Searches Joe Sandbox for earlier malware analyses of a file hash, URL or domain, with verdicts and scores
Community-packaged from github.com/joesecurity/jbxapi: the registry's community pins the upstream release; the tool is its authors' work. Maintain that project? Claim this package.
Run
Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).
{"tool":"osintverse-community/joe-sandbox"}Or just say: "Run osintverse-community/joe-sandbox on … with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.
ot run osintverse-community/joe-sandbox --format tableot install osintverse-community/joe-sandboxPython wheel, run in a read-only container (Docker optional with --native) · network allowed · needs JBX_API_KEY · up to 2 min. The first ot run installs the tool after asking once. Drop --format table for JSON.
ot? Install it in one linecurl -fsSL https://get.otinstaller.com/ot | shot release for your machine from GitHub Releases.checksums.txt, and the Ed25519 signature on that file against the key built into the script.ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.irm https://get.otinstaller.com/ot.ps1 | iexot release for your machine from GitHub Releases.checksums.txt, and the Ed25519 signature on that file against the key built into the script.ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.sha256:7fc82701…fa7b83 from PyPI. ot re-hashes the file after download and refuses a mismatch.ot warns before installing.ot downloads the copy and checks the same hash.Not health-checked yet; 3.25.0 came out today; nobody has said yet whether it works.
3.25.0 is in its first week. Nobody has said whether it works yet.
Used 3.25.0?It's broken for me
{
"code": 4,
"message": "Invalid API key"
}
The start of what version 3.25.0 printed on its test input (json), recorded by the registry on 24 Oct 2026. ot run wraps it in the result envelope.
This repository packages github.com/joesecurity/jbxapi for the OTInstaller Registry as osintverse-community/joe-sandbox. The tool is the work of its authors, under the MIT license; this repository only holds the manifest and release workflow.
Report problems with the tool upstream, and problems with the packaging here. If you maintain the upstream project and want to publish it yourself, open an issue or run ot claim osintverse-community/joe-sandbox: the package is transferred to you.
It installs the upstream project's own release from PyPI, pinned by version and hash; nothing here is rebuilt.
Searches earlier analyses (it never submits anything) on Joe Sandbox Cloud Pro. A free Cloud Basic key works too: set JBX_API_URL to https://www.joesandbox.com/api with ot keys set JBX_API_URL, or to your own Joe Sandbox server. Give one of --hash, --url or --domain.
API errors are printed as JSON and the exit code is 100 plus the API's error code. Without JBX_API_KEY the API answers error 4 and the CLI exits with code 104, which is what the registry's smoke test expects.
ot run osintverse-community/joe-sandbox --hash …Packaged version: 3.25.0.
Alternatives to joe-sandbox that also take a hash; ot auto runs every installed one on the same value.
Looks up a file hash in PolySwarm and shows how its marketplace of malware engines judged the file
Looks up a file hash in CIRCL hashlookup to see whether it belongs to known software, such as NSRL sets
Looks up an IP, domain, URL or file hash in AlienVault OTX: the threat reports that mention it, malware, tags
Looks up an IP, domain, URL or file hash in VirusTotal: engine verdicts, reputation, tags, owner, DNS records
Looks up a file hash in abuse.ch MalwareBazaar: malware family, tags, file type, first seen date and reporter