YaraFlux MCP Server
About
An MCP server for YARA scanning, enabling LLMs to analyze files using YARA rules.
Details
- Author
- ThreatFlux
- GitHub stars
- 23
- Downloads
- 196
- Categories
- Other, File Management, Security
Jump to
- 19 integrated MCP tools for scanning, rule management, and file handling
- YARA rule creation, validation, import, update, and deletion
- URL and file content scanning with detailed match information
- Secure file upload, storage, and analysis (hex view, string extraction)
- Storage backends: local filesystem and MinIO/S3
- JWT authentication and non-root container execution
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
YaraFlux MCP ServerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Run it with Docker (docker pull threatflux/yaraflux-mcp-server:latest and docker run with the required JWT_SECRET_KEY, ADMIN_PASSWORD, and DEBUG environment variables) or install from source (requires Python 3.13+, then make install and make run). For Claude Desktop, add a docker entry to claude_desktop_config.json with the appropriate environment variables and auto-approved tools.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"yaraflux mcp server": {
"YaraFlux": {
"command": "docker",
"args": [
"pull",
"threatflux/yaraflux-mcp-server:latest"
]
}
}
}
}McpServers
{
"YaraFlux": {
"command": "docker",
"args": [
"pull",
"threatflux/yaraflux-mcp-server:latest"
]
}
}YaraFlux MCP Server
A Model Context Protocol (MCP) server for YARA scanning, providing LLMs with capabilities to analyze files with YARA rules.
📋 Overview
YaraFlux MCP Server enables AI assistants to perform YARA rule-based threat analysis through the standardized Model Context Protocol interface. The server integrates YARA scanning with modern AI assistants, supporting comprehensive rule management, secure scanning, and detailed result analysis through a modular architecture.
🧩 Architecture Overview
+------------------------------------------+
| AI Assistant |
+--------------------+---------------------+
|
| Model Context Protocol
|
+--------------------v---------------------+
| YaraFlux MCP Server |
| |
| +----------------+ +---------------+ |
| | MCP Server | | Tool Registry | |
| +-------+--------+ +-------+-------+ |
| | | |
| +-------v--------+ +-------v-------+ |
| | YARA Service | | Storage Layer | |
| +----------------+ +---------------+ |
| |
+------------------------------------------+
| |
+-----------------+ +---------------+
| YARA Engine | | Storage |
| - Rule Compiling| | - Local FS |
| - File Scanning | | - MinIO/S3 |
+-----------------+ +---------------+
YaraFlux follows a modular architecture that separates concerns between:
- MCP Integration Layer: Handles communication with AI assistants
- Tool Implementation Layer: Implements YARA scanning and management functionality
- Storage Abstraction Layer: Provides flexible storage options
- YARA Engine Integration: Leverages YARA for scanning and rule management
For detailed architecture diagrams, see the Architecture Documentation.
✨ Features
- 🔄 Modular Architecture
- Clean separation of MCP integration, tool implementation, and storage
- Standardized parameter parsing and error handling
- Flexible storage backend with local and S3/MinIO options
- 🤖 MCP Integration
- 19 integrated MCP tools for comprehensive functionality
- Optimized for Claude Desktop integration
- Direct file analysis from within conversations
- Compatible with latest MCP protocol specification
- 🔍 YARA Scanning
- URL and file content scanning
- Detailed match information with context
- Scan result storage and retrieval
- Performance-optimized scanning engine
- 📝 Rule Management
- Create, read, update, delete YARA rules
- Rule validation with detailed error reporting
- Import rules from ThreatFlux repository
- Categorization by source (custom vs. community)
- 📊 File Analysis
- Hexadecimal view for binary analysis
- String extraction with configurable parameters
- File metadata and hash information
- Secure file upload and storage
- 🔐 Security Features
- JWT authentication for API access
- Non-root container execution
- Secure storage isolation
- Configurable access controls
🚀 Quick Start
Using Docker Image
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
