File Hash Verification MCP Server for AI Agents via CIRCL API

This n8n workflow transforms the CIRCL hashlookup API into a fully functional MCP (Model Context Protocol) server, enabling AI agents to easily query file hashes for threat intelligence. It supports 11 endpoints including bulk MD5/SHA1 searches, individual lookups for MD5/SHA1/SHA256, parents/children relations for SHA1, and database info. The MCP trigger acts as the entry point, with HTTP request nodes handling API calls to https://hashlookup.circl.lu, and AI expressions like $fromAI() auto-populating parameters for seamless integration.

Key benefits include rapid deployment of a security-focused server without custom coding, direct AI agent compatibility via webhook URL, and native response formatting. It saves hours of development time for security teams integrating threat intel into AI workflows, reducing manual hash checks and enabling automated malware analysis.

Ideal use cases: AI-powered security scanning in DevOps pipelines, file upload verification in web apps, incident response automation for SOC teams, and research tools for cybersecurity analysts. Setup is straightforward: import, add CIRCL credentials, activate, and connect your AI agents to the webhook for instant access to CIRCL's vast hash database.