@remnux/mcp-server 0.1.11 → 0.1.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -9
- package/dist/cli.js +2 -2
- package/dist/file-type-mappings.d.ts.map +1 -1
- package/dist/file-type-mappings.js +29 -1
- package/dist/file-type-mappings.js.map +1 -1
- package/dist/handlers/analyze-file.d.ts.map +1 -1
- package/dist/handlers/analyze-file.js +37 -10
- package/dist/handlers/analyze-file.js.map +1 -1
- package/dist/handlers/get-tool-help.d.ts +10 -0
- package/dist/handlers/get-tool-help.d.ts.map +1 -0
- package/dist/handlers/get-tool-help.js +51 -0
- package/dist/handlers/get-tool-help.js.map +1 -0
- package/dist/handlers/run-tool.d.ts.map +1 -1
- package/dist/handlers/run-tool.js +2 -2
- package/dist/handlers/run-tool.js.map +1 -1
- package/dist/handlers/suggest-tools.d.ts.map +1 -1
- package/dist/handlers/suggest-tools.js +30 -12
- package/dist/handlers/suggest-tools.js.map +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +5 -1
- package/dist/index.js.map +1 -1
- package/dist/ioc/extractor.d.ts +1 -0
- package/dist/ioc/extractor.d.ts.map +1 -1
- package/dist/ioc/extractor.js +21 -3
- package/dist/ioc/extractor.js.map +1 -1
- package/dist/ioc/noise.d.ts.map +1 -1
- package/dist/ioc/noise.js +13 -0
- package/dist/ioc/noise.js.map +1 -1
- package/dist/parsers/capa.js +1 -1
- package/dist/parsers/capa.js.map +1 -1
- package/dist/parsers/index.d.ts.map +1 -1
- package/dist/parsers/index.js +0 -1
- package/dist/parsers/index.js.map +1 -1
- package/dist/response.d.ts.map +1 -1
- package/dist/response.js +4 -1
- package/dist/response.js.map +1 -1
- package/dist/schemas/tools.d.ts +8 -0
- package/dist/schemas/tools.d.ts.map +1 -1
- package/dist/schemas/tools.js +3 -0
- package/dist/schemas/tools.js.map +1 -1
- package/dist/tools/definitions.d.ts.map +1 -1
- package/dist/tools/definitions.js +144 -77
- package/dist/tools/definitions.js.map +1 -1
- package/dist/tools/registry.d.ts +2 -0
- package/dist/tools/registry.d.ts.map +1 -1
- package/dist/tools/registry.js.map +1 -1
- package/dist/utils/stderr-filter.d.ts +8 -0
- package/dist/utils/stderr-filter.d.ts.map +1 -0
- package/dist/utils/stderr-filter.js +19 -0
- package/dist/utils/stderr-filter.js.map +1 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -26,7 +26,7 @@ This server enables AI assistants (Claude Code, OpenCode, Cursor, etc.) to execu
|
|
|
26
26
|
2. **AI tool and MCP server both on REMnux** — everything runs locally on the same REMnux system (simplest setup)
|
|
27
27
|
3. **AI tool on your machine, MCP server on REMnux** — MCP server runs inside REMnux, your AI tool connects over HTTP
|
|
28
28
|
|
|
29
|
-
|
|
29
|
+
The server includes built-in tool guidance via `suggest_tools` (file-type-aware recommendations) and `get_tool_help` (usage flags for any installed tool). For additional tool documentation, you can optionally enable the [REMnux docs MCP server](https://docs.remnux.org/~gitbook/mcp).
|
|
30
30
|
|
|
31
31
|
## What This Server Provides
|
|
32
32
|
|
|
@@ -123,7 +123,7 @@ The MCP server runs inside the REMnux VM or container using the Local connector.
|
|
|
123
123
|
|
|
124
124
|
**Prerequisites:** Node.js >= 18, plus Docker (for container mode) or SSH access (for VM mode).
|
|
125
125
|
|
|
126
|
-
**
|
|
126
|
+
**Optional:** For additional tool documentation beyond what `suggest_tools` and `get_tool_help` provide, you can enable the [REMnux docs MCP server](https://docs.remnux.org/~gitbook/mcp) alongside this one.
