MCP server intelligence profile

REMnux MCP Server

Enables AI assistants to execute malware analysis tools on a REMnux system via Docker, SSH, or local connections. It provides automated file-type analysis, structured tool discovery, and security guardrails for streamlined malware investigation

HybridOfficial distributionREMnux
Verified cleanNpm · 0.1.72

Our scanner tested version 0.1.72 without proving a finding in the methods exercised. This is not a guarantee that every deployment is secure.

1Distribution channel
19Independently observed tools
1Linked remote endpoint
AvailableVersion intelligence

Install and connect

Installation and connection instructions are shown only when supported by retained package, repository, or endpoint evidence.

Install @remnux/mcp-server from npm

Install exact version 0.1.72. No verified executable entrypoint is available, so use the package documentation to launch it.

npm install --save-exact @remnux/mcp-server@0.1.72

Identity

Canonical slugremnux-mcp-server-92492e62DeploymentHybrid
Canonical packagenpm:@remnux/mcp-serverRepositoryREMnux/remnux-mcp-server
First published—Latest release—
Last security verification—Classification confidence82%
PublicationPublishedOfficial distributionYes

Distributions

ChannelIdentifierCurrent versionVersionsSource
npm@remnux/mcp-server0.1.7268Repository

Current release

PackageVersionPublished / observedInventorySecurity scan
npm@remnux/mcp-server0.1.72CurrentSep 5, 202619 toolsSucceeded · 153 resources · 0 promptsFailed
Enterprise protection

Continuously monitor this MCP for security risk

Independently scan the exact version your agents use, receive alerts when its risk changes, and investigate every finding with retained version evidence.

  • Independent exact-version security scans
  • Continuous release and vulnerability monitoring
  • Risk-change alerts with capability context
  • Historical evidence and API exports
Custom pricingContact salesTailored to your organization, integrations, data needs, and support requirements.

Current version evidence

Provenanceartifact_hash_verifiedSignature—
MCP SDK— Artifact SHA-25604cbf492bb100a8e6beb6937849f0550c1cd0ef80f17eaedd951d03b2854edad
Scannermcp-proof-engine 0.1.0Scan completedSep 3, 2026
Security rating—Methodology—

Current protocol inventory

2025-06-18Negotiated protocol
remnux-mcp-serverServer-reported name
2Capability groups
Sep 3, 2026Observed

