MalwareBazaar

liveSecurity

abuse.ch malware sample metadata — search by hash, tag, family, or signature.

5tools
0msauth
free tier50 calls/day

Tools

get_sample_inforequired: hash

Sample metadata by hash.

Parameters
NameTypeDescription
hashreqstringmd5/sha1/sha256
▶Try it
search_tagrequired: tag

Samples tagged with a string.

Parameters
NameTypeDescription
tagreqstringTag
limitoptnumberMax results
▶Try it
search_familyrequired: family

Samples by malware family.

Parameters
NameTypeDescription
familyreqstringFamily name
limitoptnumberMax results
▶Try it
search_signaturerequired: signature

Samples matching a YARA signature.

Parameters
NameTypeDescription
signaturereqstringSignature name
limitoptnumberMax results
▶Try it
recent_samples

Most recent samples.

Parameters
NameTypeDescription
selectoroptstringtime | 100
▶Try it

Test with curl

The gateway speaks JSON-RPC 2.0 over HTTP POST. You can test any pack directly from the terminal.

List available tools
bash
curl -X POST https://gateway.pipeworx.io/malwarebazaar/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Call a tool
bash
curl -X POST https://gateway.pipeworx.io/malwarebazaar/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_sample_info","arguments":{"hash": "example"}}}'

Use with the SDK

Install @pipeworx/sdk to call tools from any TypeScript/Node project.

TypeScript
import { Pipeworx } from '@pipeworx/sdk';
const px = new Pipeworx();
const result = await px.call("get_sample_info", {"hash":"example"});
ask_pipeworx
// Or ask in plain English:
const answer = await px.ask("abuse");