analyze_file
Auto-select and run REMnux tools based on detected file type
How to use it
analyze_file is exposed by the Remnux MCP Server MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the analyze_file tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Remnux MCP Server
docker run -d --name remnux remnux/remnux-distro:nobleOther tools in Remnux MCP Server (17)
For a Windows PE, report per-behavior staticcapability (clipboard, HTTP/WinHTTP C2, injection, persistence, etc.) from the import table; packed/.NET binaries return analysisincomplete, not a false negative
Check which REMnux analysis tools are installed and available
Structured diff of two related samples (loader vs payload): size/entropy, architecture, compiler, packer, imports, capabilities, and sections added/removed
Download a file from the output directory to the host (password-protected archive by default; password: infected)
Download a file from a URL into the samples directory
Extract .zip, .7z, .rar archives with automatic password detection (infected, malware, virus). Handles WinZip AES-256 .zip and header-encrypted .7z (-mhe=on) by routing to 7z automatically
Extract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text with confidence scoring
Get file type, hashes (SHA256, MD5), basic metadata
Return bundled, offline OSINT triage guidance for malware indicators. Enrichment tradecraft (hash-first, disclosure-aware, do-not-tip-off-the-adversary, leads-not-verdicts) plus a curated, PR-maintained catalog of free and freemium lookup services. topic selects the guidance slice, ioctype narrows t
Return bundled report writing guidelines (sections, confidence, capabilities, IOC tiering, anti-patterns); topic narrows the digest, or topic='triagechecklist' returns the pre-claim artifact-vs-behavior triage discipline checklist
Return a bundled malware analysis report template (CC BY 4.0, by Lenny Zeltser) for drafting a report offline. The response also carries an optionalsectionconvention explaining that headings marked (Optional) are conditional markers to resolve, not literal heading text
Get usage help (--help output) for any installed REMnux tool
List files in samples or output directory
Execute a command in REMnux (supports piped commands)
Detect file type and return recommended tools with analysis hints (no execution)
Upload a file from the host to the samples directory (200MB limit)
Check whether an embedded string is referenced by code (referencedfromcode) or vestigial (nocodexrefsdetected) using radare2 — never claims a string is "unused"; degraded analysis returns unknown