@remnux/mcp-server

Execute a command in REMnux. Supports piped commands (e.g.,

Get file type, hashes, and basic metadata

List files in samples or output directory

Extract files from a compressed archive (.zip, .7z, .rar), including WinZip AES-256 .zip and header-encrypted .7z (-mhe=on) — these route through 7z automatically. Tries a supplied password first, then common malware passwords (infected, malware, virus) if the archive is password-protected. Returns list of extracted files.

Download a file from a URL into the samples directory for analysis.

Download a file from the output directory (returns base64-encoded content). Use this to retrieve analysis results.

Auto-analyze a file using REMnux tools appropriate for the detected file type. Runs `file` to detect type, then executes matching tools (e.g., PE → peframe/capa, PDF → pdfid/pdf-parser, Office → olevba/oleid). Use `depth` to control analysis intensity:

Detect file type and return recommended REMnux analysis tools without executing them.

Extract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text.

Before claiming a Windows PE performs a behavior (clipboard hijacking, HTTP/WinHTTP C2, process injection,

Check whether a string embedded in a binary is actually referenced by code, or is a vestigial artifact

Compare two related samples (e.g. a loader and its unpacked payload) and return a structured diff: size and

Get usage help for a REMnux tool. Returns the tool

Check which REMnux analysis tools are installed and available. Returns a summary of installed vs missing tools across all file type categories.

Get a malware analysis report template (Markdown) bundled locally for offline use.

Get malware analysis report writing guidelines bundled locally for offline use — report sections,

OSINT triage for malware indicators. Given the hashes, C2 domains/IPs, and URLs from a sample (for