Qu1cksc0pe MCP Server: Setup for Claude Code, Cursor and Other Apps

• Runs the full static analysis on a suspicious file

  Works out what kind of file it is (Windows program, Linux binary, Android app, script, shortcut, email, capture file) and runs Qu1cksc0pe's complete static analysis, then returns a JSON report. It can also summarize the report with an AI model.

  Try: “Analyze /home/me/samples/invoice.exe and tell me what looks suspicious.”

  Runs code · analyze_file

• Analyzes macro and script-family documents

  Analyzes Office documents and script files such as .doc, .xls, .vbs and .bas, the kinds that often hide macros. Returns a JSON report.

  Try: “Check /home/me/samples/report.docm for malicious macros.”

  Runs code · analyze_document

• Lists and scans the contents of an archive

  Lists what is inside a .zip, .rar or .ace file and scans the files nested in it for indicators of compromise and YARA matches.

  Try: “Look inside /home/me/samples/parcel.zip and scan every file.”

  Runs code · analyze_archive

• Checks if a binary is packed

  Checks whether one binary, or every file in a folder, was packed with a known packer. Packing is a common way to hide malware.

  Try: “Is /home/me/samples/dropper.exe packed?”

  Runs code · detect_packer

• Guesses the language a binary was built with

  Fingerprints the programming language used to build a binary, such as Go, Rust or Delphi.

  Try: “What language was /home/me/samples/tool.bin written in?”

  Runs code · detect_language

• Pulls URLs, IPs and emails out of a file

  Extracts the URLs, IP addresses and email addresses embedded in a file, which helps you spot where it phones home.

  Try: “List every URL and IP address inside /home/me/samples/update.exe.”

  Runs code · extract_iocs

• Inspects the resources inside a Windows file

  Extracts and inspects the resources of a Windows PE file, such as icons, manifests and hidden payloads. It returns console output only.

  Try: “Check the embedded resources of /home/me/samples/setup.exe.”

  Runs code · check_resources

• Looks for files hidden inside a file

  Scans a file for embedded file signatures, for example an EXE tucked inside another file type. It returns console output only.

  Try: “Does /home/me/samples/image.png hide another file inside?”

  Runs code · check_signatures

• Checks a file against a local malware hash list

  Looks up the MD5 of one file, or of every file in a folder, in the local malware hash database. It needs the database from update_hash_database first.

  Try: “Check every file in /home/me/samples against the hash database.”

  Runs code · scan_hash

• Looks up a file's hash on VirusTotal

  Looks up the hash of a file on VirusTotal. The file itself is not uploaded. It needs a VirusTotal API key saved first.

  Try: “Look up /home/me/samples/invoice.exe on VirusTotal.”

  Runs code · scan_virustotal

• Saves your VirusTotal API key

  Saves a VirusTotal API key to a file in your home folder (~/sc0pe_Base) for scan_virustotal to use. The key is not echoed back.

  Try: “Save my VirusTotal key for Qu1cksc0pe.”

  Runs code · configure_virustotal_api_key

• Saves a cloud AI provider key

  Saves a key for Claude, OpenAI, DeepSeek, Kimi or GLM to a file in your home folder, so the analysis tools can send reports to that provider for a summary.

  Try: “Save my OpenAI key for Qu1cksc0pe.”

  Runs code · configure_ai_api_key

• Downloads the malware hash list

  Downloads or refreshes the local malware hash database that scan_hash needs.

  Try: “Update the Qu1cksc0pe hash database.”

  Runs code · update_hash_database

• Lists the file types and which tool fits

  Returns the file types Qu1cksc0pe recognizes and which tool to use for each. It returns a fixed list.

  Try: “Which Qu1cksc0pe tool should I use for an .lnk file?”

  Read · list_supported_file_types

Watch out for

• Two tools take API keys through chat

  configure_virustotal_api_key and configure_ai_api_key save keys to files in your home folder. Set the key with an environment variable or run the key command in a terminal instead of pasting it into a chat. github.com

• Cloud AI summaries send report data out

  If you pick a cloud ai_provider on an analysis tool, the report leaves your machine. The default is local Ollama. Keep the default for confidential samples. github.com

• It writes reports and logs to disk

  Each analysis writes JSON reports under sc0pe_reports, and every call is logged to sc0pe_reports/mcp/mcp_server.log. Set SC0PE_MCP_LOG_FILE=0 to turn the log file off. github.com

• It reads real malware samples

  The tools are static analysis, and the tool descriptions say script emulation runs in memory with nothing executed. The files are still malware, so avoid opening them by hand. github.com

Security advisories