Mlab.sh Mlab.sh
v1.23.0
Platform
Free Tools Redkit Ecosystem Pricing Blog Programs
Technical
CLI & Binaries Developer API Integrations MCP Integration Changelog Engineering
Learn
Cheat Sheets Comparisons Glossary
Support
Help Center Contact sales Partners
Terms · Privacy · Sales · DPA
Redkit
Code
Governance
tprm.mlab.sh
Third-party risk management
risk.mlab.sh
EBIOS Risk Manager platform
Detection
ir.mlab.sh
Self-hosted incident response
hunt.mlab.sh
Threat hunting with Sigma & YARA
actors.mlab.sh
Threat actor database, APTs, groups & TTPs
Attack Surface
code.mlab.sh
Source code scanning for GitHub & GitLab
vuln.mlab.sh
CVE intelligence & tracking
Training
academy.mlab.sh
Cybersecurity training & courses
kids.mlab.sh
Cyber education for kids
About
Contact
Sign up
Navigation
Terms Privacy About Contact
Integrations

Bring mlab.sh into your tools

Your assistant, your IDE, your CI and your workflows, plus the open-source scanners built by the mlab.sh team. Every entry links to its repository, with setup instructions.

Integrations
22
Categories
10
Source
github.com/mlab-sh
01

AI assistants

Ask your assistant about an indicator and get mlab.sh answers without leaving the conversation.

MCP server
Connect Claude, Cursor or any MCP client to mlab.sh: IOC lookups, domain scans, CVEs and threat actors from your assistant.
MCPRemote
Claude Code plugins
Ready-made Claude Code workflows for SOC and DFIR teams: IOC triage, SBOM audits and supply-chain reviews.
Claude CodePlugins
02

IDE

Known vulnerabilities in your dependencies, flagged where you write the code.

VS Code extension
Scans lockfiles for known CVEs with EPSS and KEV status, lists findings in the Problems panel, shows CVE details on hover and looks up IOCs.
VS CodeOpen VSX
 Also on Open VSX · Source
JetBrains plugin
The same lockfile scanning inside IntelliJ IDEA, PyCharm, GoLand, WebStorm and RustRover, with findings inline.
JetBrains
 Source · JetBrains
03

CI/CD

Stop a vulnerable dependency before it is merged.

GitHub Action
Checks every dependency on each push or pull request, writes a job summary and fails the build above your severity threshold.
GitHub Actions
 Source
04

Automation

Plug mlab.sh into the workflows your team already runs.

n8n node
Scans, CVE intelligence and threat-actor data as a node in your n8n workflows.
n8nnpm
 Source
Shuffle app
Scans, CVE intelligence and threat-actor data as an app in your Shuffle SOAR workflows.
ShuffleSOAR
 Source
05

SIEM

Enrich the alerts your SOC already triages.

Wazuh integration
Enriches Wazuh alerts with mlab.sh verdicts on file hashes, URLs, CVEs and public IPs, with ready-made rules.
WazuhSIEM
 Source
Splunk app
A | mlab search command that enriches events with hash, URL, CVE and IP intelligence, plus an alert action to ir.mlab.sh. Works with Enterprise Security.
SplunkSIEM
 Source
Sekoia.io integration
mlab.sh enrichment for Sekoia.io SOC Platform alerts. Work in progress.
Sekoia.ioWork in progress
06

Browser

Pivot from any web page to an investigation.

mlab.sh INTEL extension
Spots domains and IPs on any page, defanged ones included, and opens them in mlab.sh in one click.
ChromeFirefox
 Also on Firefox Add-ons · Source
07

Command line

Everything mlab.sh does, scriptable.

mlab CLI
Scan domains, IPs, files and URLs, pull IOCs out of text, gate CI on vulnerable dependencies and search CVEs and threat actors. Terminal or JSON output.
RustSingle binary
08

Infrastructure audit

Read-only command-line audits of an account or a device: graded findings, snapshots, diffs of what changed and CVEs matched to the installed version. No telemetry.

In development. These audits are usable today, but checks and output may still change between releases.
Cloudflare
DNS, edge posture, TLS, Workers, Zero Trust, logging and IAM of a Cloudflare account.
RustRead-only
Scaleway
IAM weaknesses, internet exposure, plaintext credentials and published CVEs across a Scaleway account.
RustRead-only
Proxmox VE
Access control, firewall, guest isolation, backups and patch level of a Proxmox cluster.
RustRead-only
UniFi
Segmentation, firewall, Wi-Fi and exposure of a UniFi console.
RustRead-only
MikroTik
Exposure, firewall and accounts of a RouterOS device, with CVEs matched to its exact version.
RustRead-only
09

Open-source security tools

Standalone scanners from the mlab.sh team. They run offline and need no account.

postmortem
Supply-chain scanner: malicious install code, typosquats and shady provenance across your dependencies and OS packages.
RustCLI
mcpwn
Static security scanner for MCP servers: flags the tools, prompts and resources that can turn an agent against its user.
RustCLI
apex
Static analysis of Android and iOS packages (.apk, .aab, .xapk, .ipa): 15 analyzers and a weighted score.
RustCLI
assay
Offline scanner for ML model files (safetensors, GGUF, PyTorch pickle): checks provenance and integrity before you load a model.
RustOffline
k3sec
Runtime security for k3s clusters: one real-time stream of what happens in the cluster.
RustBeta
10

Other

mlab.sh intelligence inside the rest of your IT stack.

GLPI plugin
Vulnerability management for your IT inventory: matches installed Windows and Linux software against CVEs, prioritizes by KEV, EPSS and CVSS, and opens tickets for exploited flaws.
GLPI 11ITSM
 Source · GLPI
Custom integration

Your tool is not on the list?

We build new integrations on request: a SIEM, a SOAR, a ticketing system or an in-house platform. Tell us what you run and we will scope it with you.

Request an integration Browse the source
  1. 01
    Tell us your stackThe product, its version and the alerts or data you want enriched.
  2. 02
    We scope it togetherWhich mlab.sh data to pull in and where it should show up.
  3. 03
    It ships open sourcePublished on GitHub with setup docs, and listed on this page.

All product names, logos and brands shown on this page are the property of their respective owners and are used only to identify the products each integration works with. Their use does not imply any affiliation with, sponsorship by, endorsement by or partnership with those owners, unless stated otherwise in writing. Claude is a trademark of Anthropic, PBC. JetBrains and IntelliJ IDEA are trademarks of JetBrains s.r.o. Visual Studio Code is a trademark of Microsoft Corporation. GitHub is a trademark of GitHub, Inc. GitLab is a trademark of GitLab Inc. n8n is a trademark of n8n GmbH. Shuffle is a trademark of Shuffle AS. Wazuh is a trademark of Wazuh, Inc. Splunk is a trademark of Splunk LLC. Sekoia.io is a trademark of SEKOIA SAS. GLPI is a trademark of Teclib'. Cloudflare is a trademark of Cloudflare, Inc. Scaleway is a trademark of Scaleway SAS. Proxmox is a trademark of Proxmox Server Solutions GmbH. UniFi and Ubiquiti are trademarks of Ubiquiti Inc. MikroTik and RouterOS are trademarks of SIA Mikrotikls. All other trademarks belong to their respective owners.