Remnux MCP Server
未认领MCP server for using the REMnux malware analysis toolkit via AI assistants
安装
docker run -d --name remnux remnux/remnux-distro:noble更多AI & ML服务器
浏览完整目录安全概况
已认领和已认证的服务器每周接受一次静态扫描，显示代码能触及的范围（外部服务、环境变量、shell 命令、代理配置目录）以及带有已知公告的依赖。认领此列表即可获得。 安全概况的工作原理
18 个工具中显示 18 个
文档中列出的工具 (18)
内容来自项目文档。服务器握手不会验证每个工具的说明或行为。
analyze_file
Auto-select and run REMnux tools based on detected file type
check_behavior_prerequisites
For a Windows PE, report per-behavior staticcapability (clipboard, HTTP/WinHTTP C2, injection, persistence, etc.) from the import table; packed/.NET binaries return analysisincomplete, not a false negative
check_tools
Check which REMnux analysis tools are installed and available
compare_files
Structured diff of two related samples (loader vs payload): size/entropy, architecture, compiler, packer, imports, capabilities, and sections added/removed
download_file
Download a file from the output directory to the host (password-protected archive by default; password: infected)
download_from_url
Download a file from a URL into the samples directory
extract_archive
Extract .zip, .7z, .rar archives with automatic password detection (infected, malware, virus). Handles WinZip AES-256 .zip and header-encrypted .7z (-mhe=on) by routing to 7z automatically
extract_iocs
Extract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text with confidence scoring
get_file_info
Get file type, hashes (SHA256, MD5), basic metadata
get_osint_guidance
Return bundled, offline OSINT triage guidance for malware indicators. Enrichment tradecraft (hash-first, disclosure-aware, do-not-tip-off-the-adversary, leads-not-verdicts) plus a curated, PR-maintained catalog of free and freemium lookup services. topic selects the guidance slice, ioctype narrows t
get_report_guidance
Return bundled report writing guidelines (sections, confidence, capabilities, IOC tiering, anti-patterns); topic narrows the digest, or topic='triagechecklist' returns the pre-claim artifact-vs-behavior triage discipline checklist
get_report_template
Return a bundled malware analysis report template (CC BY 4.0, by Lenny Zeltser) for drafting a report offline. The response also carries an optionalsectionconvention explaining that headings marked (Optional) are conditional markers to resolve, not literal heading text
get_tool_help
Get usage help (--help output) for any installed REMnux tool
list_files
List files in samples or output directory
run_tool
Execute a command in REMnux (supports piped commands)
suggest_tools
Detect file type and return recommended tools with analysis hints (no execution)
upload_from_host
Upload a file from the host to the samples directory (200MB limit)
verify_string_usage
Check whether an embedded string is referenced by code (referencedfromcode) or vestigial (nocodexrefsdetected) using radare2 — never claims a string is "unused"; degraded analysis returns unknown