> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# remnux-ssh MCP

> Custom MCP server that lets Claude Code run analysis commands on REMnux over SSH.

## Build the MCP Server

```bash theme={null}
mkdir -p ~/mcp/remnux-mcp/src
cd ~/mcp/remnux-mcp

npm init -y
npm install @modelcontextprotocol/sdk ssh2 zod
npm install -D typescript @types/node @types/ssh2
npm pkg set type="module"

cat > tsconfig.json << 'EOF'
{
  "compilerOptions": {
    "target": "ES2022",
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
    "outDir": "build",
    "rootDir": "src",
    "strict": false,
    "esModuleInterop": true,
    "skipLibCheck": true
  },
  "include": ["src"]
}
EOF
```

Place the `index.ts` source into `~/mcp/remnux-mcp/src/index.ts`, then build:

```bash theme={null}
npx tsc
ls build/   # verify output
```

## Create Ghidra Helper Scripts on REMnux

These scripts solve SSH quoting issues when communicating with the Ghidra Docker container. The POST script automatically translates REMnux paths to container paths and supports an optional language parameter for shellcode/raw binaries.

```bash theme={null}
ssh remnux 'python3 -c "
import os
os.makedirs(\"/home/remnux/ghidra-scripts\", exist_ok=True)

get_script = \"\"\"#!/bin/sh
echo \"curl -s -H \x27Authorization: Bearer ghidra-lab-token\x27 http://localhost:8089\$1\" > /tmp/gh_cmd.sh
docker cp /tmp/gh_cmd.sh ghidra-mcp:/tmp/gh_cmd.sh
docker exec ghidra-mcp sh /tmp/gh_cmd.sh
\"\"\"

post_script = \"\"\"#!/bin/sh
FILE_PATH=\$(echo \"\$1\" | sed \x27s|/home/remnux/samples/|/data/|\x27)
LANGUAGE=\$2
if [ -n \"\$LANGUAGE\" ]; then
  BODY=\"{\\\"file\\\":\\\"\$FILE_PATH\\\",\\\"language\\\":\\\"\$LANGUAGE\\\"}\"
else
  BODY=\"{\\\"file\\\":\\\"\$FILE_PATH\\\"}\"
fi
echo \"\$BODY\" > /tmp/gh_body.json
echo \"curl -s -X POST -H \x27Authorization: Bearer ghidra-lab-token\x27 -H \x27Content-Type: application/json\x27 -d @/tmp/gh_body.json http://localhost:8089/load_program\" > /tmp/gh_post_cmd.sh
docker cp /tmp/gh_body.json ghidra-mcp:/tmp/gh_body.json
docker cp /tmp/gh_post_cmd.sh ghidra-mcp:/tmp/gh_post_cmd.sh
docker exec ghidra-mcp sh /tmp/gh_post_cmd.sh
\"\"\"

with open(\"/home/remnux/ghidra-scripts/ghidra-get.sh\", \"w\") as f: f.write(get_script)
with open(\"/home/remnux/ghidra-scripts/ghidra-post.sh\", \"w\") as f: f.write(post_script)
os.chmod(\"/home/remnux/ghidra-scripts/ghidra-get.sh\", 0o755)
os.chmod(\"/home/remnux/ghidra-scripts/ghidra-post.sh\", 0o755)
print(\"Scripts written\")
"'
```

The POST script maps `/home/remnux/samples/` → `/data/` automatically. For raw shellcode, pass the language as a second argument — e.g. `x86:LE:64:default`.

## Register with Claude Code

```bash theme={null}
claude mcp add remnux-ssh \
  --scope user \
  -- node /home/$USER/mcp/remnux-mcp/build/index.js \
  --host 192.168.56.20 \
  --username remnux \
  --private-key /home/$USER/.ssh/remnux_key

# Verify
claude mcp list | grep remnux-ssh
```

## MCP Tool Groups

| Group | Tag | Key Tools |
| - | - | - |
| Intake & Utility | `[UTILITY]` | `run_command`, `upload_sample`, `intake_sample`, `list_samples` |
| Quick Triage | `[TRIAGE]` | `triage_quick`, `triage_pe`, `triage_iocs`, `triage_office`, `triage_script`, `triage_elf`, `triage_python`, `triage_java`, `triage_go`, `triage_dotnet`, `triage_full` |
| Deep Static | `[STATIC]` | `analyze_file`, `floss_strings`, `capa_analyze`, `diec_analyze`, `binwalk_extract`, `extract_config` |
| Office Documents | `[OFFICE]` | `oleid_analyze`, `olevba_analyze`, `oledump_analyze`, `mraptor_analyze`, `vmonkey_analyze` |
| Script Deobfuscation | `[DEOBFUSCATE]` | `deobfuscate_js`, `js_beautify`, `js_extract_strings`, `deobfuscate_powershell` |
| MSI / MSIX | `[MSI]` | `msi_analyze`, `msi_extract_files`, `msix_analyze` |
| ELF / Linux | `[ELF]` | `elf_analyze`, `elf_imports`, `elf_sections`, `elf_iocs` |
| Python Malware | `[PYTHON]` | `pyinstaller_extract`, `python_decompile`, `python_analyze` |
| .NET Assembly | `[DOTNET]` | `dotnet_decompile`, `dotnet_il_disasm`, `dotnet_pe_headers`, `dotnet_metadata`, `dotnet_strings`, `dotnet_resources` |
| Java / JAR | `[JAVA]` | `java_decompile`, `java_disassemble`, `java_jar_inspect`, `java_extract_jar`, `jadx_decompile`, `java_strings_iocs` |
| Go Binaries | `[GO]` | `go_info`, `go_symbols`, `go_strings`, `go_capabilities`, `go_modules` |
| Ghidra | `[GHIDRA]` | `ghidra_load_sample`, `ghidra_run_analysis`, `ghidra_list_functions`, `ghidra_decompile`, `ghidra_list_imports`, `ghidra_list_strings`, `ghidra_detect_malware`, `ghidra_extract_iocs` |

> [!NOTE]
>
> For shellcode/raw binaries call `ghidra_run_analysis` with `entry_offset=0x0` after loading. Supported language IDs: `x86:LE:64:default`, `x86:LE:32:default`, `ARM:LE:32:v8`, `AARCH64:LE:64:v8A`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.