# mlab.sh

Enrich IPs, domains, URLs and hashes with threat intelligence, search CVEs and scan SBOMs from an MCP client. Useful when an investigation needs these checks alongside coding work.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 2
- Author: mlab-sh
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/mlab-sh/mcp
- Updated: 2026-08-31
- HTML: https://affpapa.org/en/nevibecode/mcp/mlabsh

## What it does

mlab.sh provides tools to identify an indicator’s type and retrieve threat intelligence. You can check IP addresses, analyze URLs without visiting them, look up file hashes, and search for CVEs or threat actors. Domain scans cover DNS, subdomains and SSL; a separate tool retrieves scan results.

Other tools inspect SBOMs or dependency lockfiles for known CVEs, analyze inline shell scripts, and show account scan history, quotas and bookmarks. The client connects to the remote endpoint `https://mlab.sh/mcp`. OAuth 2.1 is the recommended authentication method; a static token is an alternative for clients that cannot use OAuth. Quotas depend on the account plan. Claude Code is not among the officially supported clients, so its support is best effort.

## Requirements
- Remote server: `https://mlab.sh/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http mcp https://mlab.sh/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add mlabsh --url https://mlab.sh/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mlabsh": {
            "url": "https://mlab.sh/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mlabsh": {
            "type": "http",
            "url": "https://mlab.sh/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http mlabsh https://mlab.sh/mcp
```

## When to use it
- check an IP, URL or hash for threat intelligence
- find CVEs and actors associated with a vulnerability
- run a domain scan and retrieve its results
- scan an SBOM for known CVEs
- inspect account scan quotas

## Example prompts
- Check the threat intelligence for IP address `203.0.113.7`.
- Find CVEs for this vulnerability and identify actors known to exploit them.
- Scan this project's SBOM for known CVEs.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md