malchela
dwmetz/MalChelaPlugin
MalChela is a Rust-based malware analysis toolkit for DFIR analysts and malware researchers. It exposes file triage, string extraction with IOC detection and MITRE ATT&CK mapping, YARA rule generation, hash lookup, VirusTotal and MalwareBazaar threat intel queries, and NSRL database checks — all accessible to Claude via MCP server integration.
Why this score
Popularity score: 69/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank
Security
Scanned Oct 22, 2026 at commit 13eabfe91f0d, with Cisco's open-source skill-scanner.
What its code does:
- Runs shell commands Common for dev tools. Read the commands it runs..claude-plugin/mcp/index.js:27, README.md:1, docs/install.md:1 and 1 more
- Reads environment variables, where API keys usually liveserver/malchela_server.py:172
A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan
Alternatives
Nothing from another maker does quite the same job yet.