← MCP Security Catalog

REMnux MCP Server 0.1.72

npm · @remnux/mcp-server · latest release

Scan failed
Security result
19
Observed tools
—
Version rating
—
Change risk

Independent inventory

Observed 2026-09-03T03:34:04.050Z using mcpSecurity-inventory. Protocol 2025-06-18.

ToolCategoryRisk
analyze_fileAuto-analyze a file using REMnux tools appropriate for the detected file type. Runs `file` to detect type, then executes matching tools (e.g., PE → peframe/capa, PDF → pdfid/pdf-parser, Office → olevba/oleid). Use `depth` to control analysis intensity: 'quick' (triage only), 'standard' (default), 'deep' (includes expensive tools). Note: 'standard' is sufficient for most files; use 'deep' only when standard doesn't reveal enough. Output includes a capability_evidence field (behavior_capable vs artifact_only) and per-capa evidence_types tags so you can tell code-backed capabilities from data-only artifacts — an artifact_only match means the data is present, not that the behavior executes.
Input schema
{
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "description": "Filename relative to samples directory, or absolute path in local mode"
    },
    "timeout_per_tool": {
      "type": "number",
      "description": "Timeout per tool in seconds (default: 60)"
    },
    "depth": {
      "type": "string",
      "enum": [
        "quick",
        "standard",
        "deep"
      ],
      "default": "standard",
      "description": "Analysis depth. 'quick' (~5-15s): fast triage. 'standard' (~30-90s, default): comprehensive analysis. 'deep' (~2-5min): exhaustive. Use 'deep' only when 'standard' isn't enough."
    }
  },
  "required": [
    "file"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
check_behavior_prerequisitesBefore claiming a Windows PE performs a behavior (clipboard hijacking, HTTP/WinHTTP C2, process injection, registry/LNK persistence, browser-credential theft, screen capture, keylogging, network-share enumeration), check whether the prerequisite APIs are even accessible. Reads the static import table (readpe) and detects packing (diec), then reports a `static_capability` per behavior: capable_statically / incapable_statically / possibly_via_dynamic_resolution (GetProcAddress + loader present) / analysis_incomplete (packed, or a managed/.NET assembly whose native imports don't reflect its capability — don't read it as a clean negative) / not_applicable (not a PE). This is a STATIC gate — it tells you whether the binary CAN call the required APIs, not whether it does. Omit `behavior` to scan all. Confirm any behavior with dynamic analysis.
Input schema
{
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "description": "Filename relative to the samples directory, or an absolute path in local mode."
    },
    "behavior": {
      "type": "string",
      "description": "Behavior to check (omit to scan ALL known behaviors). One of: clipboard_hijacking, http_c2_wininet, winhttp_c2, socket_c2, process_injection_remote, process_injection_self, registry_persistence_run, lnk_persistence, browser_credential_theft, screen_capture, keylog_polling, keylog_hook, network_share_enum."
    }
  },
  "required": [
    "file"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
check_toolsCheck which REMnux analysis tools are installed and available. Returns a summary of installed vs missing tools across all file type categories.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
——
compare_filesCompare two related samples (e.g. a loader and its unpacked payload) and return a structured diff: size and entropy deltas, architecture, compiler, packer, imports added/removed, capabilities (capa) added/removed, and section changes. Reuses readpe/diec/capa/radare2. Use depth='quick' to skip the (slower) capa capability diff. Surfaces what each stage adds without re-running tools by hand.
Input schema
{
  "type": "object",
  "properties": {
    "file_a": {
      "type": "string",
      "description": "First file (relative to the samples directory, or absolute in local mode)."
    },
    "file_b": {
      "type": "string",
      "description": "Second file to compare against file_a."
    },
    "depth": {
      "type": "string",
      "enum": [
        "quick",
        "standard"
      ],
      "description": "'standard' (default) includes a capa capability diff (slower — runs capa on both files); 'quick' skips capa (imports/sections/compiler/entropy only)."
    }
  },
  "required": [
    "file_a",
    "file_b"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
download_fileDownload a file from the output directory to a directory on the host (output_path); returns the host path. Use this to retrieve analysis results, including the text files the server saves when tool output exceeds a response budget (run_tool: stdout_saved_file, e.g. run_tool-<tool>-<hash>.stdout.txt; analyze_file: <tool>-<sample>.txt). To read such a file in-session instead, use run_tool with grep/sed -n on %OUTPUT%/<file>. Files are wrapped in a password-protected archive by default to prevent AV/EDR triggers. Pass archive: false for harmless files like text reports.
Input schema
{
  "type": "object",
  "properties": {
    "file_path": {
      "type": "string",
      "description": "File path relative to the output directory"
    },
    "output_path": {
