MalwareAnalyzerMCP
# MalwareAnalyzerMCP
A specialized MCP server for Claude Desktop that allows executing terminal commands for malware analysis.
## Features
- Execute terminal commands with configurable timeouts
- Read output from running or completed processes
- Specialized malware analysis commands (`file`, `strings`, `hexdump`, `objdump`, `xxd`)
- Clean process management with graceful shutdowns
- Pure JavaScript implementation - no build step required
## Installation
```bash
# Install dependencies
npm install
```
## Usage
### Running the Server
```bash
# Start the server directly
node index.js
# Or use npm script
npm start
# With debugging proxy (logs all communications)
npm run debug
```
### Integration with Claude Desktop
To integrate this MCP server with Claude Desktop:
1. Open Claude Desktop's settings (Claude menu → Settings)
2. Click on "Developer" and then "Edit Config"
3. Update your configuration to include:
```json
{
"mcpServers": {
"MalwareAnalysisMCP": {
"command": "node",
"args": [
"/path/to/MalwareAnalysisMCP/index.js"
]
}
}
}
```
> **Note**: Replace `/path/to/MalwareAnalysisMCP` with the actual path to your project directory.
4. Restart Claude Desktop
## Debugging
To see all communication between Claude Desktop and the MCP server:
1. Update your Claude Desktop configuration to use the debug proxy:
```json
{
"mcpServers": {
"MalwareAnalysisMCP": {
"command": "node",
"args": [
"/path/to/MalwareAnalysisMCP/mcp-debug-proxy.js"
]
}
}
}
```
2. Check the logs in the `logs` directory
## Compatibility Notes
- Requires Node.js 18 or higher
- Compatible with Node.js v22+ using ESM modules
## API
### Basic Tools
#### shell_command
Executes a terminal command and returns its process ID, output, and blocked status.
Parameters:
- `command` (string): The command to execute in the terminal
- `timeout_ms` (number, optional): Timeout in milliseconds (default: 30000)
Returns:
- `pid` (number): Process ID
- `output` (string): Command output
- `isBlocked` (boolean): Whether the command execution is blocked/timed out
#### read_output
Reads output from a running or completed process.
Parameters:
- `pid` (number): The process ID to read output from
Returns:
- `output` (string | null): The process output, or null if the process is not found
### Specialized Malware Analysis Tools
The following specialized tools are available for malware analysis:
#### file
Analyze a file and determine its type.
Parameters:
- `target` (string): Target file to analyze
- `options` (string, optional): Additional command-line options
Example:
```json
{
"target": "suspicious.exe",
"options": "-b"
}
```
#### strings
Extract printable strings from a file.
Parameters:
- `target` (string): Target file to analyze
- `minLength` (number, optional): Minimum string length to display
- `encoding` (string, optional): String encoding (s=7-bit, S=8-bit, b=16-bit big-endian, l=16-bit little-endian, etc.)
- `options` (string, optional): Additional command-line options
Example:
```json
{
"target": "suspicious.exe",
"minLength": 10,
"encoding": "l"
}
```
#### hexdump
Display file contents in hexadecimal format.
Parameters:
- `target` (string): Target file to analyze
- `length` (number, optional): Number of bytes to display
- `offset` (number, optional): Starting offset in the file
- `options` (string, optional): Additional command-line options
Example:
```json
{
"target": "suspicious.exe",
"length": 256,
"offset": 1024
}
```
#### objdump
Display information from object files.
Parameters:
- `target` (string): Target file to analyze
- `disassemble` (boolean, optional): Disassemble executable sections
- `headers` (boolean, optional): Display the contents of the section headers
- `options` (string, optional): Additional command-line options
Example:
```json
{
"target": "suspicious.exe",
"disassemble": true
}
```
#### xxd
Create a hexdump with ASCII representation.
Parameters:
- `target` (string): Target file to analyze
- `length` (number, optional): Number of bytes to display
- `offset` (number, optional): Starting offset in the file
- `cols` (number, optional): Format output into specified number of columns
- `bits` (boolean, optional): Switch to bits (binary) dump
- `options` (string, optional): Additional command-line options
Example:
```json
{
"target": "suspicious.exe",
"cols": 16,
"bits": true
}
```
## License
ISC TDQS
Scored across 7 tools
Several tools have overlapping purposes that could cause confusion. The 'hexdump' and 'xxd' tools both create hexadecimal representations of files with similar options, making them difficult to distinguish. Additionally, 'read_output' and 'shell_command' both deal with process execution but have unclear boundaries, as 'shell_command' mentions background execution while 'read_output' focuses on output reading.
The naming conventions are mixed but still readable. Most tools use descriptive names like 'file', 'hexdump', 'objdump', and 'strings', which follow a consistent noun-based pattern. However, 'read_output' uses a verb_noun format while 'shell_command' uses a noun_noun format, creating minor inconsistency. The overall naming is functional but lacks a unified pattern.
With 7 tools, the count is reasonable for a malware analysis server, falling within the typical 3-15 range. It covers core analysis tasks like file identification, hex dumping, and string extraction. However, it feels slightly thin for comprehensive malware analysis, as it lacks tools for network analysis, behavior monitoring, or threat intelligence integration, which are common in this domain.
There are significant gaps in the tool surface for malware analysis. While basic file inspection tools are present, there is no coverage for dynamic analysis (e.g., sandbox execution), network traffic analysis, registry monitoring, or malware classification. The server focuses on static analysis only, leaving agents unable to perform common malware investigation workflows, which will likely cause failures in real-world scenarios.