How do I connect Remnux MCP Server to Claude?

The listing records `docker run -d --name remnux remnux/remnux-distro:noble` as its setup step. Run it, then follow the repository's instructions for the client configuration; the listing names Claude Desktop, Claude Code, Cursor as compatible clients.

Is Remnux MCP Server free?

The listed licence is GPL-3.0. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.

What can Remnux MCP Server do?

Remnux MCP Server documents 18 tools to the agent, including analyze_file, check_behavior_prerequisites, check_tools. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.

Remnux MCP Server

Unclaimed

by REMnux

MCP server for using the REMnux malware analysis toolkit via AI assistants

Install

$docker run -d --name remnux remnux/remnux-distro:noble

Set up this server

Compare servers My Stack

This server needs project-specific setup. Follow the project instructions; no reusable public launch command is available yet.

Project instructions

Is this your MCP server?

This listing was auto-indexed from the public record. Claim it to edit the page, set compatibility and unlock growth tools. Takes under two minutes.

Claim this server

Security profile

Claimed and verified servers get a weekly static scan that shows what the code can reach: external services, environment variables, shell commands, agent configuration folders, plus any dependencies with known advisories. Claim this listing to get one. How the security profile works

18 of 18 tools

Documented tools (18)

From project documentation. A server handshake does not verify each tool’s description or behavior.

analyze_file

Auto-select and run REMnux tools based on detected file type

check_behavior_prerequisites

For a Windows PE, report per-behavior staticcapability (clipboard, HTTP/WinHTTP C2, injection, persistence, etc.) from the import table; packed/.NET binaries return analysisincomplete, not a false negative

check_tools

Check which REMnux analysis tools are installed and available

compare_files

Structured diff of two related samples (loader vs payload): size/entropy, architecture, compiler, packer, imports, capabilities, and sections added/removed

download_file

Download a file from the output directory to the host (password-protected archive by default; password: infected)

download_from_url

Download a file from a URL into the samples directory

extract_archive

Extract .zip, .7z, .rar archives with automatic password detection (infected, malware, virus). Handles WinZip AES-256 .zip and header-encrypted .7z (-mhe=on) by routing to 7z automatically

extract_iocs

Extract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text with confidence scoring

get_file_info

Get file type, hashes (SHA256, MD5), basic metadata

get_osint_guidance

Return bundled, offline OSINT triage guidance for malware indicators. Enrichment tradecraft (hash-first, disclosure-aware, do-not-tip-off-the-adversary, leads-not-verdicts) plus a curated, PR-maintained catalog of free and freemium lookup services. topic selects the guidance slice, ioctype narrows t

get_report_guidance

Return bundled report writing guidelines (sections, confidence, capabilities, IOC tiering, anti-patterns); topic narrows the digest, or topic='triagechecklist' returns the pre-claim artifact-vs-behavior triage discipline checklist

get_report_template

Return a bundled malware analysis report template (CC BY 4.0, by Lenny Zeltser) for drafting a report offline. The response also carries an optionalsectionconvention explaining that headings marked (Optional) are conditional markers to resolve, not literal heading text

get_tool_help

Get usage help (--help output) for any installed REMnux tool

list_files

List files in samples or output directory

run_tool

Execute a command in REMnux (supports piped commands)

suggest_tools

Detect file type and return recommended tools with analysis hints (no execution)

upload_from_host

Upload a file from the host to the samples directory (200MB limit)

verify_string_usage

Check whether an embedded string is referenced by code (referencedfromcode) or vestigial (nocodexrefsdetected) using radare2 — never claims a string is "unused"; degraded analysis returns unknown

Tool change history

Compared across complete checks of the same configuration. Tools were listed, not invoked. Input-schema changes are not measured here.

No complete tool checks yet.

FAQ

Questions about Remnux MCP Server

How do I connect Remnux MCP Server to Claude?: The listing records `docker run -d --name remnux remnux/remnux-distro:noble` as its setup step. Run it, then follow the repository's instructions for the client configuration; the listing names Claude Desktop, Claude Code, Cursor as compatible clients.
Is Remnux MCP Server free?: The listed licence is GPL-3.0. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.
What can Remnux MCP Server do?: Remnux MCP Server documents 18 tools to the agent, including analyze_file, check_behavior_prerequisites, check_tools. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.