malchela
Doug Metz
MalChela is a Rust-based malware analysis toolkit for DFIR analysts and malware researchers. It exposes file triage, string extraction with IOC detection and MITRE ATT&CK mapping, YARA rule generat...
From the developer
License
MIT
Declared components
Mcp servers
Works with
Claude Code
Description
From the marketplace listing
MalChela is a Rust-based malware analysis toolkit for DFIR analysts and malware researchers. It exposes file triage, string extraction with IOC detection and MITRE ATT&CK mapping, YARA rule generation, hash lookup, VirusTotal and MalwareBazaar threat intel queries, and NSRL database checks — all accessible to Claude via MCP server integration.
What changed
No changes recorded yet. Follow this plugin to keep track of future changes.
Similar plugins
Find competitors to follow as you develop your plugin.
-
The ProntoNLP Plugin is an advanced financial analysis toolkit designed to transform complex financial data and earnings calls into struc...
Shared terms: analyst, researcher, toolkit, analysis
-
A Laravel toolkit for Claude Code with 27 skills across 9 categories: database migration consolidation, model analysis, N+1 detection, se...
Shared terms: detection, toolkit, analysis, database
-
Rust language server for code intelligence and analysis
Shared terms: rust, analysis, server
-
Prisma MCP integration for Postgres database management, schema migrations, SQL queries, and connection string management. Provision Pris...
Shared terms: string, database, querie, integration
-
The first BCI toolkit for researchers, developers, and security engineers. Threat modeling, vulnerability scoring, pattern detection, and...
Shared terms: detection, researcher, toolkit, threat
Keywords
Files & skills
malchela · catalog manifest
Saved declaration
{}
malchela · catalog manifest
Saved declaration
{
"name": "malchela",
"source": {
"sha": "13eabfe91f0d0fd7ac973ceae6904e1effcaa6b7",
"url": "https://github.com/dwmetz/MalChela.git",
"source": "url"
},
"homepage": "https://bakerstreetforensics.com",
"description": "MalChela is a Rust-based malware analysis toolkit for DFIR analysts and malware researchers. It exposes file triage, string extraction with IOC detection and MITRE ATT&CK mapping, YARA rule generation, hash lookup, VirusTotal and MalwareBazaar threat intel queries, and NSRL database checks — all accessible to Claude via MCP server integration."
}
malchela · catalog manifest
Mcp servers
{
"malchela": {
"env": {
"MALCHELA_DIR": "${MALCHELA_DIR}"
},
"args": [
"${CLAUDE_PLUGIN_ROOT}/mcp/index.js"
],
"command": "node"
}
}
Saved declaration
{
"name": "malchela",
"author": {
"name": "Doug Metz",
"email": "dwmetz@gmail.com"
},
"license": "MIT",
"version": "",
"homepage": "https://bakerstreetforensics.com",
"keywords": [
"malware",
"dfir",
"forensics",
"yara",
"threat-intel",
"virustotal",
"mcp",
"security"
],
"mcpServers": {
"malchela": {
"env": {
"MALCHELA_DIR": "${MALCHELA_DIR}"
},
"args": [
"${CLAUDE_PLUGIN_ROOT}/mcp/index.js"
],
"command": "node"
}
},
"repository": "https://github.com/dwmetz/MalChela",
"description": "MalChela malware analysis toolkit — exposes file analysis, string extraction, hash lookup, NSRL queries, and directory scanning to Claude via MCP. Built for DFIR analysts and malware researchers."
}
plugin.json observed Nov 6, 2026 · 10:46 UTC. Manifest source ↗
Catalog declarations and available plugin.json metadata are saved. Referenced skills and executable source files are not downloaded or tested. Missing components in a manifest do not prove that the plugin has none.
Installation instructions
Community
/plugin marketplace add anthropics/claude-plugins-community
/plugin install malchela@claude-community
Technical details
- Sources
- Community
- First seen
- Oct 3, 2026 · 22:13 UTC
- Last seen
- Nov 9, 2026 · 12:07 UTC
- Latest observed change
- Oct 3, 2026 · 22:13 UTC
- Collection status
- Listed
- Reported installs
- Not provided
Installation counts are source-reported, not independently verified active users. Observation dates are not release dates.
Download plugin data (JSON)Plugin history: freshly prepared. Prepared . Refreshed when catalog data changes or after 6 hours. Your account and Follow status are live.