Integration

Malcore integration

Malcore malware analysis API: upload an executable or a document for full static and dynamic analysis, poll the resulting job by its identifier, and run the individual analysis stages on their own, including threat scoring, deep static analysis, YARA rule scanning, string and hash extraction, dynamic analysis and packet capture comparison. It also checks a URL for known bad reputation and rescans a file that was already uploaded.

Connect Malcore How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Malcore.Built from the 12 Malcore tools below, on the connection you add once.

Common Malcore use cases

submitting a suspicious binary for full analysis
analysing a document attachment reported as phishing
pulling hard coded domains and addresses out of a sample
re-analysing an old sample after new detection rules were published
checking a link extracted from an email against known bad reputation
identifying the malware family of a sample from the rules it matches
scoring a file quickly to decide whether a full analysis is worth it
checking whether a sample is packed before deciding how to analyse it
computing the hashes of a file before looking it up in other services
observing what a packed sample does when static analysis reveals nothing

What you can do with Malcore

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Analysis, 3 operations

get_analysis_statusGet analysis statusPOSTPolls a Malcore analysis by its identifier and returns the result once it is ready.
rescan_fileRescan filePOSTQueues a fresh Malcore analysis of a file that has already been uploaded.
upload_fileUpload filePOSTUploads a file to Malcore for full analysis and returns the job identifier.

Document analysis, 1 operation

analyse_documentAnalyse documentPOSTAnalyses an office document and scores its malicious content.

Dynamic analysis, 1 operation

dynamic_analysisDynamic analysisPOSTExecutes a file in Malcore and reports the behaviour observed.

Hash, 1 operation

get_file_hashesGet file hashesPOSTComputes the MD5, SHA, import and fuzzy hashes of a file.

Pcap diff, 1 operation

compare_pcapsCompare pcapsPOSTCompares two packet captures and reports the packets that differ.

Static analysis, 1 operation

deep_static_analysisDeep static analysisPOSTReturns a Malcore deep static analysis of a file: packing, sections, strings and hashes.

String extract, 1 operation

extract_stringsExtract stringsPOSTExtracts the readable strings embedded in a file.

Threat score, 1 operation

get_threat_scoreGet threat scorePOSTReturns a Malcore threat score and the detections behind it for a file.

Url, 1 operation

check_urlCheck urlPOSTChecks a URL with Malcore and returns the threat categories it matches.

Yara scan, 1 operation

scan_yara_rulesScan yara rulesPOSTScans a file against the Malcore YARA rules and returns the matches.

Use Malcore from Claude Code, Cursor or Codex

Connect Malcore in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Malcore operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Malcore

Create your workspace
Sign up free. Nothing to install.
Connect Malcore once
Add your Malcore connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Malcore integration FAQ

What can you do with the Malcore integration?

LiveContext exposes 12 operations on Malcore, covering analysis, document analysis, dynamic analysis and hash. Common uses include submitting a suspicious binary for full analysis, analysing a document attachment reported as phishing and pulling hard coded domains and addresses out of a sample.