malbox - Malbox Docs

The malbox CLI is the unified entry point for Malbox. Use it to submit samples, manage analysis tasks and machines, register VM images, and administer the daemon. This page covers the analysis commands that talk to a running daemon over HTTP. For host-local daemon administration (install, upgrade, config, providers, plugin installs), see malbox daemon.

Earlier releases shipped a separate malboxctl binary for daemon administration. Those commands now live under malbox daemon.

Global flags

These flags are available on every subcommand.

Flag	Type	Default	Description
`--format`	`text` \| `json`	`text`	Output format
`--api-url`	`string`	From `cli.toml`	Override the API base URL
`-v`, `--verbose`	-	`false`	Enable verbose output (sets log level to DEBUG)
`-y`, `--yes`	-	`false`	Skip confirmation prompts

The API URL defaults to the value in ~/.config/malbox/cli.toml. If no config file exists, it falls back to http://127.0.0.1:8080.

task

Manage analysis tasks.

task submit

Submit a file for analysis.

malbox task submit <file> [options]

Argument / Flag	Type	Required	Default	Description
`file`	`string`	Yes	-	Path to the file to analyze
`--package`	`string`	No	-	Analysis package to use
`--module`	`string`	No	-	Analysis module to use
`--timeout`	`integer`	No	-	Analysis timeout in seconds
`--priority`	`integer`	No	-	Task priority (higher = more urgent)
`--tags`	`string[]`	No	-	Tags for the task (accepts multiple values)
`--owner`	`string`	No	-	Task owner
`--memory`	-	No	`false`	Enable memory dump
`--unique`	-	No	`false`	Only analyze if the sample is unique
`--enforce-timeout`	-	No	`false`	Enforce the timeout strictly

task list

List all tasks.

malbox task list

task get

Get details and results of a specific task.

malbox task get [id] [options]

Argument / Flag	Type	Required	Default	Description
`id`	`integer`	No	-	Task ID. If omitted, an interactive fuzzy-select menu is shown.
`--result`	`integer`	No	-	Fetch a specific result by its ID. JSON results are pretty-printed to a terminal; binary results are written raw when piped.

machine

Manage analysis machines.

machine list

List all machines.

malbox machine list

machine get

Get details of a specific machine.

malbox machine get [machine]

Argument	Type	Required	Default	Description
`machine`	`string`	No	-	Machine name or ID. If omitted, an interactive fuzzy-select menu is shown.

machine provision

Run a provisioning step against a machine.

malbox machine provision [machine] --provisioner <type> [options]

Argument / Flag	Type	Required	Default	Description
`machine`	`string`	No	-	Machine name or ID. If omitted, an interactive fuzzy-select menu is shown.
`--provisioner`	`string`	Yes	-	Provisioner type (for example, `ansible` or `native`)
`--snapshot`	`string`	No	-	Snapshot name to create after provisioning
`--revert-to`	`string`	No	`base`	Snapshot to revert to before provisioning
`--config`	`string`	No	-	Provisioner config as JSON (for example, `'{"playbook": "setup.yml"}'`)
`--plugins`	`string[]`	No	-	Guest plugin names to deploy (resolved from the daemon’s plugin registry)

machine provision-history

List provision run history for a machine.

malbox machine provision-history [machine]

Argument	Type	Required	Default	Description
`machine`	`string`	No	-	Machine name or ID. If omitted, an interactive fuzzy-select menu is shown.

machine snapshot list

List snapshots for a machine.

malbox machine snapshot list [machine]

Argument	Type	Required	Default	Description
`machine`	`string`	No	-	Machine name or ID. If omitted, an interactive fuzzy-select menu is shown.

machine snapshot delete

Delete a snapshot and its associated provision runs.

malbox machine snapshot delete [machine] [snapshot_name]

Argument	Type	Required	Default	Description
`machine`	`string`	No	-	Machine name or ID. If omitted, an interactive fuzzy-select menu is shown.
`snapshot_name`	`string`	No	-	Snapshot name. If omitted, an interactive fuzzy-select menu is shown.

image

Manage VM images.

image register

malbox image register --name <name> --platform <platform> --arch <arch> --path <path> [options]

Flag	Type	Required	Default	Description
`--name`	`string`	Yes	-	Image name
`--platform`	`windows` \| `linux`	Yes	-	Target platform
`--arch`	`x64` \| `x86`	Yes	-	Target architecture
`--path`	`string`	Yes	-	Path to the image file
`--image-format`	`string`	No	-	Image format (for example, `qcow2` or `vmdk`)
`--description`	`string`	No	-	Image description

image list

List all registered images.

malbox image list

image get

Get details of a specific image.

malbox image get <name>

Argument	Type	Required	Description
`name`	`string`	Yes	Image name

image delete

Delete an image.

malbox image delete <name>

Argument	Type	Required	Description
`name`	`string`	Yes	Image name

plugin

View analysis plugins registered with the running daemon. To install, update, or remove plugins on the host, use malbox daemon plugin.

plugin list

List registered plugins.

malbox plugin list [options]

Flag	Type	Required	Default	Description
`--type`	`string`	No	-	Filter by plugin type (for example, `guest` or `host`)

completion

Generate shell completions.

malbox completion <shell>

Argument	Type	Required	Description
`shell`	`bash` \| `zsh` \| `fish` \| `elvish` \| `powershell`	Yes	Target shell

To install completions, redirect the output to the appropriate location for your shell:

# Bash
malbox completion bash > ~/.local/share/bash-completion/completions/malbox

# Zsh
malbox completion zsh > ~/.zfunc/_malbox

# Fish
malbox completion fish > ~/.config/fish/completions/malbox.fish

Configuration

The malbox CLI reads its configuration from ~/.config/malbox/cli.toml:

[api]
url = "http://127.0.0.1:8080"

This file is created automatically by malbox daemon config init.

Environment variables

Variable	Description
`RUST_LOG`	Override the log level filter. Takes precedence over `--verbose`. Uses standard `tracing_subscriber::EnvFilter` syntax.

​Global flags

​task

​task submit

​task list

​task get

​machine

​machine list

​machine get

​machine provision

​machine provision-history

​machine snapshot list

​machine snapshot delete

​image

​image register

​image list

​image get

​image delete

​plugin

​plugin list

​completion

​Configuration

​Environment variables

Global flags

task

task submit

task list

task get

machine

machine list

machine get

machine provision

machine provision-history

machine snapshot list

machine snapshot delete

image

image register

image list

image get

image delete

plugin

plugin list

completion

Configuration

Environment variables