Cyberbro MCP Server — Claude Code MCP server: IOC analysis
Extracts IOC data from messy text and sends it to Cyberbro for reputation analysis. Useful for checking IPs, domains, URLs, and hashes.
claude mcp add --env CYBERBRO_URL=<CYBERBRO_URL> --env API_PREFIX=<API_PREFIX> --env SSL_VERIFY=<SSL_VERIFY> --env MCP_TRANSPORT=<MCP_TRANSPORT> --env MCP_HOST=<MCP_HOST> --transport stdio cyberbro-mcp-server -- uvx mcp-cyberbroWhat Cyberbro MCP Server does
Cyberbro MCP Server connects Cyberbro to an MCP-capable assistant. It accepts indicators found in text, runs analysis through Cyberbro engines, and returns the results. Its five tools submit an observable, check analysis status, fetch results, list engines, and provide the related web URL.
You can run it with uvx mcp-cyberbro or install the mcp-cyberbro package first. The server supports stdio, sse, and streamable-http, with Docker available for container runs. CYBERBRO_URL is required, so the server cannot connect without the Cyberbro endpoint.
What it helps with
- extract IOC values from unstructured text
- check an IP or domain reputation
- submit URLs and hashes to Cyberbro
- build an OSINT report from a domain
Example prompts for the agent
- Check the reputation of IP
192.168.1.1with Cyberbro and use the available engines. - Analyze
example.comwith Cyberbro, then show the returned findings. - Create an OSINT report for
suspicious-domain.comand pivot from the analysis results.
How to install Cyberbro MCP Server
Platform CLI
claude mcp add --env CYBERBRO_URL=<CYBERBRO_URL> --env API_PREFIX=<API_PREFIX> --env SSL_VERIFY=<SSL_VERIFY> --env MCP_TRANSPORT=<MCP_TRANSPORT> --env MCP_HOST=<MCP_HOST> --transport stdio cyberbro-mcp-server -- uvx mcp-cyberbroReplace <…> with your own values. 4 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-cyberbro <command>
Platform CLI
codex mcp add cyberbro-mcp-server --env CYBERBRO_URL=<CYBERBRO_URL> --env API_PREFIX=<API_PREFIX> --env SSL_VERIFY=<SSL_VERIFY> --env MCP_TRANSPORT=<MCP_TRANSPORT> --env MCP_HOST=<MCP_HOST> -- uvx mcp-cyberbroReplace <…> with your own values. 4 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-cyberbro <command>
Config file
{
"mcpServers": {
"cyberbro-mcp-server": {
"command": "uvx",
"args": [
"mcp-cyberbro"
],
"env": {
"CYBERBRO_URL": "<CYBERBRO_URL>",
"API_PREFIX": "<API_PREFIX>",
"SSL_VERIFY": "<SSL_VERIFY>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>",
"MCP_HOST": "<MCP_HOST>"
}
}
}
}Replace <…> with your own values. 4 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-cyberbro <command>
Config file
{
"servers": {
"cyberbro-mcp-server": {
"type": "stdio",
"command": "uvx",
"args": [
"mcp-cyberbro"
],
"env": {
"CYBERBRO_URL": "<CYBERBRO_URL>",
"API_PREFIX": "<API_PREFIX>",
"SSL_VERIFY": "<SSL_VERIFY>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>",
"MCP_HOST": "<MCP_HOST>"
}
}
}
}Replace <…> with your own values. 4 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-cyberbro <command>
Platform CLI
gemini mcp add -e CYBERBRO_URL=<CYBERBRO_URL> -e API_PREFIX=<API_PREFIX> -e SSL_VERIFY=<SSL_VERIFY> -e MCP_TRANSPORT=<MCP_TRANSPORT> -e MCP_HOST=<MCP_HOST> cyberbro-mcp-server uvx mcp-cyberbroReplace <…> with your own values. 4 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-cyberbro <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Cyberbro MCP Server
How do I install Cyberbro MCP Server in Claude Code?
Run claude mcp add mcp-cyberbro -e CYBERBRO_URL=<CYBERBRO_URL> -- uvx mcp-cyberbro.
What does Cyberbro MCP Server do?
It sends IPs, domains, URLs, and hashes to Cyberbro, then exposes the analysis through MCP tools.
What does the server need to run?
You need an accessible Cyberbro instance and a CYBERBRO_URL value. The server supports stdio, sse, and streamable-http transports.