Tools 19

ToolCategoryAnnotationsRisk
analyze_fileAuto-analyze a file using REMnux tools appropriate for the detected file type. Runs `file` to detect type, then executes matching tools (e.g., PE → peframe/capa, PDF → pdfid/pdf-parser, Office → olevba/oleid). Use `depth` to control analysis intensity: 'quick' (triage only), 'standard' (default), 'deep' (includes expensive tools). Note: 'standard' is sufficient for most files; use 'deep' only when standard doesn't reveal enough. Output includes a capability_evidence field (behavior_capable vs artifact_only) and per-capa evidence_types tags so you can tell code-backed capabilities from data-only artifacts — an artifact_only match means the data is present, not that the behavior executes.
Input schema
{
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "description": "Filename relative to samples directory, or absolute path in local mode"
    },
    "timeout_per_tool": {
      "type": "number",
      "description": "Timeout per tool in seconds (default: 60)"
    },
    "depth": {
      "type": "string",
      "enum": [
        "quick",
        "standard",
        "deep"
      ],
      "default": "standard",
      "description": "Analysis depth. 'quick' (~5-15s): fast triage. 'standard' (~30-90s, default): comprehensive analysis. 'deep' (~2-5min): exhaustive. Use 'deep' only when 'standard' isn't enough."
    }
  },
  "required": [
    "file"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
check_behavior_prerequisitesBefore claiming a Windows PE performs a behavior (clipboard hijacking, HTTP/WinHTTP C2, process injection, registry/LNK persistence, browser-credential theft, screen capture, keylogging, network-share enumeration), check whether the prerequisite APIs are even accessible. Reads the static import table (readpe) and detects packing (diec), then reports a `static_capability` per behavior: capable_statically / incapable_statically / possibly_via_dynamic_resolution (GetProcAddress + loader present) / analysis_incomplete (packed, or a managed/.NET assembly whose native imports don't reflect its capability — don't read it as a clean negative) / not_applicable (not a PE). This is a STATIC gate — it tells you whether the binary CAN call the required APIs, not whether it does. Omit `behavior` to scan all. Confirm any behavior with dynamic analysis.
Input schema
{
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "description": "Filename relative to the samples directory, or an absolute path in local mode."
    },
    "behavior": {
      "type": "string",
      "description": "Behavior to check (omit to scan ALL known behaviors). One of: clipboard_hijacking, http_c2_wininet, winhttp_c2, socket_c2, process_injection_remote, process_injection_self, registry_persistence_run, lnk_persistence, browser_credential_theft, screen_capture, keylog_polling, keylog_hook, network_share_enum."
    }
  },
  "required": [
    "file"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
check_toolsCheck which REMnux analysis tools are installed and available. Returns a summary of installed vs missing tools across all file type categories.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
——
compare_filesCompare two related samples (e.g. a loader and its unpacked payload) and return a structured diff: size and entropy deltas, architecture, compiler, packer, imports added/removed, capabilities (capa) added/removed, and section changes. Reuses readpe/diec/capa/radare2. Use depth='quick' to skip the (slower) capa capability diff. Surfaces what each stage adds without re-running tools by hand.
Input schema
{
  "type": "object",
  "properties": {
    "file_a": {
      "type": "string",
      "description": "First file (relative to the samples directory, or absolute in local mode)."
    },
    "file_b": {
      "type": "string",
      "description": "Second file to compare against file_a."
    },
    "depth": {
      "type": "string",
      "enum": [
        "quick",
        "standard"
      ],
      "description": "'standard' (default) includes a capa capability diff (slower — runs capa on both files); 'quick' skips capa (imports/sections/compiler/entropy only)."
    }
  },
  "required": [
    "file_a",
    "file_b"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
download_fileDownload a file from the output directory to a directory on the host (output_path); returns the host path. Use this to retrieve analysis results, including the text files the server saves when tool output exceeds a response budget (run_tool: stdout_saved_file, e.g. run_tool-<tool>-<hash>.stdout.txt; analyze_file: <tool>-<sample>.txt). To read such a file in-session instead, use run_tool with grep/sed -n on %OUTPUT%/<file>. Files are wrapped in a password-protected archive by default to prevent AV/EDR triggers. Pass archive: false for harmless files like text reports.
Input schema
{
  "type": "object",
  "properties": {
    "file_path": {
      "type": "string",
      "description": "File path relative to the output directory"
    },
    "output_path": {
      "type": "string",
      "description": "Directory on host to save the downloaded file"
    },
    "archive": {
      "type": "boolean",
      "default": true,
      "description": "Wrap the file in a password-protected archive before transfer (default: true). Protects against AV/EDR triggers on the host. Pass false for harmless files like text reports."
    }
  },
  "required": [
    "file_path",
    "output_path"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
download_from_urlDownload a file from a URL into the samples directory for analysis. Returns file metadata (hashes, type, size). Supports custom HTTP headers and an optional thug mode for sites requiring JavaScript execution.
Input schema
{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "format": "uri",
      "description": "URL to download (http or https only)"
    },
    "filename": {
      "type": "string",
      "description": "Override filename in samples dir. If omitted, derived from URL path."
    },
    "headers": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Custom HTTP headers as 'Name: value' strings. Example: ['User-Agent: Mozilla/5.0', 'X-Auth-Token: abc123']"
    },
    "method": {
      "type": "string",
      "enum": [
        "curl",
        "thug"
      ],
      "default": "curl",
      "description": "Download method. 'curl' (default) for direct HTTP download. 'thug' for sites requiring JavaScript execution (uses thug honeyclient)."
    },
    "overwrite": {
      "type": "boolean",
      "default": false,
      "description": "Whether to overwrite if file exists. Default: false"
    },
    "timeout": {
      "type": "number",
      "description": "Download timeout in seconds (default: server timeout)"
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
