Skip to main content
Glama
RuoJi6

Memory Shell Detector MCP

by RuoJi6

view_class_code

Extract and decompile Java class bytecode from a running JVM process memory to readable source code for analyzing memory shells.

Instructions

执行 memory-shell-detector-cli.jar 从 JVM 内存中提取并反编译指定类的字节码

底层命令: java -jar memory-shell-detector-cli.jar -v <class_name> -p

此工具通过 Java Agent 从运行中的 JVM 进程内存中 dump 指定类的字节码, 然后使用内置反编译器将字节码还原为可读的 Java 源代码。

这是分析内存马的关键步骤,可以查看:

  • 类的完整实现逻辑

  • 恶意代码的具体行为(如命令执行、文件操作、网络连接等)

  • 内存马的注入方式和触发条件

Args: class_name: 要反编译的完整类名(如 com.example.EvilFilter) pid: 目标 Java 进程的 PID tools_dir: 检测工具 jar 包所在目录 use_ssh: 是否通过 SSH 在远程服务器执行 ssh_host/ssh_username/ssh_password/ssh_key_path/ssh_port: SSH 连接参数

Returns: source_code: 反编译后的 Java 源代码

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
class_nameYes
pidYes
tools_dirNo
use_sshNo
ssh_hostNo
ssh_usernameNo
ssh_passwordNo
ssh_key_pathNo
ssh_portNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It describes the process (dump bytecode, decompile) and underlying command, but does not disclose potential side effects (e.g., JVM impact), error conditions (class not found, invalid PID), or security requirements. Behavior beyond 'success' is missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections: purpose, command example, usage context, parameter list, and return value. It is somewhat verbose with redundant technical details, but information is front-loaded and logically organized. Minor conciseness improvements possible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (9 params, optional SSH, remote execution), the description covers the main workflow and parameters. However, it lacks guidance on SSH usage triggers, error handling, and prerequisites. An output schema exists but is not detailed here; the description's mention of 'source_code' is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain parameters. It provides brief but clear explanations for all 9 parameters, including examples for 'class_name' and 'pid', and context for SSH-related parameters. Could be more detailed (e.g., format constraints), but adequately adds meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool extracts and decompiles bytecode from JVM memory using a specific jar. It uses a specific verb ('extract and decompile') and specifies the resource (class bytecode). The tool is distinct from siblings like 'execute_command' or 'scan_process', which do not perform decompilation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions it's for analyzing memory shells ('内存马') but does not explicitly state when to use this tool versus alternatives like 'execute_command' or 'scan_process'. There is no guidance on prerequisites (e.g., Java Agent availability) or exclusions. Usage context is implied but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/RuoJi6/memory-shell-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server