Integration

Hybrid Analysis integration

Hybrid Analysis malware analysis API built on Falcon Sandbox: look a file hash up to see whether it has already been detonated, search the corpus by filename, family, tag, verdict, network indicator or MITRE technique, read the aggregated overview of a sample across every analysis and scanner, submit a file or a URL for full detonation in a chosen sandbox environment, poll the state of a running analysis and read its report, run a fast lookup only scan, and check the quota left on the key.

Connect Hybrid Analysis How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Hybrid Analysis.Built from the 15 Hybrid Analysis tools below, on the connection you add once.

Common Hybrid Analysis use cases

finding every sample that contacted a suspicious domain
screening links at speed before deciding which to detonate
detonating a link from a reported phishing email in a sandbox
waiting for a detonation to finish before reading its verdict
waiting for every scanner to answer before recording a verdict
checking there is quota left before submitting a batch of samples
checking why an expected scanner is missing from a quick scan result
refreshing the scanner verdicts of a sample analysed a long time ago
detonating an unknown attachment pulled from a reported phishing email
enriching a list of hashes with a verdict without pulling full reports

What you can do with Hybrid Analysis

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Overview, 3 operations

get_overviewGet overviewGETReturns the aggregated Hybrid Analysis overview of one sample.
get_overview_summaryGet overview summaryGETReturns a compact Hybrid Analysis overview of one sample.
refresh_overviewRefresh overviewGETTriggers a refresh of the external scanner data held for a sample.

Quick scan, 3 operations

get_quick_scanGet quick scanGETPolls a Hybrid Analysis quick scan until every scanner has answered.
quick_scan_fileQuick scan filePOSTRuns a fast Hybrid Analysis scan of a file instead of a full detonation.
quick_scan_urlQuick scan urlPOSTRuns a fast Hybrid Analysis scan of a URL instead of a full detonation.

Report, 2 operations

get_report_stateGet report stateGETPolls a Hybrid Analysis job and reports whether the analysis has finished.
get_report_summaryGet report summaryGETReturns the verdict and behaviour summary of a finished Hybrid Analysis job.

Sample, 2 operations

search_hashSearch hashGETChecks whether Hybrid Analysis has already detonated a file hash.
search_termsSearch termsPOSTSearches Hybrid Analysis samples by metadata, indicator or MITRE technique.

Submission, 2 operations

submit_fileSubmit filePOSTSubmits a file to Hybrid Analysis for detonation and returns the job to poll.
submit_urlSubmit urlPOSTSubmits a URL to Hybrid Analysis for detonation and returns the job to poll.

Key, 1 operation

get_key_detailsGet key detailsGETReturns the permission level and limits of the Hybrid Analysis API key.

Quota, 1 operation

get_submission_quotaGet submission quotaGETReturns the remaining Hybrid Analysis submission quota of the key.

Scanner, 1 operation

list_quick_scan_scannersList quick scan scannersGETLists which Hybrid Analysis quick scan engines are currently available.

Use Hybrid Analysis from Claude Code, Cursor or Codex

Connect Hybrid Analysis in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Hybrid Analysis operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Hybrid Analysis

Create your workspace
Sign up free. Nothing to install.
Connect Hybrid Analysis once
Add your Hybrid Analysis connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Hybrid Analysis integration FAQ

What can you do with the Hybrid Analysis integration?

LiveContext exposes 15 operations on Hybrid Analysis, covering overview, quick scan, report and sample. Common uses include finding every sample that contacted a suspicious domain, screening links at speed before deciding which to detonate and detonating a link from a reported phishing email in a sandbox.