BlackSnufkin/LitterBox

Health v2 · maintenance only

Adoption not part of the score

1526 stars · 170 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

LitterBox is a self-hosted payload-analysis sandbox for red teams that runs static, dynamic, and EDR-based analysis on samples and produces a Detection Score with triggering indicators. It includes an MCP server so LLM agents can drive the analysis pipeline end to end, and can dispatch payloads to an EDR-instrumented Windows VM.

Use cases

• test if my payload gets detected by EDR before deployment
• run static and dynamic malware analysis on a sample
• check which YARA rules trigger on my binary
• self-host a sandbox to score payload detection risk
• let an LLM agent automate malware analysis via MCP
• dispatch samples to an Elastic Defend or Fibratus VM and collect alerts
• blue team malware triage with detection indicator breakdown

When to choose

• you are a red team operator validating payloads against modern detection before field use
• you want a self-hosted alternative to online sandboxes for sensitive samples
• you want LLM-driven automated malware analysis via MCP
• you need EDR telemetry (Elastic Defend, Fibratus) correlated with sandbox results

When to avoid

• you need a general-purpose production malware detonation service at scale
• you lack Windows environments or admin access for EDR integration
• you only need simple antivirus scanning without detection scoring
• your organization prohibits offensive-security tooling

Facets

application · maturity active

security penetration-testing vulnerability-scanning mcp self-hosted developer-tools security penetration-testing developer-tools self-hosted windows self-hosted python red-team malware-analysis sandbox edr-testing payload-analysis yara detection-scoring offensive-security linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="BlackSnufkin/LitterBox")