      "type": "string",
      "description": "Directory on host to save the downloaded file"
    },
    "archive": {
      "type": "boolean",
      "default": true,
      "description": "Wrap the file in a password-protected archive before transfer (default: true). Protects against AV/EDR triggers on the host. Pass false for harmless files like text reports."
    }
  },
  "required": [
    "file_path",
    "output_path"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
download_from_urlDownload a file from a URL into the samples directory for analysis. Returns file metadata (hashes, type, size). Supports custom HTTP headers and an optional thug mode for sites requiring JavaScript execution.
Input schema
{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "format": "uri",
      "description": "URL to download (http or https only)"
    },
    "filename": {
      "type": "string",
      "description": "Override filename in samples dir. If omitted, derived from URL path."
    },
    "headers": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Custom HTTP headers as 'Name: value' strings. Example: ['User-Agent: Mozilla/5.0', 'X-Auth-Token: abc123']"
    },
    "method": {
      "type": "string",
      "enum": [
        "curl",
        "thug"
      ],
      "default": "curl",
      "description": "Download method. 'curl' (default) for direct HTTP download. 'thug' for sites requiring JavaScript execution (uses thug honeyclient)."
    },
    "overwrite": {
      "type": "boolean",
      "default": false,
      "description": "Whether to overwrite if file exists. Default: false"
    },
    "timeout": {
      "type": "number",
      "description": "Download timeout in seconds (default: server timeout)"
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
extract_archiveExtract files from a compressed archive (.zip, .7z, .rar), including WinZip AES-256 .zip and header-encrypted .7z (-mhe=on) — these route through 7z automatically. Tries a supplied password first, then common malware passwords (infected, malware, virus) if the archive is password-protected. Returns list of extracted files.
Input schema
{
  "type": "object",
  "properties": {
    "archive_file": {
      "type": "string",
      "description": "Path to archive file relative to samples directory (e.g., 'sample.zip')"
    },
    "password": {
      "type": "string",
      "description": "Optional password to try first. If not provided, tries common passwords from built-in list."
    },
    "output_subdir": {
      "type": "string",
      "description": "Optional subdirectory name for extracted files. Defaults to archive filename without extension."
    }
  },
  "required": [
    "archive_file"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
extract_iocsExtract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text. Pass output from run_tool or analyze_file to identify indicators. If that output was truncated (truncated: true), first read the saved file via run_tool (e.g. grep -iE 'https?://|[0-9]+\.[0-9]+\.' on %OUTPUT%/<stdout_saved_file>) and pass that output, or the IOCs past the cut are missed. Works well with Volatility 3 plugin output (netscan, cmdline, filescan). Returns deduplicated IOCs with confidence scores. Note: an IOC extracted from a binary's strings is an artifact (present in the file) — not evidence the binary uses it at runtime. Cross-reference it against reachable code or dynamic analysis before treating it as an operational indicator.
Input schema
{
  "type": "object",
  "properties": {
    "text": {
      "type": "string",
      "description": "Text to extract IOCs from (e.g., output from run_tool or analyze_file)"
    },
    "include_noise": {
      "type": "boolean",
      "default": false,
      "description": "Include low-confidence known-good IOCs"
    },
    "include_private_ips": {
      "type": "boolean",
      "default": false,
      "description": "Include private/internal IP addresses (10.x, 172.16-31.x, 192.168.x)"
    }
  },
  "required": [
    "text"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
get_file_infoGet file type, hashes, and basic metadata
Input schema
{
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "description": "File path relative to samples directory, or absolute path in local mode"
    }
  },
  "required": [
    "file"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
get_osint_guidanceOSINT triage for malware indicators. Given the hashes, C2 domains/IPs, and URLs from a sample (for example from analyze_file or extract_iocs), returns malware-specific enrichment tradecraft — hash-first and disclosure-aware, do not tip off the adversary, leads not verdicts — plus a curated catalog of free and freemium lookup services. Use `topic` to pick the guidance slice and `ioc_type` to narrow the catalog to a hash, url, domain, ip, family, or host_artifact. Guidance only: it runs no lookups and stores no API keys; the AI performs the lookups with its own tools.
Input schema
{
  "type": "object",
  "properties": {
    "topic": {
      "type": "string",
      "enum": [
        "all",
        "tradecraft",
        "workflow",
        "access",
        "resources"
      ],
      "default": "all",
