# osintverse-community/joe-sandbox

Searches Joe Sandbox for earlier malware analyses of a file hash, URL or domain, with verdicts and scores

## Install and run

```sh
ot install osintverse-community/joe-sandbox
ot run osintverse-community/joe-sandbox url:https://example.com/
ot run osintverse-community/joe-sandbox d:example.com
```

The first `ot run` installs the tool after asking once. New to `ot`? See https://otinstaller.com/docs/getting-started.

From an AI agent, through ot's MCP server (`ot mcp`):

```
run_tool {"tool":"osintverse-community/joe-sandbox","inputs":{"hash":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"}}
```

## Inputs

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `hash` | hash | no |  | MD5, SHA-1 or SHA-256 of a file (give one of hash, url or domain) |
| `url` | url | no |  | URL that was analysed (give one of hash, url or domain) |
| `domain` | domain | no |  | Domain seen in analyses (give one of hash, url or domain) |

## Outputs

Finds: document.

- `document`: Analyses with their verdict, detection, score and date

## What a run does

- Does not contact the target.
- Does not collect personal data.
- Needs an account (it logs in, or uses an account or API key of yours).
- Does not notify the target.
- Usually takes about 5 seconds.
- Connects to the internet.

An agent needs the person's consent before running this tool, because it uses the person's own account or API key. See https://otinstaller.com/docs/agents#consent.

## API keys

- `JBX_API_KEY` (required, free tier): Your Joe Sandbox API key (Cloud Basic's free key has a limited API and needs JBX_API_URL) Get one at https://www.joesecurity.org/joe-sandbox-cloud
- `JBX_API_URL` (optional): API address for Cloud Basic (https://www.joesandbox.com/api) or your own server; Cloud Pro is the default Get one at https://github.com/joesecurity/jbxapi

Store a key with `ot keys set NAME`; it stays in the OS keychain.

## Trust

- Latest version: 3.25.0
- Signed: no
- Verified publisher: yes
- Health: unknown
- Installs in the last 30 days: 0
- License: MIT
- Runtime: Python wheel (pipx), pinned by hash
- Repository: https://github.com/osintverse-community/joe-sandbox
- Packaged by the community from a third-party tool

## Links

- Web page: https://otinstaller.com/osintverse-community/joe-sandbox
- JSON: https://api.otinstaller.com/v1/tools/osintverse-community/joe-sandbox
- README: https://github.com/osintverse-community/joe-sandbox#readme
- Homepage: https://github.com/joesecurity/jbxapi
- Security details: https://otinstaller.com/osintverse-community/joe-sandbox/security
- Report a problem: https://otinstaller.com/osintverse-community/joe-sandbox/report