2026-09-22 19:38 UTC
The MCP server summarizes tool output without dropping the findings. One "analyze_file" call to the MCP server runs 17 tools; their combined output can be more than fits in an Al model's context. The server extracts findings and indicators from the tools' output first, so a URL deep in the text still surfaces. The Al agent then gets a summary: key findings, every indicator, and paths to the full output on disk.The agent can decide to read the full output when it needs to, with trep or by fetching the file. "Teaching Al to Analyze Malware: How to Encode Practitioner Expertise into an MCP Server" by Lenny Zeltser at #blueteamcon (5/n)
Replies (1)
-
@PwnieFan@infosec.exchange 2026-09-22 19:39
Al, like humans, is subject to confirmation bias. Try to use neutral wording for filenames and output. For instance, "sample" instead of "malware" in filenames. Or "notable-import" instead of "suspicious-import" "Teaching Al to Analyze Malware: How to Encode Practitioner Expertise into an MCP Server" by Lenny Zeltser at #blueteamcon (6/n)