      "description": "Which slice of guidance prose to return. 'all' (default) returns tradecraft + workflow + access guidance plus a CONDENSED resource catalog. 'tradecraft' returns the OPSEC principles, 'workflow' the per-IOC decision tree, 'access' the free-vs-paid handling, 'resources' the FULL catalog with per-entry detail. Lean flow for a real sample: call once with 'all' for prose plus a condensed index, then 'resources' with an ioc_type per indicator type for detail without re-emitting the prose."
    },
    "ioc_type": {
      "type": "string",
      "enum": [
        "hash",
        "url",
        "domain",
        "ip",
        "family",
        "host_artifact"
      ],
      "description": "Optional. When set, narrows the resource catalog to full-detail entries relevant to that IOC type. Orthogonal to `topic` (which selects the prose): `topic` picks guidance, `ioc_type` picks catalog rows."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
get_report_guidanceGet malware analysis report writing guidelines bundled locally for offline use — report sections, required fields, the MBC capability model, ICD-203 confidence, Pyramid-of-Pain IOC tiering, anti-patterns, and review criteria. Use `topic` to narrow the full digest, or topic='triage_checklist' for the pre-claim triage discipline checklist (artifact-vs-behavior gates) to consult at the START of an analysis. Every report-writing response (any topic except 'triage_checklist') also carries optional_section_convention (how to resolve (Optional) section markers when drafting). For interactive review or numeric scoring, the zeltser-website MCP server's malware_review_report / rating_score_writing offer more when connected.
Input schema
{
  "type": "object",
  "properties": {
    "topic": {
      "type": "string",
      "enum": [
        "all",
        "sections",
        "confidence",
        "capabilities",
        "pyramid_of_pain",
        "anti_patterns",
        "review",
        "writing",
        "frameworks",
        "profiles",
        "triage_checklist"
      ],
      "default": "all",
      "description": "Which slice of guidance to return. 'all' (default) returns the full writing-guidelines digest; narrow to 'sections', 'confidence', 'capabilities', 'pyramid_of_pain', 'anti_patterns', 'review', 'writing', 'frameworks', or 'profiles' to reduce size. 'triage_checklist' returns the pre-claim triage discipline checklist (artifact-vs-behavior gates to pass before drawing a behavioral conclusion) — useful at the START of an analysis, not just when writing up."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
get_report_templateGet a malware analysis report template (Markdown) bundled locally for offline use. Created by Lenny Zeltser, licensed CC BY 4.0. Use it to structure a report after analyzing a sample. The response also carries optional_section_convention: headings marked (Optional) are conditional markers to resolve (include only if warranted, and drop the marker), not literal heading text. For interactive review/scoring or the latest version, the zeltser-website MCP server's malware_get_template offers more when connected.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
——
get_server_infoReport the remnux-mcp-server version, how it reaches REMnux (connector mode and transport), and the REMnux distro version on the target. Use for diagnostics and when documenting which server/REMnux versions produced an analysis.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
——
get_tool_helpGet usage help for a REMnux tool. Returns the tool's --help output so you can understand available flags, options, and usage patterns.
Input schema
{
  "type": "object",
  "properties": {
    "tool": {
      "type": "string",
      "description": "Tool name (e.g., 'capa', 'pdfid.py', 'olevba'). Returns the tool's --help output."
    }
  },
  "required": [
    "tool"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
list_filesList files in samples or output directory
Input schema
{
  "type": "object",
  "properties": {
    "directory": {
      "type": "string",
      "enum": [
        "samples",
        "output"
      ],
      "default": "samples",
      "description": "Which directory to list"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
run_toolExecute a command in REMnux. Supports piped commands (e.g., 'oledump.py /home/remnux/files/samples/sample.doc | grep VBA'; use input_file for a single-tool command, or an absolute path inline when piping). stdout is returned whole up to 102,400 characters (see the command parameter for the truncation contract), so do not pre-cap output with '| head'; filter by content with grep instead. String extraction: For PE files use 'pestr'; for non-PE use 'strings' (ASCII) and 'strings -el' (Unicode). Note: capa matches under namespaces like collection/* or data-manipulation/* can be artifact-level (matched on strings/data) rather than behavioral; a behavioral capability requires the corresponding APIs to be imported or dynamically resolved. analyze_file tags capa findings with evidence_types to make this explicit.
Input schema
{
  "type": "object",
  "properties": {
    "command": {
      "type": "string",
