{"id":"7c10c2ef-e14c-4fbf-9808-3bfaca57ec25","slug":"litterbox","kind":"mcp","name":"LitterBox","summary":"A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.","owner":"BlackSnufkin","repoUrl":"https://github.com/BlackSnufkin/LitterBox","license":"GPL-3.0","licenseTier":"strong-copyleft","trust":"community","stars":1550,"match":null,"fewStars":false,"format":"mcp","createdAt":"2024-12-25T11:24:33.000Z","addedAt":"2026-10-14T03:42:04.658Z","logoUrl":"https://avatars.githubusercontent.com/u/61916899?u=c7441a7dbe6d3861728ab587e404f1761b9fc9f9&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["cloud-infra","developer-tools","communication"],"tags":["malware-development","redteam","sandbox","ai","docker-compose","malware-analysis","offensive-security"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-15T02:38:29.629Z","sample":false,"url":"https://conduits.dev/tools/litterbox","language":"YARA","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# LitterBox\n\n![LitterBox Logo](Screenshots/lb-logo.png)\n\n[![Python](https://img.shields.io/badge/Python-3.11+-3776AB?style=plastic&logo=python&logoColor=white)]()\n[![Windows](https://img.shields.io/badge/Windows-Supported-0078D6?style=plastic&logo=onlyfans&logoColor=black)]()\n[![Linux](https://img.shields.io/badge/Linux-Supported-FCC624?style=plastic&logo=linux&logoColor=black)]()\n[![Docker](https://img.shields.io/badge/Docker-Enabled-2496ED?style=plastic&logo=docker&logoColor=white)]()\n[![MCP](https://img.shields.io/badge/MCP-Enabled-412991?style=plastic&logo=openai&logoColor=black)]()\n[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/BlackSnufkin/LitterBox)\n[![GitHub Stars](https://img.shields.io/github/stars/BlackSnufkin/LitterBox)](https://github.com/BlackSnufkin/LitterBox/stargazers)\n\nA self-hosted payload-analysis sandbox for red teams. Upload a sample, run static / dynamic / EDR analysis against it, get a Detection Score and a triggering-indicators breakdown — decide whether the payload is field-ready before it leaves the lab.\n\nLitterBox can also dispatch payloads to a separate EDR-instrumented Windows VM (Elastic Defend or Fibratus) and pull the correlated detection alerts back into the results page.\n\n> While designed primarily for red teams, LitterBox is equally useful for blue teams running the same tools in their malware-analysis workflows.\n\n## Documentation\n\nOperator and developer documentation lives in the **[LitterBox Wiki](../../wiki)**.\n\n| Topic | Wiki page |\n|---|---|\n| How everything fits together | [Application Architecture](../../wiki/Application-Architecture) |\n| Run static + every reachable EDR in parallel | [All in One Pipeline](../../wiki/All-in-One-Pipeline) |\n| Dispatch payloads to a real EDR VM | [EDR Integration](../../wiki/EDR-Integration) → [Elastic Defend](../../wiki/Elastic-Defend-Setup) / [Fibratus](../../wiki/Fibratus-Setup) |\n| Whiskers agent (install, endpoints, build) | [Whiskers Agent](../../wiki/Whiskers-Agent) |\n| Every HTTP endpoint | [HTTP API Reference](../../wiki/HTTP-API-Reference) |\n| CLI / Python lib / MCP for LLMs | [GrumpyCats CLI](../../wiki/GrumpyCats-CLI) · [GrumpyCats Library](../../wiki/GrumpyCats-Library) · [LitterBoxMCP](../../wiki/LitterBoxMCP) |\n| What feeds the Detection Score | [Detection Score Explained](../../wiki/Detection-Score-Explained) |\n| Configure scanners / paths / timeouts | [Configuration Reference](../../wiki/Configuration-Reference) |\n| Add custom YARA rules / scanners | [YARA Rules Management](../../wiki/YARA-Rules-Management) · [New Scanner](../../wiki/New-Scanner) |\n\n## Installation\n\n### Windows\n\n```bash\ngit clone https://github.com/BlackSnufkin/LitterBox.git\ncd LitterBox\npython -m venv venv\n.\\venv\\Scripts\\Activate.ps1\npip install -r requirements.txt\npython litterbox.py            # add --debug for verbose logging\n```\n\nOpen `http://127.0.0.1:1337`. Requires Python 3.11+ and an admin shell.\n\n### Linux (Docker)\n\n```bash\ngit clone https://github.com/BlackSnufkin/LitterBox.git\ncd LitterBox/Docker\nchmod +x setup.sh\n./setup.sh\n```\n\nThe setup script provisions a Windows 10 container with KVM and runs LitterBox inside. Initial build takes ~1 hour.