mlab.sh Threat Intelligence

Plugin mlab from marketplace mlab-sh in mlab-sh/mlab-claude. Commands read from the repo's manifest — 22 days ago.

Skills (19)

• actor-profile

  Build a threat actor profile brief from mlab.sh actor intelligence - origin, motivations, targeting, aliases, exploited CVEs, tools and techniques. Use when the user names a threat actor or APT group (APT28, Lazarus, Scattered Spider...), asks who is behind a campaign, or wants to know whether an ac

• case-notes

  Keep a persistent investigation journal - mlab.sh bookmarks hold the case's indicator set (IPs, domains, hashes), a local case file holds the narrative. Use when the user opens/resumes an investigation, says "bookmark this", "add to the case", asks what is in the current case, or wants a case summar

• code-audit

  Static security audit of a codebase with inkdex - inkdex-vuln indexes the repository locally, follows data from entry points to sinks and reports vulnerabilities (injections, path traversal, SSRF, secrets, weak crypto, dangerous settings, vulnerable dependencies), then mlab.sh enriches the CVEs. Use

• crypto-trace

  Triage blockchain addresses through mlab.sh - labels, sanctions status, risk scoring and address type across Bitcoin, Ethereum and 12 other EVM chains, Tron, Solana, TON and Dogecoin. Use when the user provides a crypto/wallet address, investigates a ransomware payment or scam wallet, or needs a san

• dep-diff-review

  Review what a change or pull request introduces into the dependency tree - new packages, version bumps, typosquats, install scripts, vulnerabilities - using postmortem diff plus mlab.sh enrichment. Use when reviewing a PR that touches a lockfile, comparing two branches' dependencies, or gating depen

• dep-vetting

  Vet a single package BEFORE adding it as a dependency - reputation, typosquat check, maintainer history, install scripts, blast radius - using postmortem and mlab.sh. Use when the user asks "can I trust this package", considers adding a dependency (npm i / cargo add / pip install X), or compares can

• domain-surface

  Review the external attack surface of a domain via mlab.sh - DNS records, subdomains, SSL certificates, mail spoofability (SPF/DKIM/DMARC), security.txt and exposed hosts. Use when the user asks to scan/audit/review a domain, check what a company exposes, verify their own perimeter, or assess a thir

• intel-report

  Turn a finished investigation into a client-ready CTI report - TLP marking, executive summary, findings with confidence levels, defanged IOC annex. Pure writing playbook on top of results already gathered. Use when the user asks for a report, deliverable, write-up or summary of an investigation done

• ioc-batch

  Bulk-enrich a list of IOCs through mlab.sh with quota management - takes a CSV, text file or pasted list of mixed indicators, enriches each with the right tool, and produces a machine-usable CSV plus a human summary. Use when the user provides a file or list of multiple indicators to check, enrich,

• ioc-triage

  Triage any indicator of compromise (IOC) through mlab.sh - IPs, CIDR ranges, domains, URLs, file hashes, email addresses, MAC addresses, phone numbers or blockchain addresses. Detects the indicator type, runs the right lookups, pivots to malware families, threat actors and CVEs, and produces an anal

• license-check

  Inventory the licenses of a project's dependency graph and enforce a policy over them using postmortem - denied licenses, unknown licenses, dual-licensing. Use when the user asks about license compliance, what licenses their dependencies carry, whether GPL/AGPL is present, or wants a license gate fo

• phishing-triage

  Analyze a suspicious email, SMS or message for phishing/smishing using mlab.sh - sender address reputation, domain spoofability (SPF/DKIM/DMARC), embedded URL analysis, callback phone numbers and smishing scoring. Use when the user pastes a suspicious message, reports a phishing attempt, or asks whe

• repo-ioc-sweep

  Inventory what a codebase talks to - extract embedded URLs, IPs, domains, wallets, base64 blobs and shell scripts from a repo, then enrich each endpoint through mlab.sh. Use when the user asks what a repo connects to, wants an egress inventory, or vets a vendor/third-party codebase for suspicious em

• sbom-audit

  Audit a dependency lockfile or SBOM for known vulnerabilities via mlab.sh, prioritize findings by KEV status and EPSS, and attribute actively exploited CVEs to threat actors. Use when the user provides a lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, Cargo.lock, requirements.txt, poetry.loc

• sbom-export

  Generate a CycloneDX SBOM locally with postmortem and push it through mlab.sh vulnerability scanning - for projects or container images where no single lockfile can be pasted. Use when the user asks for an SBOM, needs vuln scanning of a container image or a multi-ecosystem repo, or when sbom-audit l

• script-triage

  Statically analyze a suspicious shell script through mlab.sh - install.sh, cron payloads, CI steps, curl-pipe-sh one-liners. Flags dangerous constructs (download-piped-to-shell, base64 decoding, reverse shells, persistence, anti-forensics, destructive deletes), extracts every IOC and enriches them.

• smishing-campaign

  Analyze a batch of reported SMS/text messages through mlab.sh - score each for smishing, cluster them into campaigns, and extract the shared infrastructure (URLs, callback numbers, sender patterns). Use when the user has multiple reported SMS from users/employees, or investigates an SMS phishing wav

• supply-chain-audit

  Full supply-chain audit of a project - postmortem detects malicious code, install hooks and risky dependencies locally, then mlab.sh enriches what it finds (hashes, endpoints, actors, CVEs). Use when the user asks to audit a project's dependencies or supply chain, check a repo for malicious packages

• threat-watch

  Generate a threat landscape digest from mlab.sh - recent critical/KEV CVEs filtered to a declared technology stack, with actor attribution. Use when the user asks what is new in vulnerabilities, wants a daily/weekly threat brief, asks about recent CVEs for a product, or sets up a recurring watch on

MCP servers (1)

• mlab

  connects to: https://mlab.sh/mcp

Similar plugins