extract_archiveExtract files from a compressed archive (.zip, .7z, .rar), including WinZip AES-256 .zip and header-encrypted .7z (-mhe=on) — these route through 7z automatically. Tries a supplied password first, then common malware passwords (infected, malware, virus) if the archive is password-protected. Returns list of extracted files.
Input schema
{
  "type": "object",
  "properties": {
    "archive_file": {
      "type": "string",
      "description": "Path to archive file relative to samples directory (e.g., 'sample.zip')"
    },
    "password": {
      "type": "string",
      "description": "Optional password to try first. If not provided, tries common passwords from built-in list."
    },
    "output_subdir": {
      "type": "string",
      "description": "Optional subdirectory name for extracted files. Defaults to archive filename without extension."
    }
  },
  "required": [
    "archive_file"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
extract_iocsExtract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text. Pass output from run_tool or analyze_file to identify indicators. If that output was truncated (truncated: true), first read the saved file via run_tool (e.g. grep -iE 'https?://|[0-9]+\.[0-9]+\.' on %OUTPUT%/<stdout_saved_file>) and pass that output, or the IOCs past the cut are missed. Works well with Volatility 3 plugin output (netscan, cmdline, filescan). Returns deduplicated IOCs with confidence scores. Note: an IOC extracted from a binary's strings is an artifact (present in the file) — not evidence the binary uses it at runtime. Cross-reference it against reachable code or dynamic analysis before treating it as an operational indicator.
Input schema
{
  "type": "object",
  "properties": {
    "text": {
      "type": "string",
      "description": "Text to extract IOCs from (e.g., output from run_tool or analyze_file)"
    },
    "include_noise": {
      "type": "boolean",
      "default": false,
      "description": "Include low-confidence known-good IOCs"
    },
    "include_private_ips": {
      "type": "boolean",
      "default": false,
      "description": "Include private/internal IP addresses (10.x, 172.16-31.x, 192.168.x)"
    }
  },
  "required": [
    "text"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
get_file_infoGet file type, hashes, and basic metadata
Input schema
{
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "description": "File path relative to samples directory, or absolute path in local mode"
    }
  },
  "required": [
    "file"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
get_osint_guidanceOSINT triage for malware indicators. Given the hashes, C2 domains/IPs, and URLs from a sample (for example from analyze_file or extract_iocs), returns malware-specific enrichment tradecraft — hash-first and disclosure-aware, do not tip off the adversary, leads not verdicts — plus a curated catalog of free and freemium lookup services. Use `topic` to pick the guidance slice and `ioc_type` to narrow the catalog to a hash, url, domain, ip, family, or host_artifact. Guidance only: it runs no lookups and stores no API keys; the AI performs the lookups with its own tools.
Input schema
{
  "type": "object",
  "properties": {
    "topic": {
      "type": "string",
      "enum": [
        "all",
        "tradecraft",
        "workflow",
        "access",
        "resources"
      ],
      "default": "all",
      "description": "Which slice of guidance prose to return. 'all' (default) returns tradecraft + workflow + access guidance plus a CONDENSED resource catalog. 'tradecraft' returns the OPSEC principles, 'workflow' the per-IOC decision tree, 'access' the free-vs-paid handling, 'resources' the FULL catalog with per-entry detail. Lean flow for a real sample: call once with 'all' for prose plus a condensed index, then 'resources' with an ioc_type per indicator type for detail without re-emitting the prose."
    },
    "ioc_type": {
      "type": "string",
      "enum": [
        "hash",
        "url",
        "domain",
        "ip",
        "family",
        "host_artifact"
      ],
      "description": "Optional. When set, narrows the resource catalog to full-detail entries relevant to that IOC type. Orthogonal to `topic` (which selects the prose): `topic` picks guidance, `ioc_type` picks catalog rows."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
get_report_guidanceGet malware analysis report writing guidelines bundled locally for offline use — report sections, required fields, the MBC capability model, ICD-203 confidence, Pyramid-of-Pain IOC tiering, anti-patterns, and review criteria. Use `topic` to narrow the full digest, or topic='triage_checklist' for the pre-claim triage discipline checklist (artifact-vs-behavior gates) to consult at the START of an analysis. Every report-writing response (any topic except 'triage_checklist') also carries optional_section_convention (how to resolve (Optional) section markers when drafting). For interactive review or numeric scoring, the zeltser-website MCP server's malware_review_report / rating_score_writing offer more when connected.
Input schema
{
  "type": "object",
  "properties": {
    "topic": {
      "type": "string",
      "enum": [
        "all",
        "sections",
        "confidence",
        "capabilities",
        "pyramid_of_pain",
        "anti_patterns",
        "review",
        "writing",
        "frameworks",
        "profiles",
        "triage_checklist"
      ],
      "default": "all",
      "description": "Which slice of guidance to return. 'all' (default) returns the full writing-guidelines digest; narrow to 'sections', 'confidence', 'capabilities', 'pyramid_of_pain', 'anti_patterns', 'review', 'writing', 'frameworks', or 'profiles' to reduce size. 'triage_checklist' returns the pre-claim triage discipline checklist (artifact-vs-behavior gates to pass before drawing a behavioral conclusion) — useful at the START of an analysis, not just when writing up."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
get_report_templateGet a malware analysis report template (Markdown) bundled locally for offline use. Created by Lenny Zeltser, licensed CC BY 4.0. Use it to structure a report after analyzing a sample. The response also carries optional_section_convention: headings marked (Optional) are conditional markers to resolve (include only if warranted, and drop the marker), not literal heading text. For interactive review/scoring or the latest version, the zeltser-website MCP server's malware_get_template offers more when connected.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
——
get_server_infoReport the remnux-mcp-server version, how it reaches REMnux (connector mode and transport), and the REMnux distro version on the target. Use for diagnostics and when documenting which server/REMnux versions produced an analysis.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
