Remnux MCP Server

Unclaimed

by REMnux

MCP server for using the REMnux malware analysis toolkit via AI assistants

Install

$docker run -d --name remnux remnux/remnux-distro:noble

Unclaimed listing

Is this your MCP server?

This listing was auto-indexed from the public record. Claim it to edit the page, set compatibility and unlock growth tools. Takes under two minutes.

Claim this server

Tools (18)

analyze_file

Auto-select and run REMnux tools based on detected file type

check_behavior_prerequisites

For a Windows PE, report per-behavior staticcapability (clipboard, HTTP/WinHTTP C2, injection, persistence, etc.) from the import table; packed/.NET binaries return analysisincomplete, not a false negative

check_tools

Check which REMnux analysis tools are installed and available

compare_files

Structured diff of two related samples (loader vs payload): size/entropy, architecture, compiler, packer, imports, capabilities, and sections added/removed

download_file

Download a file from the output directory to the host (password-protected archive by default; password: infected)

download_from_url

Download a file from a URL into the samples directory

extract_archive

Extract .zip, .7z, .rar archives with automatic password detection (infected, malware, virus). Handles WinZip AES-256 .zip and header-encrypted .7z (-mhe=on) by routing to 7z automatically

extract_iocs

Extract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text with confidence scoring

get_file_info

Get file type, hashes (SHA256, MD5), basic metadata

get_osint_guidance

Return bundled, offline OSINT triage guidance for malware indicators. Enrichment tradecraft (hash-first, disclosure-aware, do-not-tip-off-the-adversary, leads-not-verdicts) plus a curated, PR-maintained catalog of free and freemium lookup services. topic selects the guidance slice, ioctype narrows t

get_report_guidance

Return bundled report writing guidelines (sections, confidence, capabilities, IOC tiering, anti-patterns); topic narrows the digest, or topic='triagechecklist' returns the pre-claim artifact-vs-behavior triage discipline checklist

get_report_template

Return a bundled malware analysis report template (CC BY 4.0, by Lenny Zeltser) for drafting a report offline. The response also carries an optionalsectionconvention explaining that headings marked (Optional) are conditional markers to resolve, not literal heading text

get_tool_help

Get usage help (--help output) for any installed REMnux tool

list_files

List files in samples or output directory

run_tool

Execute a command in REMnux (supports piped commands)

suggest_tools

Detect file type and return recommended tools with analysis hints (no execution)

upload_from_host

Upload a file from the host to the samples directory (200MB limit)

verify_string_usage

Check whether an embedded string is referenced by code (referencedfromcode) or vestigial (nocodexrefsdetected) using radare2 — never claims a string is "unused"; degraded analysis returns unknown