LitterBox

Why we included this project

LitterBox is a self-hosted sandbox where you can drop a sample and run static, dynamic, and EDR analysis in one go, getting back a Detection Score plus a list of which indicators actually fired. It pulls in familiar tools like PE-Sieve, Hollows-Hunter, Moneta, and YARA rules, so you can judge field-readiness without leaving your lab, and it can also ship samples to a separate EDR-instrumented Windows VM and pull the correlated alerts back into the same results page. The MCP integration is what makes it interesting for automation-minded teams: an LLM agent can drive the whole pipeline through a standard interface, which fits neatly into scripted red-team evals. Blue teams doing routine malware analysis can run the same workflows, though it's built for isolated test environments, not production.