——
get_tool_helpGet usage help for a REMnux tool. Returns the tool's --help output so you can understand available flags, options, and usage patterns.
Input schema
{
  "type": "object",
  "properties": {
    "tool": {
      "type": "string",
      "description": "Tool name (e.g., 'capa', 'pdfid.py', 'olevba'). Returns the tool's --help output."
    }
  },
  "required": [
    "tool"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
list_filesList files in samples or output directory
Input schema
{
  "type": "object",
  "properties": {
    "directory": {
      "type": "string",
      "enum": [
        "samples",
        "output"
      ],
      "default": "samples",
      "description": "Which directory to list"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
run_toolExecute a command in REMnux. Supports piped commands (e.g., 'oledump.py /home/remnux/files/samples/sample.doc | grep VBA'; use input_file for a single-tool command, or an absolute path inline when piping). stdout is returned whole up to 102,400 characters (see the command parameter for the truncation contract), so do not pre-cap output with '| head'; filter by content with grep instead. String extraction: For PE files use 'pestr'; for non-PE use 'strings' (ASCII) and 'strings -el' (Unicode). Note: capa matches under namespaces like collection/* or data-manipulation/* can be artifact-level (matched on strings/data) rather than behavioral; a behavioral capability requires the corresponding APIs to be imported or dynamically resolved. analyze_file tags capa findings with evidence_types to make this explicit.
Input schema
{
  "type": "object",
  "properties": {
    "command": {
      "type": "string",
      "description": "Command to execute (can include pipes, e.g., 'strings /home/remnux/files/samples/sample.exe | grep -i password'; commands run in the user's home, so name samples by absolute path or via input_file). The server returns stdout whole up to 102,400 characters, so a trailing '| head -N' or '| tail -N' only discards lines you would otherwise receive; narrow by content with grep when you want a subset. If a response sets truncated: true, follow its truncation_notice: the captured stdout is saved in the output directory as stdout_saved_file when an output directory is configured, and the notice gives a sed -n recipe on that file (or a redirect recipe) using %OUTPUT%/<file>, which the server replaces with that directory."
    },
    "input_file": {
      "type": "string",
      "description": "Input file path (relative to samples dir, or absolute path in local mode), appended as the final argument of the whole command, after any pipe, so in a pipeline it reaches the last stage (e.g. head), not the tool. When piping, put the sample's absolute path inline in command and omit input_file (list_files reports the samples directory path; without input_file the command does not run in the samples directory)."
    },
    "timeout": {
      "type": "number",
      "description": "Timeout in seconds (default: 300)"
    }
  },
  "required": [
    "command"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
suggest_toolsDetect file type and return recommended REMnux analysis tools without executing them. Use this to plan an analysis strategy, then run individual tools with run_tool. Returns tool names, descriptions, depth tiers, and expert analysis hints. For binaries, confirming a behavior (versus merely finding its artifacts) generally requires more than static analysis — plan for emulation (speakeasy) or sandbox detonation when a behavioral claim is needed.
Input schema
{
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "description": "Filename relative to samples directory, or absolute path in local mode"
    },
    "depth": {
      "type": "string",
      "enum": [
        "quick",
        "standard",
        "deep"
      ],
      "default": "standard",
      "description": "Filter recommendations by depth tier: 'quick' (triage only), 'standard' (default), 'deep' (all tools)"
    }
  },
  "required": [
    "file"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
upload_from_hostUpload a file from the host filesystem to the samples directory for analysis. Accepts an absolute host path — the MCP server reads the file locally and transfers it. Maximum file size: 200MB. Files can also be referenced by absolute path in analysis tools, bypassing the need to upload. For files outside the samples directory, pass the full path to get_file_info, analyze_file, or run_tool.
Input schema
{
  "type": "object",
  "properties": {
    "host_path": {
      "type": "string",
      "description": "Absolute path to the file on the machine where the MCP server runs (not the remote client in HTTP deployments). When the server is started with --sandbox, the resolved path must reside inside the configured --ingest-root (defaults to the samples directory)."
    },
    "filename": {
      "type": "string",
      "description": "Override filename in samples dir (defaults to basename of host_path)"
    },
    "overwrite": {
      "type": "boolean",
      "default": false,
      "description": "Whether to overwrite if file exists. Default: false"
    }
  },
  "required": [
    "host_path"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
verify_string_usageCheck whether a string embedded in a binary is actually referenced by code, or is a vestigial artifact (e.g. a wallet address or C2 host sitting in .rdata). Uses radare2 to locate the string and find code cross-references to it. Returns a per-match `xref_status`: `referenced_from_code` (an instruction references it) / `no_code_xrefs_detected` (a COMPLETE-analysis null — NOT proof it is unused; the reference may be computed, indirect, or in code the analyzer missed) / `data_only` (non-code file) / `unknown` (analysis incomplete: packed, timed out, or version drift — never a negative). A static check: never concludes a string is 'unused', and confirm runtime use dynamically.
Input schema
{
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "description": "Filename relative to the samples directory, or an absolute path in local mode."
    },
    "query": {
      "type": "string",
      "description": "The string (or substring) to locate in the binary and cross-reference against code."
    },
    "depth": {
      "type": "string",
      "enum": [
        "standard",
        "deep"
      ],
      "description": "Analysis depth: 'standard' (radare2 aa; aar — default) or 'deep' (aaa — slower, more thorough)."
    },
    "max_matches": {
      "type": "number",
      "description": "Cap on the number of distinct matching strings to classify (default 50)."
    }
  },
  "required": [
    "file",
    "query"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——

