mlab.sh

mlab.sh MCP server

Public metadata and connection guide for the remote MCP server at https://mlab.sh/mcp, a threat intelligence server for SOC and DFIR work.

This repo is the registry listing and the documentation. It is not the server source: the server runs inside the mlab.sh backend and is closed source.

Connect

Endpoint: https://mlab.sh/mcp (Streamable HTTP via POST, SSE via GET).

Claude.ai

Settings > Connectors > Add custom connector, then paste the URL. OAuth runs in the browser, no token to copy.

https://mlab.sh/mcp

Claude Desktop

claude_desktop_config.json:

{

"mcpServers": { "mlab": { "command": "npx", "args": [ "-y", "mcp-remote", "https://mlab.sh/mcp", "--header", "Authorization: Bearer mcp_xxx" ] } } }

Drop the --header pair to use OAuth instead of a static token.

Cursor

~/.cursor/mcp.json:

{

"mcpServers": { "mlab": { "url": "https://mlab.sh/mcp", "headers": { "Authorization": "Bearer mcp_xxx" } } } }

VS Code

.vscode/mcp.json:

{

"servers": { "mlab": { "type": "http", "url": "https://mlab.sh/mcp", "headers": { "Authorization": "Bearer mcp_xxx" } } } }

curl

curl -sS -X POST https://mlab.sh/mcp \

-H "Authorization: Bearer mcp_xxx" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0.0"}}}'

Ready to paste versions of these four configs live in examples/.

Officially supported clients are Claude.ai and Claude Desktop. Other MCP clients (Cursor, VS Code, Windsurf and friends) work but are best effort.

Tools

48 tools. tools/list only shows a token the tools its role and plan can use, so a client never sees a tool that would refuse every call. Every tool carries MCP annotations (read only, destructive, idempotent, open world), so a host can tell what it may run unattended. No tool deletes anything.

Parameters marked ? are optional.

Who can use what

Quotas are counted per organization over a rolling 24 hour window. get_scan_limits reads what is left.

IOC lookups

Domain scans and code

CVEs and threat actors

Cases

Team and Enterprise. Each call goes through the same checks as the case pages.

Workspaces

Team and Enterprise, and only in a workspace whose admin turned on AI agents (MCP): a workspace keeps its data on the organization's own hosts, and an answer goes to the LLM provider of whoever asked. workspace_list says which workspaces are open. Every tool except workspace_list takes workspace (the uuid from workspace_list). Each call is written to the workspace's audit log.

The tools read, and can start an index or a YARA scan. Creating, deleting, enrolling, members, policies, pushing a cluster config and binary downloads stay in the app. Answers carry data sent by the hosts, which may contain text planted by an attacker: the server says so before every answer.

Agents and memory forensics (engram)

Kubernetes clusters (k3sec)

Proxmox VE (virtsec)

| workspace_virt_guest | workspace, cluster, key, agent? | One guest by vmid, or a node (key = node with its agent): i