Base URL: https://malwaretracker-912661936520.europe-west1.run.app

MalwareTracker & QuickSand API Documentation

Authenticate all API requests with an X-API-Key: mt_live_... header (or Authorization: Bearer mt_live_...). Generate a free key (1,000 scans/mo) in 5 seconds on the Developer Portal.

Endpoint #1 • B2D File Upload Security

POST /v1/scan — Synchronous In-Memory Document Scan

Unpacks PDFs, Office documents (OLE2, OOXML, RTF, XLM macros, encrypted VelvetSweatshop files), MIME emails, and archives in memory in <100ms. By default, ?store=false ensures zero file retention on disk or cloud storage for SOC 2, HIPAA, and ISO 27001 compliance.

curl -X POST "https://malwaretracker-912661936520.europe-west1.run.app/v1/scan?store=false" \
  -H "X-API-Key: mt_live_YOUR_API_KEY" \
  -F "file=@uploaded_invoice.pdf"
Endpoint #2 • SecOps & Phishing Automation

POST /v1/triage — SOAR Tier-0 Pre-Filter (Tines, Shuffle, n8n)

Designed for security automation workflows. Inspects 100% of incoming email attachments in milliseconds and outputs escalate_to_sandbox: true|false and recommended_action: "allow" | "detonate_in_sandbox" | "quarantine_and_detonate" so you only spend expensive dynamic sandbox quota on genuinely suspicious files.

curl -X POST "https://malwaretracker-912661936520.europe-west1.run.app/v1/triage" \
  -H "X-API-Key: mt_live_YOUR_API_KEY" \
  -F "file=@reported_phish.doc"

Download ready-to-import workflow templates in integrations/soar/.

Endpoint #3 • Threat Intelligence Subscription

GET /v1/rules/pro — QuickSand Pro Zero-Day YARA Feed

Available on Business Pro ($199/mo) and QuickSand Pro Feed Annual ($990/yr) plans. Serves the complete commercial YARA signature bundle covering 67+ Office & PDF CVEs, obfuscated executables, and AI prompt-injection rules.

curl -sSL "https://malwaretracker-912661936520.europe-west1.run.app/v1/rules/pro" \
  -H "X-API-Key: mt_live_YOUR_PRO_KEY" \
  -o quicksand_pro_rules.yara
Integration #4 • Cloud Storage Compliance

AWS S3 & Google Cloud Storage Bucket Guard

Satisfy SOC 2 & HIPAA storage scanning controls without slow, memory-heavy ClamAV containers. Deploy our Terraform appliance from integrations/bucket-guard/ to automatically scan objects uploaded to an untrusted bucket and promote clean files to clean or isolate threats in quarantine.

Integration #5 • AI Agent & RAG Security

QuickSand MCP Server & LangChain Guardrail

Add mcp-server-quicksand to Claude Desktop, Cursor, or your LangChain/LlamaIndex ingestion pipeline to detect invisible PDF text (3 Tr), zero-point font instructions, OOXML <w:vanish/> hidden prompts, and markdown exfiltration links.

{
  "mcpServers": {
    "quicksand-security": {
      "command": "python3",
      "args": ["/path/to/integrations/mcp-server/server.py"],
      "env": {
        "MALWARETRACKER_API_KEY": "mt_live_YOUR_API_KEY"
      }
    }
  }
}