Resources 153

  • 1768remnux://tools/1768

    Analyze Cobalt Strike beacons and extract configuration details.

  • apkidremnux://tools/apkid

    Identify compilers, packers, and obfuscators used to protect Android APK and DEX files.

  • apktoolremnux://tools/apktool

    Reverse-engineer Android APK files.

  • autoit-ripperremnux://tools/autoit-ripper

    Extract and decompile AutoIt scripts from compiled executables.

  • base64dumpremnux://tools/base64dump

    Locate and decode Base64 and other encoded strings.

  • box-jsremnux://tools/box-js

    Emulate JavaScript in a sandbox to observe runtime behavior — recovers URLs and config assembled at runtime that static deobfuscation (webcrack) leaves unresolved. An older, emulation-based tool: it stalls on anti-emulation (e.g. a wscript self-relaunch), so it is a deliberate deep-tier step, not part of the fast standard chain.

  • brxorremnux://tools/brxor

    Bruteforce XOR-encoded strings to find English words.

  • caparemnux://tools/capa

    Identify capabilities in executable files using CAPA rules.

  • capa-vvremnux://tools/capa-vv

    Identify capabilities with verbose rule match details (addresses and evidence).

  • capinfosremnux://tools/capinfos

    Capture overview: packet count, duration, start/end timestamps, data rates, and link-layer encapsulation for a PCAP file.

  • cfrremnux://tools/cfr

    Decompile Java class files and JARs to readable Java source code.

  • cs-decrypt-metadataremnux://tools/cs-decrypt-metadata

    Decrypt and analyze Cobalt Strike beacon metadata.

  • csceremnux://tools/csce

    Extract Cobalt Strike beacon configuration from raw shellcode or memory dumps.

  • cut-bytesremnux://tools/cut-bytes

    Cut out portions of data streams by position or pattern.

  • decairemnux://tools/decai

    AI-assisted decompiler: turn a native PE/ELF function into readable pseudo-C with the decai radare2 plugin. REQUIRES a configured LLM backend — an API key or a local Ollama, set via 'decai -e' (e.g. 'decai -e api=openai'); without one it returns an error, not code. Function-scoped: first list functions with run_tool command="r2 -A -q -c afl <file>", then decompile a target by seeking to it: run_tool command="r2 -A -q -c 's main; decai -d' <file>" (or 's sym.<name>;', 's 0x<addr>;'). Check availability and settings with get_tool_help tool="decai". For deterministic, offline decompilation that needs no API key, use r2ghidra (pdg) instead.

  • decode-vberemnux://tools/decode-vbe

    Decode VBE-encoded VBScript files to readable source.

  • diecremnux://tools/diec

    Determine types of files and examine file properties.

  • disitoolremnux://tools/disitool

    Examine and manipulate embedded Authenticode digital signatures in PE files.

  • dotnetfile_dumpremnux://tools/dotnetfile_dump

    Analyze static properties of .NET files.

  • droidlysisremnux://tools/droidlysis

    Perform static analysis of Android applications.

  • emldumpremnux://tools/emldump

    Analyze and extract content from email (EML) files.

  • etl2pcapremnux://tools/etl2pcap

    Extract network packets from an ETL trace into a PCAP file. Only traces containing Microsoft-Windows-NDIS-PacketCapture events (e.g. from `netsh trace`) yield packets: a 24-byte header-only pcap means the trace holds no packet events, not that the tool failed.

  • etl2xmlremnux://tools/etl2xml

    Convert a Windows Event Trace Log (ETL) file to XML for inspection. REMnux's build decodes AMSI events, recovering scanned script content from antimalware traces.

  • exiftoolremnux://tools/exiftool

    Read and analyze EXIF metadata from various file types.

  • file-magicremnux://tools/file-magic

    Identify file types of data streams using libmagic signatures.

  • flossremnux://tools/floss

    Extract and deobfuscate strings from PE executables.

  • format-bytesremnux://tools/format-bytes

    Decompose and display structured binary data in readable format.

  • gootloader-decoderemnux://tools/gootloader-decode

    Statically deobfuscate GootLoader JScript to recover the payload and extract C2 domains.

  • ilspycmdremnux://tools/ilspycmd

    Decompile .NET assemblies to C# source code.

  • jadxremnux://tools/jadx

    Decompile Android APK/DEX files to Java source code.

  • js-beautifyremnux://tools/js-beautify

    Beautify and deobfuscate JavaScript, CSS, and HTML files.

  • js-deobfuscatorremnux://tools/js-deobfuscator

    Deobfuscate JavaScript by removing string arrays, proxy functions, and other common obfuscation.

  • js_unshroudremnux://tools/js_unshroud

    Observe JavaScript behavior on a LIVE web page: loads the URL in an instrumented Playwright Chromium browser and records runtime events (executed scripts, deobfuscated code, network activity) to a JSONL file. Unlike the file-based JavaScript tools, it analyzes a URL, not a local file — use it when the sample is a malicious page or when deobfuscation reveals a next-stage URL. In the invocation template, replace <file> with the URL. The run subcommand needs a display: current REMnux versions start a virtual one automatically via the tool's wrapper; on older installs prefix the command with 'xvfb-run -a'. It can exit 0 even when the browser fails to launch or dies mid-capture, so confirm the events file has content before drawing conclusions. Summarize captured events with 'js_unshroud analyze --input <events.jsonl> --format stats'; the query and correlate subcommands drill down further (all three read the local JSONL and need no display). OPSEC: the run subcommand visits live adversary infrastructure from your analysis network; see get_osint_guidance topic='tradecraft' before touching attacker-controlled URLs.

