mlab.sh — Claude Code MCP server: features and setup
Enrich IPs, domains, URLs and hashes with threat intelligence, search CVEs and scan SBOMs from an MCP client. Useful when an investigation needs these checks alongside coding work.
claude mcp add --transport http mcp https://mlab.sh/mcpWhat mlab.sh does
mlab.sh provides tools to identify an indicator’s type and retrieve threat intelligence. You can check IP addresses, analyze URLs without visiting them, look up file hashes, and search for CVEs or threat actors. Domain scans cover DNS, subdomains and SSL; a separate tool retrieves scan results.
Other tools inspect SBOMs or dependency lockfiles for known CVEs, analyze inline shell scripts, and show account scan history, quotas and bookmarks. The client connects to the remote endpoint https://mlab.sh/mcp. OAuth 2.1 is the recommended authentication method; a static token is an alternative for clients that cannot use OAuth. Quotas depend on the account plan. Claude Code is not among the officially supported clients, so its support is best effort.
What it helps with
- check an IP, URL or hash for threat intelligence
- find CVEs and actors associated with a vulnerability
- run a domain scan and retrieve its results
- scan an SBOM for known CVEs
- inspect account scan quotas
Example prompts for the agent
- Check the threat intelligence for IP address
203.0.113.7. - Find CVEs for this vulnerability and identify actors known to exploit them.
- Scan this project's SBOM for known CVEs.
How to install mlab.sh
Platform CLI: remote server
claude mcp add --transport http mcp https://mlab.sh/mcpPlatform CLI: remote server
codex mcp add mlabsh --url https://mlab.sh/mcpConfig file
{
"mcpServers": {
"mlabsh": {
"url": "https://mlab.sh/mcp"
}
}
}Config file
{
"servers": {
"mlabsh": {
"type": "http",
"url": "https://mlab.sh/mcp"
}
}
}Platform CLI: remote server
gemini mcp add -t http mlabsh https://mlab.sh/mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about mlab.sh
How do I install mlab.sh in Claude Code?
Run both commands: claude mcp add --transport http mcp https://mlab.sh/mcp, then claude mcp add --transport http mlabsh https://mlab.sh/mcp.
What does mlab.sh do?
It offers tools for IOC enrichment, CVE and threat actor searches, domain scans, and SBOM checks.
How does mlab.sh authentication work?
OAuth 2.1 is the recommended option. Clients without OAuth support can use a static token created in Account > Settings > MCP Tokens.
