REMnux MCP Server
remnux-mcp-server
Malware analysis in REMnux through an agent: tool selection, automatic tool chains, IOC extraction and report templates
- 141 ★ on the repository
- Last commit
- GPL-3.0
Broad access
Why this level
- The agent runs commands in a REMnux environment that holds malicious samples.
- Without `--sandbox --ingest-root` upload reads any user file and download writes into any writable folder.
- Sample content and the file name can push the agent toward a false conclusion or a command.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/remnux-mcp-serverDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent runs commands in a REMnux environment that holds malicious samples.
- Without `--sandbox --ingest-root` upload reads any user file and download writes into any writable folder.
- Sample content and the file name can push the agent toward a false conclusion or a command.
This is third-party code. Review the repository files before installing.
What it does
The MCP server gives an agent the tools of REMnux, a Linux distribution for malware analysis. `suggest_tools` detects the file type and recommends tools, `analyze_file` runs the right chain at one of three depths (`quick`, `standard`, `deep`) and returns structured output with IOCs, and `run_tool` executes any command in the REMnux environment. The server steers the agent toward cautious conclusions. Wording is neutral ("notable" instead of "suspicious"), static findings are kept apart from observed behavior, and `check_behavior_prerequisites` and `verify_string_usage` test whether code supports a claimed behavior. A report template and an OSINT triage guide for indicators are bundled.
Who it is for. Malware analysts and incident responders who examine samples in REMnux together with an agent.
Good fit when
- A quick first look at a suspicious PE file is needed: type, packer and capabilities via capa.
- Embedded macros and XML are extracted from an Office document to look for indicators.
- Two samples are compared, a loader and its payload, by imports, sections and entropy.
- After analysis a report is drafted from the template along with an IOC enrichment plan.
Not a fit when
- REMnux is not deployed: there is no container or virtual machine with the distribution.
- Samples sit on your main workstation without isolation: the container or VM is the security boundary.
- A final verdict is wanted without analyst review: tool output remains material for a human decision.
Example request
Upload `sample.exe` to REMnux, run a quick analysis and show capabilities and IOCs, separating static findings from observed behavior.MCP
- Transport
- stdio, http
- Authentication
- not required
Environment variables
MCP_TOKENsecret- Token for HTTP mode; the server will not start on a non-loopback address without it.
Limitations
The container or VM is the security boundary, not the server guards: only null bytes and catastrophic commands such as `mkfs` and `rm -rf /` are blocked. Without `--sandbox --ingest-root`, `upload_from_host` reads any file your user can read and `download_file` writes into any directory you can write to. HTTP on a non-loopback address needs a token and a reverse proxy for HTTPS. Node.js 20 or newer and Docker or SSH access are required. Some tools are missing from REMnux on arm64.
How to disable. Remove the remnux entry from the MCP client configuration and stop the container with `docker rm -f remnux`. Delete samples and analysis output from the samples and output folders.
FAQ
How do I connect when the agent and REMnux are on one machine?
Run the server without `--mode`: local mode is the default and the standard `/home/remnux/files/samples` and `/home/remnux/files/output` folders work as they are.
What does `analyze_file` do with large output?
When total output exceeds about 32 KB, the tool switches to summary mode with key findings per tool, all IOCs and paths to the full output files.
How do I secure HTTP access?
The server refuses to start on a non-loopback address without `--http-token` or the `MCP_TOKEN` variable. Generate a token with `openssl rand -hex 32` and use a reverse proxy for HTTPS.
How many tools does `analyze_file` run?
It depends on depth: `quick` runs about 20 tools, `standard` about 80 and `deep` about 100. The figures span all file types, and only the relevant part runs for a given file.
How does the server handle sample archives?
`extract_archive` tries the passwords `infected`, `malware` and `virus` automatically, and `download_file` returns results in an archive with the password `infected` by default.
Discussion
No questions or reviews yet.
Related
MCP serversA malware analysis tool with an MCP server: the agent calls file, document and archive analysis, indicator extraction and signature checks
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
RE-MCP opens IDA Pro and Ghidra to an agent in headless mode: functions, decompiler, cross-references, types and patching.
MCP server for reverse engineering and malware analysis: decompilation, YARA, forensics and evidence-backed reports
An MCP server that gives the agent vulnerability triage: NVD data, EPSS, the CISA KEV catalog, MITRE ATT&CK mapping and one-call CVE risk scoring
An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research
README in short
Three layouts are described: agent and server on a workstation with REMnux in Docker or over SSH, everything on REMnux itself, and the server inside REMnux reached over HTTP. For sample handling there is host upload up to 200 MB and result download as a password-protected archive using `infected`.