What can you do with the Malcore integration?

LiveContext exposes 12 operations on Malcore, covering analysis, document analysis, dynamic analysis and hash. Common uses include submitting a suspicious binary for full analysis, analysing a document attachment reported as phishing and pulling hard coded domains and addresses out of a sample.

LiveContext

All integrations

Malcore integration

Malcore malware analysis API: upload an executable or a document for full static and dynamic analysis, poll the resulting job by its identifier, and run the individual analysis stages on their own, including threat scoring, deep static analysis, YARA rule scanning, string and hash extraction, dynamic analysis and packet capture comparison. It also checks a URL for known bad reputation and rescans a file that was already uploaded.

12 toolsAPI keyAPI docs

Connect Malcore How integrations work

Common Malcore use cases

submitting a suspicious binary for full analysis
analysing a document attachment reported as phishing
pulling hard coded domains and addresses out of a sample
re-analysing an old sample after new detection rules were published
checking a link extracted from an email against known bad reputation
identifying the malware family of a sample from the rules it matches
scoring a file quickly to decide whether a full analysis is worth it
checking whether a sample is packed before deciding how to analyse it
computing the hashes of a file before looking it up in other services
observing what a packed sample does when static analysis reveals nothing

What you can do with Malcore

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Analysis, 3 operations

POSTget_analysis_status
Polls a Malcore analysis by its identifier and returns the result once it is ready.
POSTrescan_file
Queues a fresh Malcore analysis of a file that has already been uploaded.
POSTupload_file
Uploads a file to Malcore for full analysis and returns the job identifier.

Document analysis, 1 operation

POSTanalyse_document
Analyses an office document and scores its malicious content.

Dynamic analysis, 1 operation

POSTdynamic_analysis
Executes a file in Malcore and reports the behaviour observed.

Hash, 1 operation

POSTget_file_hashes
Computes the MD5, SHA, import and fuzzy hashes of a file.

Pcap diff, 1 operation

POSTcompare_pcaps
Compares two packet captures and reports the packets that differ.

Static analysis, 1 operation

POSTdeep_static_analysis
Returns a Malcore deep static analysis of a file: packing, sections, strings and hashes.

String extract, 1 operation

POSTextract_strings
Extracts the readable strings embedded in a file.

Threat score, 1 operation

POSTget_threat_score
Returns a Malcore threat score and the detections behind it for a file.

Url, 1 operation

POSTcheck_url
Checks a URL with Malcore and returns the threat categories it matches.

Yara scan, 1 operation

POSTscan_yara_rules
Scans a file against the Malcore YARA rules and returns the matches.

Use Malcore from Claude Code, Cursor or Codex

Connect Malcore in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Malcore operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Malcore

Create your workspace
Sign up free. Nothing to install.
Connect Malcore once
Add your Malcore connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Malcore integration FAQ

What can you do with the Malcore integration?: LiveContext exposes 12 operations on Malcore, covering analysis, document analysis, dynamic analysis and hash. Common uses include submitting a suspicious binary for full analysis, analysing a document attachment reported as phishing and pulling hard coded domains and addresses out of a sample.