Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

YARAify (BYOK) — connector documentation

  • MCP endpoint: https://byok-yaraify.connectorbay.com/mcp
  • REST API: POST https://byok-yaraify.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-yaraify.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own YARAify abuse.ch Auth-Key, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-yaraify.connectorbay.com/health · Tool schemas: https://byok-yaraify.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-yaraify · agent@connectorbay.com

What YARAify (BYOK) is for

YARAify (BYOK) lets an AI assistant read your own YARAify data through the YARAify API with a key you supply (abuse.ch Auth-Key). Read-only: 10 tools (lookup_file_hash, get_task_results, get_files_by_yara_rule, get_files_by_clamav_signature, get_files_by_imphash, get_files_by_tlsh, get_files_by_telfhash, get_files_by_gimphash, get_files_by_icon_dhash, list_recent_yara_rules). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to yaraify-api.abuse.ch. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by YARAify. YARAify and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "What does YARAify know about file hash b0bb095dd0ad8b8de1c83b13c38e68dd?"
  • "What were the YARAify scan results for task fb2763e9-7b84-11ec-9f01-42010aa4000b?"
  • "Which files in YARAify carry YARA rule MALWARE_Win_Neshta?"
  • "Which files in YARAify carry ClamAV signature Win.Dropper.Gh0stRAT-978?"
  • "Which files in YARAify carry imphash 680b9682922177224183342c?"
  • "Which files in YARAify carry TLSH hash T140551236C8E05951CAEFD7?"

What it does

  • lookup_file_hash: Look up one file in YARAify by SHA256, MD5, SHA1 or SHA3-384 hash: file metadata, similarity hashes and the scan tasks that touched it with YARA and ClamAV matches.
  • get_task_results: Get the status and scan results (YARA and ClamAV matches, unpacked files) of one YARAify scan task by its task id.
  • get_files_by_yara_rule: List recent files known to YARAify that share a match for one YARA rule, with hashes, size, type, sightings and first and last seen dates.
  • get_files_by_clamav_signature: List recent files known to YARAify that share a match for one ClamAV signature, with hashes, size, type, sightings and first and last seen dates.
  • get_files_by_imphash: List recent files known to YARAify that share the same import hash (imphash), with hashes, size, type, sightings and first and last seen dates.
  • get_files_by_tlsh: List recent files known to YARAify that share a similar TLSH fuzzy hash, with hashes, size, type, sightings and first and last seen dates.
  • get_files_by_telfhash: List recent files known to YARAify that share the same telfhash (ELF import hash), with hashes, size, type, sightings and first and last seen dates.
  • get_files_by_gimphash: List recent files known to YARAify that share the same gimphash (Go import hash), with hashes, size, type, sightings and first and last seen dates.
  • get_files_by_icon_dhash: List recent files known to YARAify that share the same icon difference hash, with hashes, size, type, sightings and first and last seen dates.
  • list_recent_yara_rules: List the most recently deployed public (TLP:WHITE) YARA rules on YARAify with rule name, author, description, licence and Malpedia family.

BYOK key

You bring your own YARAify abuse.ch Auth-Key (https://auth.abuse.ch/). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to yaraify-api.abuse.ch over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the YARAify API (yaraify-api.abuse.ch) with a BYOK key; documentation: https://yaraify.abuse.ch/api/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by YARAify. YARAify and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your YARAify account.

Built for: Worldwide. Languages: English.