      "description": "Command to execute (can include pipes, e.g., 'strings /home/remnux/files/samples/sample.exe | grep -i password'; commands run in the user's home, so name samples by absolute path or via input_file). The server returns stdout whole up to 102,400 characters, so a trailing '| head -N' or '| tail -N' only discards lines you would otherwise receive; narrow by content with grep when you want a subset. If a response sets truncated: true, follow its truncation_notice: the captured stdout is saved in the output directory as stdout_saved_file when an output directory is configured, and the notice gives a sed -n recipe on that file (or a redirect recipe) using %OUTPUT%/<file>, which the server replaces with that directory."
    },
    "input_file": {
      "type": "string",
      "description": "Input file path (relative to samples dir, or absolute path in local mode), appended as the final argument of the whole command, after any pipe, so in a pipeline it reaches the last stage (e.g. head), not the tool. When piping, put the sample's absolute path inline in command and omit input_file (list_files reports the samples directory path; without input_file the command does not run in the samples directory)."
    },
    "timeout": {
      "type": "number",
      "description": "Timeout in seconds (default: 300)"
    }
  },
  "required": [
    "command"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
suggest_toolsDetect file type and return recommended REMnux analysis tools without executing them. Use this to plan an analysis strategy, then run individual tools with run_tool. Returns tool names, descriptions, depth tiers, and expert analysis hints. For binaries, confirming a behavior (versus merely finding its artifacts) generally requires more than static analysis — plan for emulation (speakeasy) or sandbox detonation when a behavioral claim is needed.
Input schema
{
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "description": "Filename relative to samples directory, or absolute path in local mode"
    },
    "depth": {
      "type": "string",
      "enum": [
        "quick",
        "standard",
        "deep"
      ],
      "default": "standard",
      "description": "Filter recommendations by depth tier: 'quick' (triage only), 'standard' (default), 'deep' (all tools)"
    }
  },
  "required": [
    "file"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
upload_from_hostUpload a file from the host filesystem to the samples directory for analysis. Accepts an absolute host path — the MCP server reads the file locally and transfers it. Maximum file size: 200MB. Files can also be referenced by absolute path in analysis tools, bypassing the need to upload. For files outside the samples directory, pass the full path to get_file_info, analyze_file, or run_tool.
Input schema
{
  "type": "object",
  "properties": {
    "host_path": {
      "type": "string",
      "description": "Absolute path to the file on the machine where the MCP server runs (not the remote client in HTTP deployments). When the server is started with --sandbox, the resolved path must reside inside the configured --ingest-root (defaults to the samples directory)."
    },
    "filename": {
      "type": "string",
      "description": "Override filename in samples dir (defaults to basename of host_path)"
    },
    "overwrite": {
      "type": "boolean",
      "default": false,
      "description": "Whether to overwrite if file exists. Default: false"
    }
  },
  "required": [
    "host_path"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——
verify_string_usageCheck whether a string embedded in a binary is actually referenced by code, or is a vestigial artifact (e.g. a wallet address or C2 host sitting in .rdata). Uses radare2 to locate the string and find code cross-references to it. Returns a per-match `xref_status`: `referenced_from_code` (an instruction references it) / `no_code_xrefs_detected` (a COMPLETE-analysis null — NOT proof it is unused; the reference may be computed, indirect, or in code the analyzer missed) / `data_only` (non-code file) / `unknown` (analysis incomplete: packed, timed out, or version drift — never a negative). A static check: never concludes a string is 'unused', and confirm runtime use dynamically.
Input schema
{
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "description": "Filename relative to the samples directory, or an absolute path in local mode."
    },
    "query": {
      "type": "string",
      "description": "The string (or substring) to locate in the binary and cross-reference against code."
    },
    "depth": {
      "type": "string",
      "enum": [
        "standard",
        "deep"
      ],
      "description": "Analysis depth: 'standard' (radare2 aa; aar — default) or 'deep' (aaa — slower, more thorough)."
    },
    "max_matches": {
      "type": "number",
      "description": "Cap on the number of distinct matching strings to classify (default 50)."
    }
  },
  "required": [
    "file",
    "query"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
——

Resources 153

Resource templates 2

Prompts 0

Changes from previous version

No completed comparison is available.

RiskChangeSubject
No material changes recorded.

Confirmed vulnerabilities

SeverityFindingAdvisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: 04cbf492bb100a8e6beb6937849f0550c1cd0ef80f17eaedd951d03b2854edad

Scanner: mcp-proof-engine 0.1.0.

Let’s talk about MCP security.

Share your details and our security team will contact you.