\n\n- **Install monitor**: `http://localhost:8006`\n- **RDP**: `localhost:3389` (creds in the docker compose file)\n- **LitterBox UI**: `http://127.0.0.1:1337` once setup completes\n\n### EDR setup (optional)\n\nDrop one or more profile YAMLs under `Config/edr_profiles/` and the upload page picks them up at boot. Full walkthroughs in the wiki: [Whiskers Agent](../../wiki/Whiskers-Agent) → [Elastic Defend Setup](../../wiki/Elastic-Defend-Setup) or [Fibratus Setup](../../wiki/Fibratus-Setup).\n\n## Scanners\n\nBundled binaries under `Scanners/`. Versions and last-update dates tracked here so operators can tell at a glance whether a scanner is current.\n\n| Scanner | Version | Last updated | Source |\n|---|---|---|---|\n| [PE-Sieve](https://github.com/hasherezade/pe-sieve) | 0.4.1.2 (`f1dc39d`) | 2026-05-02 | hasherezade/pe-sieve |\n| [Hollows-Hunter](https://github.com/hasherezade/hollows_hunter) | 0.4.1.2 (`e271f7e`) | 2026-04-18 | hasherezade/hollows_hunter |\n| [Moneta](https://github.com/forrest-orr/moneta) | `5b65395` | 2024-03-16 | forrest-orr/moneta |\n| [Patriot](https://github.com/joe-desimone/patriot) | — | 2024-12-29 | joe-desimone/patriot |\n| [Hunt-Sleeping-Beacons](https://github.com/thefLink/Hunt-Sleeping-Beacons) | `84dd3a9` | 2026-01-25 | thefLink/Hunt-Sleeping-Beacons |\n| [RedEdr](https://github.com/dobin/RedEdr) | `3bd6b97` (EXE-only build) | 2026-05-03 | dobin/RedEdr |\n| [YARA](https://github.com/VirusTotal/yara/releases) (engine `yara64.exe`) | — | 2024-12-29 | VirusTotal/yara |\n| Elastic YARA rules (`Scanners/Yara/rules/elastic-yara/`) | `d131ea8` | 2026-04-30 | elastic/protections-artifacts |\n| YARA-Forge Extended (`Scanners/Yara/rules/YARAForge/`) | 0.9.1 (release `20260503`) | 2026-05-03 | YARAHQ/yara-forge |\n| [CheckPlz](https://github.com/BlackSnufkin/CheckPlz) | — | 2024-12-29 | BlackSnufkin/CheckPlz |\n| [Stringnalyzer](https://github.com/BlackSnufkin/Rusty-Playground/tree/main/Stringnalyzer) | — | 2025-01-27 | BlackSnufkin/Rusty-Playground |\n| [HolyGrail](https://github.com/BlackSnufkin/HolyGrail) | — | 2025-08-18 | BlackSnufkin/HolyGrail |\n\nVersion format: `<release-version>` or `<release-version> (release)` when the binary is pulled from an upstream release; `<release-version> (\\`<commit>\\`)` or just `\\`<commit>\\`` when built from source. Last-updated date is the upstream commit / release date, not the local build date.\n\nWhen you refresh a scanner: replace the binary under its `Scanners/<Name>/` directory and update the row above (version + date).\n\n## Contributing\n\nSee [CONTRIBUTING.md](./CONTRIBUTING.md). Work in feature branches on personal forks.\n\n## Support 🍺\n\n<a href=\"https://www.buymeacoffee.com/blacksnufkin\"><img src=\"https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png\" width=\"200\" height=\"60\"></a>\n\n[![Stars](https://starchart.cc/blacksnufkin/litterbox.svg?variant=adaptive)](https://starchart.cc/blacksnufkin/litterbox)\n\n## Security Advisory\n\n- **Development use only.** This platform is designed for testing environments. Production deployment presents significant security risks.\n- **Isolation required.** Run only in isolated VMs or dedicated testing environments.\n- **No warranty.** Provided without guarantees; use at your own risk.\n- **Legal compliance.** Users are responsible for ensuring usage complies with applicable laws.\n\n## Acknowledgments\n\nLitterBox stands on the work of these projects and their authors:\n\n| Tool | Author |\n|---|---|\n| [YARA rules](https://github.com/elastic/protections-artifacts/tree/main/yara) · [Elastic Defend](https://www.elastic.co/security/endpoint-security) | [Elastic Security](https://github.com/elastic) |\n| [PE-Sieve](https://github.com/hasherezade/pe-sieve) · [Hollows-Hunter](https://github.com/hasherezade/hollows_hunter) | [hasherezade](https://github.com/hasherezade) |\n| [Moneta](https://github.com/forrest-orr/moneta) | [Forrest Orr](https://github.com/forrest-orr) |\n| [Patriot](https://github.com/joe-desimone/patriot) | [joe-desimone](https://github.com/joe-desimone) |\n| [Hunt-Sleeping-Beacons](https://github.com/thefLink/Hunt-Sleeping-Beacons) | [thefLink](https://github.com/thefLink) |\n| [RedEdr](https://github.com/dobin/RedEdr) | [dobin](https://github.com/dobin) |\n| [Fibratus](https://github.com/rabbitstack/fibratus) | [rabbitstack](https://github.com/rabbitstack) |\n| [ThreatCheck](https://github.com/rasta-mouse/ThreatCheck) (basis for CheckPlz) | [rasta-mouse](https://github.com/rasta-mouse) |\n| [MalAPI](https://malapi.io/) reference DB | [mr.d0x](https://github.com/mrd0x) |\n\n## Interface\n\n![LitterBox Demo](Screenshots/lb-demo.gif)\n"}