  • jstilleryremnux://tools/jstillery

    Deobfuscate JavaScript using AST-based partial evaluation.

  • manalyzeremnux://tools/manalyze

    Statically analyze PE files for imports, resources, and anomalies.

  • monodis-mresourcesremnux://tools/monodis-mresources

    Extract all embedded managed resources from a .NET assembly to the current directory.

  • monodis-presourcesremnux://tools/monodis-presources

    List embedded manifest resources in a .NET assembly (names and offsets).

  • msgconvertremnux://tools/msgconvert

    Convert Outlook MSG files to standard EML format.

  • msoffcrypto-crackremnux://tools/msoffcrypto-crack

    Attempt to recover the password of encrypted Microsoft Office documents.

  • numbers-to-stringremnux://tools/numbers-to-string

    Convert numeric representations to strings for deobfuscating encoded payloads.

  • oledumpremnux://tools/oledump

    Analyze OLE2 Structured Storage files.

  • oleidremnux://tools/oleid

    Analyze OLE2 files for risk indicators (macros, encryption, etc.).

  • olevbaremnux://tools/olevba

    Extract and analyze VBA macros from Microsoft Office documents.

  • onedumpremnux://tools/onedump

    Analyze OneNote documents and extract embedded files.

  • pcodedmpremnux://tools/pcodedmp

    Disassemble VBA p-code from Office documents.

  • pdf-parserremnux://tools/pdf-parser

    Examine elements and structure of a PDF file.

  • pdfcopremnux://tools/pdfcop

    Detect malicious PDF structures using policy-based heuristics.

  • pdfdecompressremnux://tools/pdfdecompress

    Decompress PDF streams to reveal obfuscated content.

  • pdfextractremnux://tools/pdfextract

    Extract JavaScript, attachments, fonts, images, and streams from PDF.

  • pdfidremnux://tools/pdfid

    Identify notable elements of a PDF file.

  • pdfid-detailedremnux://tools/pdfid-detailed

    Identify notable elements of a PDF file (detailed names output).

  • pdfresurrectremnux://tools/pdfresurrect

    Extract previous versions of content from PDF files.

  • pdftkremnux://tools/pdftk

    Manipulate PDF files: merge, split, decrypt, repair, and extract metadata.

  • pdftoolremnux://tools/pdftool

    Analyze incremental updates in PDF files to detect hidden payload swaps.

  • pecheckremnux://tools/pecheck

    Analyze static properties of PE files.

  • pedumpremnux://tools/pedump

    Statically analyze PE files and extract their components.

  • peepdf-3remnux://tools/peepdf-3

    Examine elements of a PDF file for notable content.

  • peframeremnux://tools/peframe

    Statically analyze PE and Microsoft Office files.

  • pescanremnux://tools/pescan

    Scan PE files for anomalies and notable indicators.

  • pestrremnux://tools/pestr

    Extract ASCII and Unicode strings from PE files with section and offset info.

  • portexremnux://tools/portex

    Statically analyze PE files for anomalies, structure, and metadata.

  • pycdcremnux://tools/pycdc

    Decompile Python bytecode (.pyc) to readable source code.

  • pyinstxtractor-ngremnux://tools/pyinstxtractor-ng

    Extract contents of PyInstaller executables without requiring a matching Python version.

  • qltool-sc-x64remnux://tools/qltool-sc-x64

    Emulate 64-bit Windows shellcode using Qiling framework (requires rootfs).

  • qltool-sc-x86remnux://tools/qltool-sc-x86

    Emulate 32-bit Windows shellcode using Qiling framework (requires rootfs).

  • qpdfremnux://tools/qpdf

    Decrypt password-protected or permission-locked PDF files.

  • r2airemnux://tools/r2ai

    AI assistant for radare2 (r2ai plugin): decompile or ask natural-language questions about the current function. REQUIRES a configured LLM backend — an API key or a local Ollama; without one it returns an error. Seek to a function first, then: run_tool command="r2 -A -q -c 's main; r2ai -d' <file>" to decompile, or run_tool command="r2 -A -q -c 's main; r2ai -d what does this function do' <file>" to ask about it. Check availability and settings with get_tool_help tool="r2ai". For deterministic, offline decompilation that needs no API key, use r2ghidra (pdg) instead.

  • r2ghidraremnux://tools/r2ghidra

    Decompile native PE/ELF functions to pseudo-C using the r2ghidra (Ghidra) decompiler in radare2. Function-scoped — one function per 'pdg'. List functions first: run_tool command="r2 -A -q -c afl <file>", then decompile a target: run_tool command="r2 -A -q -c 'pdg @ main' <file>" ('pdg @ entry0', 'pdg @ sym.<name>', or 'pdg @ 0x<addr>'). If the Ghidra plugin is unavailable, use radare2's native 'pdc' instead of 'pdg' (lower fidelity, no plugin). Decompiled output can be fed to extract_iocs.

