# Cyberbro MCP Server

Extracts IOC data from messy text and sends it to Cyberbro for reputation analysis. Useful for checking IPs, domains, URLs, and hashes.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 19
- Author: stanfrbd
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/stanfrbd/mcp-cyberbro
- Updated: 2026-10-18
- HTML: https://affpapa.org/en/nevibecode/mcp/cyberbro-mcp-server

## What it does

Cyberbro MCP Server connects Cyberbro to an MCP-capable assistant. It accepts indicators found in text, runs analysis through Cyberbro engines, and returns the results. Its five tools submit an observable, check analysis status, fetch results, list engines, and provide the related web URL.

You can run it with `uvx mcp-cyberbro` or install the `mcp-cyberbro` package first. The server supports `stdio`, `sse`, and `streamable-http`, with Docker available for container runs. `CYBERBRO_URL` is required, so the server cannot connect without the Cyberbro endpoint.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `CYBERBRO_URL`, `API_PREFIX`, `SSL_VERIFY`, `MCP_TRANSPORT`, `MCP_HOST`, `MCP_PORT`, `MCP_MOUNT_PATH`, `MCP_SSE_PATH`, `MCP_STREAMABLE_HTTP_PATH` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env CYBERBRO_URL=<CYBERBRO_URL> --env API_PREFIX=<API_PREFIX> --env SSL_VERIFY=<SSL_VERIFY> --env MCP_TRANSPORT=<MCP_TRANSPORT> --env MCP_HOST=<MCP_HOST> --transport stdio cyberbro-mcp-server -- uvx mcp-cyberbro
```
Replace <…> with your own values. 4 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-cyberbro <command>

### Codex

**Platform CLI**
```bash
codex mcp add cyberbro-mcp-server --env CYBERBRO_URL=<CYBERBRO_URL> --env API_PREFIX=<API_PREFIX> --env SSL_VERIFY=<SSL_VERIFY> --env MCP_TRANSPORT=<MCP_TRANSPORT> --env MCP_HOST=<MCP_HOST> -- uvx mcp-cyberbro
```
Replace <…> with your own values. 4 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-cyberbro <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "cyberbro-mcp-server": {
            "command": "uvx",
            "args": [
                "mcp-cyberbro"
            ],
            "env": {
                "CYBERBRO_URL": "<CYBERBRO_URL>",
                "API_PREFIX": "<API_PREFIX>",
                "SSL_VERIFY": "<SSL_VERIFY>",
                "MCP_TRANSPORT": "<MCP_TRANSPORT>",
                "MCP_HOST": "<MCP_HOST>"
            }
        }
    }
}
```
Replace <…> with your own values. 4 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-cyberbro <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "cyberbro-mcp-server": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "mcp-cyberbro"
            ],
            "env": {
                "CYBERBRO_URL": "<CYBERBRO_URL>",
                "API_PREFIX": "<API_PREFIX>",
                "SSL_VERIFY": "<SSL_VERIFY>",
                "MCP_TRANSPORT": "<MCP_TRANSPORT>",
                "MCP_HOST": "<MCP_HOST>"
            }
        }
    }
}
```
Replace <…> with your own values. 4 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-cyberbro <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e CYBERBRO_URL=<CYBERBRO_URL> -e API_PREFIX=<API_PREFIX> -e SSL_VERIFY=<SSL_VERIFY> -e MCP_TRANSPORT=<MCP_TRANSPORT> -e MCP_HOST=<MCP_HOST> cyberbro-mcp-server uvx mcp-cyberbro
```
Replace <…> with your own values. 4 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from mcp-cyberbro <command>

## When to use it
- extract IOC values from unstructured text
- check an IP or domain reputation
- submit URLs and hashes to Cyberbro
- build an OSINT report from a domain

## Example prompts
- Check the reputation of IP `192.168.1.1` with Cyberbro and use the available engines.
- Analyze `example.com` with Cyberbro, then show the returned findings.
- Create an OSINT report for `suspicious-domain.com` and pivot from the analysis results.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md