OLETools Secure MCP Server
About
Secure MCP server for analyzing Excel files with oletools
Explore
Analyzes VBA Macros (olevba)
Detects XLM Macros (XLMMacroDeobfuscator, olevba)
Checks for DDE Links (msodde)
Extracts embedded OLE Objects (oleobj)
Analyzes XLL file exports for suspicious functions (pefile)
Extracts IOCs (URLs, IPs, Hashes, Emails) using iocextract
Provides basic MIME type and file size validation (python-magic)
Uses a configurable scoring system for basic risk classification
- Designed for integration with systems supporting the MCP protocol (like compatible versions of Claude Desktop).
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
OLETools Secure MCP ServerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
- Python 3.6+
- OLETools: Install via pip install oletools
- XLMMacroDeobfuscator: Install via pip install XLMMacroDeobfuscator
- python-magic: Install via pip install python-magic-bin (Windows)
- iocextract (optional): Install via pip install iocextract for advanced IOC extraction
- Claude Desktop application
This project provides a secure microservice using FastMCP to analyze Microsoft Office documents (Excel, Word, PowerPoint) and related file types (like XLL add-ins) for potential malicious content using static analysis techniques. It leverages external tools like oletools, XLMMacroDeobfuscator, and pefile.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"oletools secure mcp server": {
"oletools-mcp-server": {
"command": "python",
"args": [
"config.py"
]
}
}
}
}McpServers
{
"oletools-mcp-server": {
"command": "python",
"args": [
"config.py"
]
}
}This project provides a secure microservice using FastMCP to analyze Microsoft Office documents (Excel, Word, PowerPoint) and related file types (like XLL add-ins) for potential malicious content using static analysis techniques. It leverages external tools like oletools, XLMMacroDeobfuscator, and pefile.
Features
Analyzes VBA Macros (olevba)
Detects XLM Macros (XLMMacroDeobfuscator, olevba)
Checks for DDE Links (msodde)
Extracts embedded OLE Objects (oleobj)
Analyzes XLL file exports for suspicious functions (pefile)
Extracts IOCs (URLs, IPs, Hashes, Emails) using iocextract
Provides basic MIME type and file size validation (python-magic)
Uses a configurable scoring system for basic risk classification
- Designed for integration with systems supporting the MCP protocol (like compatible versions of Claude Desktop).
Prerequisites
- Python 3.6+ - OLETools: Install viapip install oletools
- XLMMacroDeobfuscator: Install via pip install XLMMacroDeobfuscator
- python-magic: Install via pip install python-magic-bin (Windows)
- iocextract (optional): Install via pip install iocextract for advanced IOC extraction
- Claude Desktop application
Installation
1. Clone the Repository:
git clone https://github.com/pradeep895/oletools-mcp-server.git
cd oletools-mcp-server
2. Install Dependencies:
pip install -r requirements.txt
3. Download the "Claude Desktop" application go to the Developer settings and Edit the "claude_desktop_config.json" file and paste content in the configuration.json file.Restart the application.
4. Run the config file:
python config.py
6. Run the server:
python mcp_service.py
9. Go to "Claude Desktop" application and check for the "hammer symbol" it appeared means MCP tools are available.
10. type "analyze_vba_macros in <filepath\example.xlsm>" this will help you to analyze the excel file statically and gave you the findings.
analyze_vba_macros file_path:"C:\path\to\your\example.xlsm"
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
