr","tz_submit_url","tz_submit_open_in_browser"],"distinctSurfaces":1},"endpointFacts":[{"id":"ep_ewggnfwbwsmu","url":"https://app.threat.zone/mcp","type":"mcp_streamable_http","factsCheckedAt":"2026-10-16T23:23:57.506Z","auth":{"observedAt":"2026-10-16T23:23:57.541Z","authRequired":false,"scheme":null,"resourceMetadata":null,"authorizationServer":null,"conformance":{"dpop":false,"rfc8414":false,"rfc9728":false,"pkceS256":false,"clientIdMetadataDocument":false,"dynamicClientRegistration":false}},"tls":{"observedAt":"2026-10-16T23:23:57.553Z","protocol":"TLSv1.3","chainValid":true,"chainError":null,"hostMatches":true,"subject":"threat.zone","issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validFrom":"2026-09-05T14:47:11.000Z","validTo":"2026-12-04T15:46:57.000Z","daysToExpiry":41,"sanCount":2,"fingerprint256":"CB:D3:FB:CA:2C:7B:55:6C:3E:39:67:46:F0:1B:2A:95:78:F1:57:AB:69:DD:A5:5B:48:21:0C:B6:76:1C:4E:0E"}}]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"ard_catalog","key":"urn:air:threat.zone:mcp:threatzone","url":"https://threat.zone/.well-known/ai-catalog.json","firstSeenAt":"2026-10-01T00:26:14.794Z","fetchedAt":"2026-10-19T05:30:56.688Z","normalizedAt":"2026-10-19T05:30:56.688Z"}]},"firstSeenAt":"2026-10-01T00:26:14.794Z","updatedAt":"2026-10-23T20:29:21.885Z"}