abusech

README

abusech

abuse.ch MalwareBazaar malware-sample lookups for the gollem LLM agent framework.

github.com/gollem-dev/tools/abusech

Tools

Name	Description
abusech.bazaar.query	Query malware information from MalwareBazaar by file hash value.

Usage

ts, err := abusech.New("your-api-key")
if err != nil {
	return err
}
if err := ts.Ping(ctx); err != nil { // optional preflight
	return err
}

Options

Option	Default
WithBaseURL(string)	https://mb-api.abuse.ch/api/v1
WithHTTPClient(*http.Client)	http.DefaultClient
WithLogger(*slog.Logger)	slog.Default()

Testing

Mock tests run unconditionally. The live-service test runs only when TEST_ABUSECH_API_KEY is set:

TEST_ABUSECH_API_KEY=... go test ./...

Documentation

Overview

Package abusech provides a gollem.ToolSet for abuse.ch MalwareBazaar hash lookups.

Index

• type Option
  • func WithBaseURL(baseURL string) Option
  • func WithHTTPClient(client *http.Client) Option
  • func WithLogger(logger *slog.Logger) Option
• type ToolSet
  • func New(apiKey string, opts ...Option) (*ToolSet, error)
  • func (t *ToolSet) Ping(ctx context.Context) error
  • func (t *ToolSet) Run(ctx context.Context, name string, args map[string]any) (map[string]any, error)
  • func (t *ToolSet) Specs(ctx context.Context) ([]gollem.ToolSpec, error)

Types

type Option

type Option func(*ToolSet)

Option configures a ToolSet.

func WithBaseURL

func WithBaseURL(baseURL string) Option

WithBaseURL overrides the MalwareBazaar API base URL.

func WithHTTPClient

func WithHTTPClient(client *http.Client) Option

WithHTTPClient overrides the HTTP client used for requests.

func WithLogger

func WithLogger(logger *slog.Logger) Option

WithLogger sets the logger. A nil logger keeps the default (slog.Default()).

type ToolSet

type ToolSet struct {
	// contains filtered or unexported fields
}

ToolSet implements gollem.ToolSet for abuse.ch MalwareBazaar. Fields are unexported; configure via Option.

func New

func New(apiKey string, opts ...Option) (*ToolSet, error)

New constructs the ToolSet. apiKey is required; pass functional opts for optional configuration. It only validates static configuration; use Ping to verify connectivity and credentials.

func (*ToolSet) Ping

func (t *ToolSet) Ping(ctx context.Context) error

Ping verifies connectivity and credentials by querying a well-known SHA256 hash (Mirai malware sample present in MalwareBazaar).

func (*ToolSet) Run

func (t *ToolSet) Run(ctx context.Context, name string, args map[string]any) (map[string]any, error)

Run executes the named MalwareBazaar lookup.

func (*ToolSet) Specs

func (t *ToolSet) Specs(ctx context.Context) ([]gollem.ToolSpec, error)

Specs returns the MalwareBazaar tool specifications.