  • re-searchremnux://tools/re-search

    Search files using regular expressions to extract patterns and data.

  • readelf-headerremnux://tools/readelf-header

    Display ELF file header information.

  • readelf-sectionsremnux://tools/readelf-sections

    Display ELF section headers.

  • redressremnux://tools/redress

    Analyze Go binaries to recover package names, type definitions, source structure, and compiler version.

  • report-guidelinesremnux://report/guidelines

    Malware analysis report writing guidelines digest (© Lenny Zeltser)

  • report-optional-section-conventionremnux://report/optional-section-convention

    How to handle report template headings marked (Optional): conditional markers to resolve, not literal text

  • report-templateremnux://report/template

    Malware analysis report template (Markdown, CC BY 4.0, by Lenny Zeltser)

  • rtfdumpremnux://tools/rtfdump

    Analyze RTF files for embedded content.

  • rtfobjremnux://tools/rtfobj

    Extract embedded objects from RTF files.

  • setsremnux://tools/sets

    Perform set operations (union, intersection, difference) on text file lines or bytes.

  • signsrchremnux://tools/signsrch

    Find patterns of common encryption, compression, or encoding algorithms.

  • speakeasyremnux://tools/speakeasy

    Emulate Windows PE, DLL, and driver execution using Speakeasy API emulation.

  • speakeasy-sc-x64remnux://tools/speakeasy-sc-x64

    Emulate 64-bit shellcode using Speakeasy Windows API emulation.

  • speakeasy-sc-x86remnux://tools/speakeasy-sc-x86

    Emulate 32-bit shellcode using Speakeasy Windows API emulation.

  • spidermonkeyremnux://tools/spidermonkey

    Execute JavaScript with SpiderMonkey engine using browser/PDF object emulation.

  • ssdeepremnux://tools/ssdeep

    Compute fuzzy hash (ssdeep) for file similarity comparison.

  • stringsremnux://tools/strings

    Extract printable ASCII strings from binary files. For Unicode (UTF-16), use 'strings -e l <file>' (little-endian) or 'strings -e b <file>' (big-endian). For PE files, prefer pestr which extracts both automatically.

  • toolsremnux://tools

    All registered REMnux analysis tools with metadata

  • Tools tagged "ai"remnux://tools/by-tag/ai

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "apk"remnux://tools/by-tag/apk

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "autoit"remnux://tools/by-tag/autoit

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "capabilities"remnux://tools/by-tag/capabilities

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "cobalt-strike"remnux://tools/by-tag/cobalt-strike

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "crypto"remnux://tools/by-tag/crypto

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "data-exe"remnux://tools/by-tag/data-exe

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "decompilation"remnux://tools/by-tag/decompilation

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "decryption"remnux://tools/by-tag/decryption

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "dotnet"remnux://tools/by-tag/dotnet

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "elf"remnux://tools/by-tag/elf

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "email"remnux://tools/by-tag/email

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "etl"remnux://tools/by-tag/etl

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "fallback"remnux://tools/by-tag/fallback

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "family-detection"remnux://tools/by-tag/family-detection

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "jar"remnux://tools/by-tag/jar

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "javascript"remnux://tools/by-tag/javascript

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "macros"remnux://tools/by-tag/macros

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "memory"remnux://tools/by-tag/memory

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "metadata"remnux://tools/by-tag/metadata

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "ole2"remnux://tools/by-tag/ole2

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "onenote"remnux://tools/by-tag/onenote

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "ooxml"remnux://tools/by-tag/ooxml

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "packer-detection"remnux://tools/by-tag/packer-detection

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "pcap"remnux://tools/by-tag/pcap

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "pdf"remnux://tools/by-tag/pdf

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "pe"remnux://tools/by-tag/pe

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "python"remnux://tools/by-tag/python

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "rtf"remnux://tools/by-tag/rtf

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "script"remnux://tools/by-tag/script

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "shellcode"remnux://tools/by-tag/shellcode

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "strings"remnux://tools/by-tag/strings

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "triage"remnux://tools/by-tag/triage

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "unpacking"remnux://tools/by-tag/unpacking

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • Tools tagged "yara"remnux://tools/by-tag/yara

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

  • tracescremnux://tools/tracesc

    Execute and trace shellcode via Wine to log API calls and behavior.

  • translateremnux://tools/translate

    Apply byte-level transforms to files (XOR, reverse, shift, custom expressions).

  • tshark-conversationsremnux://tools/tshark-conversations

    Summarize TCP/UDP conversations from a PCAP file.

  • tshark-dnsremnux://tools/tshark-dns

    Extract DNS queries and responses from a PCAP file.

