{
  "specVersion": "1.0",
  "host": {
    "displayName": "Threat.Zone",
    "identifier": "did:web:threat.zone"
  },
  "entries": [
    {
      "identifier": "urn:air:threat.zone:mcp:threatzone",
      "displayName": "Threat.Zone MCP Server",
      "type": "application/mcp-server-card+json",
      "url": "https://threat.zone/.well-known/mcp/server-card.json",
      "description": "Submit files and URLs to the Threat.Zone malware sandbox, read verdicts, IOCs, MITRE ATT&CK mappings and network traffic, and drive the live sandbox VM.",
      "representativeQueries": [
        "analyze this suspicious file in a malware sandbox",
        "is this URL malicious",
        "get the IOCs and MITRE ATT&CK techniques for a malware sample",
        "download the PCAP from a sandbox run",
        "disarm this document with CDR"
      ]
    },
    {
      "identifier": "urn:air:threat.zone:api:public-api",
      "displayName": "Threat.Zone Public API",
      "type": "application/vnd.oai.openapi+json",
      "url": "https://app.threat.zone/public-api/docs-json",
      "description": "OpenAPI description of the Threat.Zone Public API: submissions for sandbox, static, CDR and URL analysis, reports, indicators and artifacts. Bearer API token from the Threat.Zone workspace.",
      "representativeQueries": [
        "submit a sample to Threat.Zone through the API",
        "Threat.Zone API endpoint for submission status",
        "download a malware analysis report as PDF",
        "list network connections from a sandbox analysis"
      ]
    }
  ]
}