Ransomware Live MCP Server

This model context protocol (MCP) server interfaces with the ransomware.live API. Allowing you to use any LLM/MCP client of your choosing to reason over this data and find insights.

Credit for ransomware.live goes to its creator Julien Mousqueton.

🧰 Available Tools and Resources

• get_recent_victims: tool - get details about the last 100 victims claimed by ransomware groups that are tracked by ransomware.live
• get_sector_counts: tool - get the number of victims by sector that are tracked by ransomware.live
• get_victims_by_sector: tool - get details about victims within a specific sector
• get_victims_by_sector_countrycode: tool - get details about victims within a specific sector and country code
• get_victims_by_countrycode: tool - get details about victims within a specific country
• get_victims_by_year: tool - get details about the victims within a specific year
• get_victims_by_year_month: tool - get details about the victims within a specific year and month
• get_victims_by_keyword: tool - query for victims by keyword
• get_all_ransomware_groups: tool - get details about all ransomware groups that are tracked by ransomware.live
• get_ransomware_group: tool - get details about a specific ransomware group according to ransomware.live
• get_ransomware_group_victims: tool - get all victims of a specific ransomware group according to ransomware.live

📝 Usage

Start the server using the default stdio transport

uv run ransomwarelive_mcp_server

🧑‍💻 Usage (Development)

Start the server and test it with the MCP inspector

uv add "mcp[cli]"
mcp dev server.py

🔍 Example Use Case

Using the MCP server with Claude desktop (you must have Claude desktop installed)

uv add "mcp[cli]"
mcp install server.py --name "Ransomware Live MCP Server"

With a basic prompt:

With a basic prompt and visual output:

🪪 License

MIT License