Remnux MCP Server

Findings (5)

• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.17: 1 known vulnerability

  GHSA-rmxm-3fg6-px4f

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.6: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  husky

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (19)

• run_tool

  Execute a command in REMnux. Supports piped commands (e.g., 'oledump.py /home/remnux/files/samples/sample.doc | grep VBA'; use input_file for a single-tool command, or an absolute path inline when piping). stdout is returned whole up to 102,400 characters (see the command parameter for the truncatio

• get_file_info

  Get file type, hashes, and basic metadata

• list_files

  List files in samples or output directory

• extract_archive

  Extract files from a compressed archive (.zip, .7z, .rar), including WinZip AES-256 .zip and header-encrypted .7z (-mhe=on) — these route through 7z automatically. Tries a supplied password first, then common malware passwords (infected, malware, virus) if the archive is password-protected. Returns

• upload_from_host

  Upload a file from the host filesystem to the samples directory for analysis. Accepts an absolute host path — the MCP server reads the file locally and transfers it. Maximum file size: 200MB. Files can also be referenced by absolute path in analysis tools, bypassing the need to upload. For files out

• download_from_url

  Download a file from a URL into the samples directory for analysis. Returns file metadata (hashes, type, size). Supports custom HTTP headers and an optional thug mode for sites requiring JavaScript execution (thug is not included in stock arm64 REMnux).

• download_file

  Download a file from the output directory to a directory on the host (output_path); returns the host path. Use this to retrieve analysis results, including the text files the server saves when tool output exceeds a response budget (run_tool: stdout_saved_file, e.g. run_tool-<tool>-<hash>.stdout.txt;

• analyze_file

  Auto-analyze a file using REMnux tools appropriate for the detected file type. Runs `file` to detect type, then executes matching tools (e.g., PE → peframe/capa, PDF → pdfid/pdf-parser, Office → olevba/oleid). Use `depth` to control analysis intensity: 'quick' (triage only), 'standard' (default), 'd

• suggest_tools

  Detect file type and return recommended REMnux analysis tools without executing them. Use this to plan an analysis strategy, then run individual tools with run_tool. Returns tool names, descriptions, depth tiers, and expert analysis hints. For binaries, confirming a behavior (versus merely finding i

• extract_iocs

  Extract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text. Pass output from run_tool or analyze_file to identify indicators. If that output was truncated (truncated: true), first read the saved file via run_tool (e.g. grep -iE 'https?://|[0-9]+\.[0-9]+\.' on %OUTPUT%/<stdout_saved_fil

• check_behavior_prerequisites

  Before claiming a Windows PE performs a behavior (clipboard hijacking, HTTP/WinHTTP C2, process injection, registry/LNK persistence, browser-credential theft, screen capture, keylogging, network-share enumeration), check whether the prerequisite APIs are even accessible. Reads the static import tabl

• verify_string_usage

  Check whether a string embedded in a binary is actually referenced by code, or is a vestigial artifact (e.g. a wallet address or C2 host sitting in .rdata). Uses radare2 to locate the string and find code cross-references to it. Returns a per-match `xref_status`: `referenced_from_code` (an instructi

• compare_files

  Compare two related samples (e.g. a loader and its unpacked payload) and return a structured diff: size and entropy deltas, architecture, compiler, packer, imports added/removed, capabilities (capa) added/removed, and section changes. Reuses readpe/diec/capa/radare2. Use depth='quick' to skip the (s

• get_tool_help

  Get usage help for a REMnux tool. Returns the tool's --help output so you can understand available flags, options, and usage patterns.

• check_tools

  Check which REMnux analysis tools are installed and available. Returns a summary of installed vs missing tools across all file type categories, the target's architecture, and a note on each missing tool that stock REMnux does not include on that architecture.

• get_server_info

  Report the remnux-mcp-server version, how it reaches REMnux (connector mode and transport), and the REMnux distro version and architecture (amd64 or arm64) on the target. Use for diagnostics and when documenting which server/REMnux versions produced an analysis. Stock arm64 REMnux lacks some tools.

• get_report_template

  Get a malware analysis report template (Markdown) bundled locally for offline use. Created by Lenny Zeltser, licensed CC BY 4.0. Use it to structure a report after analyzing a sample. The response also carries optional_section_convention: headings marked (Optional) are conditional markers to resolve

• get_report_guidance

  Get malware analysis report writing guidelines bundled locally for offline use — report sections, required fields, the MBC capability model, ICD-203 confidence, Pyramid-of-Pain IOC tiering, anti-patterns, and review criteria. Use `topic` to narrow the full digest, or topic='triage_checklist' for the

• get_osint_guidance

  OSINT triage for malware indicators. Given the hashes, C2 domains/IPs, and URLs from a sample (for example from analyze_file or extract_iocs), returns malware-specific enrichment tradecraft — hash-first and disclosure-aware, do not tip off the adversary, leads not verdicts — plus a curated catalog o