check_tools

MCP tool from Remnux MCP Server by REMnux

Check which REMnux analysis tools are installed and available

How to use it

Project documentation lists check_tools for the Remnux MCP Server MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install Remnux MCP Server

$docker run -d --name remnux remnux/remnux-distro:noble

FULL REMNUX MCP SERVER LISTING

Other tools in Remnux MCP Server (17)

analyze_file

Auto-select and run REMnux tools based on detected file type

check_behavior_prerequisites

For a Windows PE, report per-behavior staticcapability (clipboard, HTTP/WinHTTP C2, injection, persistence, etc.) from the import table; packed/.NET binaries return analysisincomplete, not a false negative

compare_files

Structured diff of two related samples (loader vs payload): size/entropy, architecture, compiler, packer, imports, capabilities, and sections added/removed

download_file

Download a file from the output directory to the host (password-protected archive by default; password: infected)

download_from_url

Download a file from a URL into the samples directory

extract_archive

Extract .zip, .7z, .rar archives with automatic password detection (infected, malware, virus). Handles WinZip AES-256 .zip and header-encrypted .7z (-mhe=on) by routing to 7z automatically

extract_iocs

Extract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text with confidence scoring

get_file_info

Get file type, hashes (SHA256, MD5), basic metadata

get_osint_guidance

Return bundled, offline OSINT triage guidance for malware indicators. Enrichment tradecraft (hash-first, disclosure-aware, do-not-tip-off-the-adversary, leads-not-verdicts) plus a curated, PR-maintained catalog of free and freemium lookup services. topic selects the guidance slice, ioctype narrows t

get_report_guidance

Return bundled report writing guidelines (sections, confidence, capabilities, IOC tiering, anti-patterns); topic narrows the digest, or topic='triagechecklist' returns the pre-claim artifact-vs-behavior triage discipline checklist

get_report_template

Return a bundled malware analysis report template (CC BY 4.0, by Lenny Zeltser) for drafting a report offline. The response also carries an optionalsectionconvention explaining that headings marked (Optional) are conditional markers to resolve, not literal heading text

get_tool_help

Get usage help (--help output) for any installed REMnux tool

list_files

List files in samples or output directory

run_tool

Execute a command in REMnux (supports piped commands)

suggest_tools

Detect file type and return recommended tools with analysis hints (no execution)

upload_from_host

Upload a file from the host to the samples directory (200MB limit)

verify_string_usage

Check whether an embedded string is referenced by code (referencedfromcode) or vestigial (nocodexrefsdetected) using radare2 — never claims a string is "unused"; degraded analysis returns unknown