yara-mcp

name	yara-mcp
description	Use when a task needs the local YARA MCP tools `yaraScan`, `yaraScanInline`, `yaraWriteRule`, `yaraListRules`, or `yaraHelp`, including choosing whether to scan with a saved rule file, inline rule text, or persist a rule into the standardized generated-artifact YARA directory.

YARA MCP

Use this skill for structured YARA scanning through the local MCP server.

Tool Surface

• yaraScan(target_path, rules_path="", recursive=True, show_strings=False, timeout_sec=300)
• yaraScanInline(target_path, rule_text, recursive=True, show_strings=False, timeout_sec=300)
• yaraListRules(max_rules=200)
• yaraWriteRule(rule_text, filename="", overwrite=False, validate=True, timeout_sec=15)
• yaraHelp(timeout_sec=5)

When To Use Which Tool

• Use yaraScan when you already have a saved .yar or .yara rule file.
• Use yaraScanInline for one-off rule text that should not be persisted.
• Use yaraWriteRule when you want to persist a rule into the standardized generated-artifact YARA directory and make it available to default YARA scans.
• Use yaraListRules to inspect both the base YARA rules and the generated YARA rules.
• Use yaraHelp when you need raw CLI help output.

Argument Guidance

• target_path: file or directory to scan.
• rules_path: optional saved rule file; omit it to use the default combined base-plus-generated rule set.
• recursive: mainly matters for directory targets.
• show_strings=True: include string match details when the task needs them.
• filename: optional simple file name for yaraWriteRule; otherwise the first rule name is used.
• validate=True: syntax-check the rule before writing when yara is installed.

Notes

• Base rules come from the configured YARA_RULES_DIR.
• If YARA_RULES_DIR is unset, this repo prefers ./third_party/signature-base.
• MCPServers/yara_rules is only a legacy fallback path.
• Generated rules default to AGENT_ARTIFACT_DIR/yara.
• yaraWriteRule refreshes index.yar in the generated-rules directory, and default scans include both the base rules and generated rules when rules_path is omitted.
• Prefer concise, specific rules over broad noisy conditions.