> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> AI-powered malware and forensics analysis lab orchestrated through Claude Code and MCP servers.

**triage-llm-lab** is a four-VM isolated sandbox that combines Claude Code with REMnux static analysis, SIFT Workstation digital forensics, Ghidra decompilation, VirusTotal intelligence, and Windows 11 dynamic analysis — all orchestrated through MCP servers from a clean Ubuntu host.

> [!NOTE]
>
> [GitHub Repository](https://github.com/tasox/triage-llm-lab)

| | |
| - | - |
| **Hypervisor** | VMware Workstation / Fusion |
| **VMs** | Ubuntu 24.04 + REMnux + SIFT Workstation + Windows 11 |
| **LLM** | Claude Code (Sonnet) |

## Key Design Principles

> [card] Air-Gapped Analysis VMs
>
> REMnux, SIFT, and Windows have **no internet access**. Samples never touch the LLM host — they live only on the isolated analysis VMs.

> [card] MCP Orchestration
>
> Claude Code controls all VMs remotely over SSH via custom MCP servers — no manual command-line switching.

> [card] 120+ Analysis Tools
>
> Static analysis, YARA, Ghidra decompilation, .NET reversing, Office macro emulation, JS deobfuscation, memory forensics, disk imaging, x64dbg debugging, and more.

> [card] Windows Dynamic Analysis
>
> x64dbg and WinDbg on VM4 with FakeNet-NG network simulation — debugger control via MCP through an SSH tunnel.

## VM Layout

| VM | OS | Role | Network | Internet |
| - | - | - | - | - |
| `VM1` | Ubuntu 24.04 LTS | Claude Code + MCP orchestration host | NAT + Host-only `192.168.56.10` | ✅ Yes |
| `VM2` | REMnux | Static malware analysis, Ghidra, deobfuscation | Host-only `192.168.56.20` | ❌ No |
| `VM3` | SIFT Workstation | Memory forensics, disk forensics, timelines | Host-only `192.168.56.30` | ❌ No |
| `VM4` | Windows 11 | Dynamic analysis — x64dbg, WinDbg, FakeNet-NG | Host-only `192.168.56.40` | ❌ No |

## MCP Servers

| MCP Server | Purpose |
| - | - |
| `remnux-ssh` | Run all REMnux static analysis tools remotely over SSH |
| `sift-ssh` | Run SIFT Workstation forensic tools over SSH (Volatility3, Sleuthkit, Plaso) |
| `virustotal` | Hash lookups, file reports, behavioral analysis, sample downloads |
| `ghidra-mcp` | Headless Ghidra decompilation via Docker (accessed through `remnux-ssh`) |
| `x64dbg` | x64dbg debugger control on Windows VM4 via HTTP MCP (SSH tunnel port 3000) |
| `windbg` | WinDbg/CDB crash dump and kernel analysis on Windows VM4 via HTTP MCP (SSH tunnel port 8000) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.