← Claude plugins
CLAUDE PLUGIN

malchela

Doug Metz

MalChela is a Rust-based malware analysis toolkit for DFIR analysts and malware researchers. It exposes file triage, string extraction with IOC detection and MITRE ATT&CK mapping, YARA rule generat...

Create a free account to save this plugin.

From the developer

License

MIT

Declared components

Mcp servers

Works with

Claude Code

Description

From the marketplace listing

MalChela is a Rust-based malware analysis toolkit for DFIR analysts and malware researchers. It exposes file triage, string extraction with IOC detection and MITRE ATT&CK mapping, YARA rule generation, hash lookup, VirusTotal and MalwareBazaar threat intel queries, and NSRL database checks — all accessible to Claude via MCP server integration.

What changed

No changes recorded yet. Follow this plugin to keep track of future changes.

Keywords

Files & skills

malchela · catalog manifest

Saved declaration

{}
malchela · catalog manifest

Saved declaration

{
  "name": "malchela",
  "source": {
    "sha": "13eabfe91f0d0fd7ac973ceae6904e1effcaa6b7",
    "url": "https://github.com/dwmetz/MalChela.git",
    "source": "url"
  },
  "homepage": "https://bakerstreetforensics.com",
  "description": "MalChela is a Rust-based malware analysis toolkit for DFIR analysts and malware researchers. It exposes file triage, string extraction with IOC detection and MITRE ATT&CK mapping, YARA rule generation, hash lookup, VirusTotal and MalwareBazaar threat intel queries, and NSRL database checks — all accessible to Claude via MCP server integration."
}
malchela · catalog manifest

Mcp servers

{
  "malchela": {
    "env": {
      "MALCHELA_DIR": "${MALCHELA_DIR}"
    },
    "args": [
      "${CLAUDE_PLUGIN_ROOT}/mcp/index.js"
    ],
    "command": "node"
  }
}

Saved declaration

{
  "name": "malchela",
  "author": {
    "name": "Doug Metz",
    "email": "dwmetz@gmail.com"
  },
  "license": "MIT",
  "version": "",
  "homepage": "https://bakerstreetforensics.com",
  "keywords": [
    "malware",
    "dfir",
    "forensics",
    "yara",
    "threat-intel",
    "virustotal",
    "mcp",
    "security"
  ],
  "mcpServers": {
    "malchela": {
      "env": {
        "MALCHELA_DIR": "${MALCHELA_DIR}"
      },
      "args": [
        "${CLAUDE_PLUGIN_ROOT}/mcp/index.js"
      ],
      "command": "node"
    }
  },
  "repository": "https://github.com/dwmetz/MalChela",
  "description": "MalChela malware analysis toolkit — exposes file analysis, string extraction, hash lookup, NSRL queries, and directory scanning to Claude via MCP. Built for DFIR analysts and malware researchers."
}

plugin.json observed Nov 6, 2026 · 10:46 UTC. Manifest source ↗

Catalog declarations and available plugin.json metadata are saved. Referenced skills and executable source files are not downloaded or tested. Missing components in a manifest do not prove that the plugin has none.

Installation instructions

Community

/plugin marketplace add anthropics/claude-plugins-community
/plugin install malchela@claude-community

Claude Code installation documentation

Technical details
Sources
Community
First seen
Oct 3, 2026 · 22:13 UTC
Last seen
Nov 9, 2026 · 00:00 UTC
Latest observed change
Oct 3, 2026 · 22:13 UTC
Collection status
Listed
Reported installs
Not provided

Installation counts are source-reported, not independently verified active users. Observation dates are not release dates.

Download plugin data (JSON)

Plugin history: freshly prepared. Prepared . Refreshed when catalog data changes or after 6 hours. Your account and Follow status are live.