  • tshark-fingerprintremnux://tools/tshark-fingerprint

    Fingerprint TLS clients (JA4 and JA3) per Client Hello, with SNI and destination IP/port, to cluster traffic by client stack and pivot to threat intel. Uses tshark's native fields, no plugin.

  • tshark-hierarchyremnux://tools/tshark-hierarchy

    Show protocol hierarchy statistics from a PCAP file.

  • tshark-httpremnux://tools/tshark-http

    Show HTTP request/response statistics from a PCAP file.

  • tshark-tlsremnux://tools/tshark-tls

    Extract TLS Client Hello server names (SNI) — surfaces destination/C2 domains even when payloads are encrypted.

  • tshark-verboseremnux://tools/tshark-verbose

    Full packet decode of first 50 packets from a PCAP file.

  • uncompyle6remnux://tools/uncompyle6

    Decompile Python bytecode (.pyc) to source code. Supports Python 1.0 through 3.8.

  • upx-decompressremnux://tools/upx-decompress

    Decompress UPX-packed executables in-place (keeps backup as .exe~).

  • vol3-cmdlineremnux://tools/vol3-cmdline

    Extract command-line arguments for each process.

  • vol3-dlllistremnux://tools/vol3-dlllist

    List loaded DLLs for each process.

  • vol3-filescanremnux://tools/vol3-filescan

    Scan for file objects in memory.

  • vol3-handlesremnux://tools/vol3-handles

    List open handles for each process.

  • vol3-hivelistremnux://tools/vol3-hivelist

    List registry hives found in memory.

  • vol3-inforemnux://tools/vol3-info

    Display OS and kernel details from a memory image.

  • vol3-linux-pslistremnux://tools/vol3-linux-pslist

    List running processes from a Linux memory image.

  • vol3-malfindremnux://tools/vol3-malfind

    Detect injected code and notable memory regions.

  • vol3-netscanremnux://tools/vol3-netscan

    Scan for network connections and sockets in a memory image.

  • vol3-pslistremnux://tools/vol3-pslist

    List running processes from a memory image.

  • vol3-psscanremnux://tools/vol3-psscan

    Find hidden or unlinked processes via pool tag scanning.

  • vol3-pstreeremnux://tools/vol3-pstree

    Display process tree from a memory image.

  • webcrackremnux://tools/webcrack

    Deobfuscate, unminify, and unpack bundled JavaScript, including scripts protected with obfuscator.io. Prints deobfuscated code to stdout; with -o <dir> it writes <dir>/deobfuscated.js instead, but refuses to run if the directory already exists — point -o at a fresh path and never pre-create it.

  • xlmdeobfuscatorremnux://tools/xlmdeobfuscator

    Deobfuscate Excel 4.0 (XLM) macros.

  • xmldumpremnux://tools/xmldump

    Format and analyze XML. For OOXML: zipdump.py -s <n> -d file | xmldump.py pretty

  • xor-kparemnux://tools/xor-kpa

    Perform XOR decryption using known-plaintext attack.

  • xorsearchremnux://tools/xorsearch

    Locate and decode strings obfuscated using XOR and other techniques.

  • xorsearch.pyremnux://tools/xorsearch.py

    Search for XOR/ROL/ROT/SHIFT encoded strings with JSON output and YARA support.

  • yara-forgeremnux://tools/yara-forge

    Scan for malware family signatures using curated YARA rules from 45+ sources (Malpedia, ReversingLabs, etc.). Matches indicate resemblance to known families, not confirmed attribution.

  • yara-rulesremnux://tools/yara-rules

    Scan a file with YARA rules to identify capabilities and behaviors (packer detection, anti-debug, networking).

  • zipdumpremnux://tools/zipdump

    Analyze zip-compressed files including OOXML and JAR.

Resource templates 2

  • tool-by-nameremnux://tools/{name}

    Single REMnux tool details by name

  • tools-by-tagremnux://tools/by-tag/{tag}

    REMnux tools filtered by tag (pe, pdf, ole2, etc.)

Prompts 0

  • None observed.

Remote endpoints

EndpointTransportAuthenticationHealthObserved
https://docs.remnux.org/~gitbook/mcpDeclared in Repository Readme · repositorystreamable_httpMCP 2025-06-18 · server 0.1.0none_observedMCP initialized · 1 attemptHTTP 200 · 211 msSep 4, 2026

REMnux MCP Server questions

How do I install REMnux MCP Server?

Install the selected package version with: npm install --save-exact @remnux/mcp-server@0.1.72

What tools does REMnux MCP Server provide?

REMnux MCP Server exposed 19 tools during independent protocol observation, including analyze_file, check_behavior_prerequisites, check_tools, compare_files, download_file, download_from_url, extract_archive, extract_iocs, and others.

Is REMnux MCP Server secure?

Our scanner tested version 0.1.72 without proving a finding in the methods exercised. This is not a guarantee that every deployment is secure.

Explore related MCP server guides

Curated product and capability guides containing this catalog record.

Official vs Community MCP Servers

Let’s talk about MCP security.

Share your details and our security team will contact you.