Overview

AI-powered malware and forensics analysis lab orchestrated through Claude Code and MCP servers.

triage-llm-lab is a four-VM isolated sandbox that combines Claude Code with REMnux static analysis, SIFT Workstation digital forensics, Ghidra decompilation, VirusTotal intelligence, and Windows 11 dynamic analysis — all orchestrated through MCP servers from a clean Ubuntu host.

GitHub Repository

Hypervisor	VMware Workstation / Fusion
VMs	Ubuntu 24.04 + REMnux + SIFT Workstation + Windows 11
LLM	Claude Code (Sonnet)

Key Design Principles

Air-Gapped Analysis VMs

REMnux, SIFT, and Windows have no internet access. Samples never touch the LLM host — they live only on the isolated analysis VMs.

MCP Orchestration

Claude Code controls all VMs remotely over SSH via custom MCP servers — no manual command-line switching.

120+ Analysis Tools

Static analysis, YARA, Ghidra decompilation, .NET reversing, Office macro emulation, JS deobfuscation, memory forensics, disk imaging, x64dbg debugging, and more.

Windows Dynamic Analysis

x64dbg and WinDbg on VM4 with FakeNet-NG network simulation — debugger control via MCP through an SSH tunnel.

VM Layout

VM	OS	Role	Network	Internet
VM1	Ubuntu 24.04 LTS	Claude Code + MCP orchestration host	NAT + Host-only 192.168.56.10	✅ Yes
VM2	REMnux	Static malware analysis, Ghidra, deobfuscation	Host-only 192.168.56.20	❌ No
VM3	SIFT Workstation	Memory forensics, disk forensics, timelines	Host-only 192.168.56.30	❌ No
VM4	Windows 11	Dynamic analysis — x64dbg, WinDbg, FakeNet-NG	Host-only 192.168.56.40	❌ No

MCP Servers

MCP Server	Purpose
remnux-ssh	Run all REMnux static analysis tools remotely over SSH
sift-ssh	Run SIFT Workstation forensic tools over SSH (Volatility3, Sleuthkit, Plaso)
virustotal	Hash lookups, file reports, behavioral analysis, sample downloads
ghidra-mcp	Headless Ghidra decompilation via Docker (accessed through remnux-ssh)
x64dbg	x64dbg debugger control on Windows VM4 via HTTP MCP (SSH tunnel port 3000)
windbg	WinDbg/CDB crash dump and kernel analysis on Windows VM4 via HTTP MCP (SSH tunnel port 8000)