|
|
127
127
|
|
|
128
128
|
Choose the scenario that matches your setup.
|
|
129
129
|
|
|
@@ -264,6 +264,7 @@ claude mcp add remnux --transport http http://REMNUX_IP:3000/mcp \
|
|
|
264
264
|
| `analyze_file` | Auto-select and run REMnux tools based on detected file type |
|
|
265
265
|
| `extract_iocs` | Extract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text with confidence scoring |
|
|
266
266
|
| `suggest_tools` | Detect file type and return recommended tools with analysis hints (no execution) |
|
|
267
|
+
| `get_tool_help` | Get usage help (`--help` output) for any installed REMnux tool |
|
|
267
268
|
| `check_tools` | Check which REMnux analysis tools are installed and available |
|
|
268
269
|
|
|
269
270
|
#### Example: Using run_tool
|
|
@@ -431,13 +432,13 @@ claude mcp add remnux --transport http http://REMNUX_IP:3000/mcp \
|
|
|
431
432
|
|
|
432
433
|
| Tier | Behavior |
|
|
433
434
|
|------|----------|
|
|
434
|
-
| `quick` | Fast triage tools only (peframe, pdfid, oleid, diec, readelf, strings) |
|
|
435
|
+
| `quick` | Fast triage tools only (peframe, pdfid, oleid, diec, readelf, strings, js-beautify, decode-vbe) |
|
|
435
436
|
| `standard` | Default — all category tools |
|
|
436
|
-
| `deep` | Standard + expensive tools (pedump, brxor, peepdf-3, dotnetfile_dump, full decompilation) |
|
|
437
|
+
| `deep` | Standard + expensive tools (pedump, brxor, peepdf-3, dotnetfile_dump, jstillery, spidermonkey, full decompilation) |
|
|
437
438
|
|
|
438
439
|
**Output format:** Returns JSON with `detected_type`, `matched_category`, `depth`, `tools_run` (with output), `tools_failed`, and `tools_skipped`.
|
|
439
440
|
|
|
440
|
-
**Supported file types:** PE/DLL, PDF, OLE2 Office (.doc/.xls/.ppt), OOXML (.docx/.xlsx/.pptx), RTF, ELF, shell scripts/
|
|
441
|
+
**Supported file types:** PE/DLL, PDF, OLE2 Office (.doc/.xls/.ppt), OOXML (.docx/.xlsx/.pptx), RTF, ELF, JavaScript (.js/.hta/.wsf/.html), shell scripts/VBS/PowerShell (.sh/.vbs/.ps1/.bat), Python bytecode (.pyc), JAR, email (EML), Android APK. Unknown types get fallback tools (strings, exiftool, base64dump, xorsearch).
|
|
441
442
|
|
|
442
443
|
#### Example: Using extract_iocs
|
|
443
444
|
|
|
@@ -665,11 +666,9 @@ LOCAL_LIVE_TEST=1 npx vitest run src/__tests__/local-live-integration.test.ts
|
|
|
665
666
|
- **Simple deployment**: `npx` just works
|
|
666
667
|
- **Flexible backends**: Docker, SSH, or local execution
|
|
667
668
|
|
|
668
|
-
### Why
|
|
669
|
+
### Why is the docs MCP server optional?
|
|
669
670
|
|
|
670
|
-
-
|
|
671
|
-
- **Execution**: This server focuses on secure tool execution
|
|
672
|
-
- **Simpler security**: Execution server has smaller attack surface
|
|
671
|
+
This server is self-sufficient for most workflows: `suggest_tools` recommends the right tools for each file type, `get_tool_help` retrieves usage flags for any installed tool, and `analyze_file` runs entire tool chains automatically. The [REMnux docs MCP server](https://docs.remnux.org/~gitbook/mcp) provides richer prose documentation and can serve as optional enrichment.
|
|
673
672
|
|
|
674
673
|
### Why blocklist-only (no allowlist)?
|
|
675
674
|
|
package/dist/cli.js
CHANGED
|
@@ -160,8 +160,8 @@ EXAMPLES:
|
|
|
160
160
|
# Add to Claude Code (stdio)
|
|
161
161
|
claude mcp add remnux -- npx @remnux/mcp-server
|
|
162
162
|
|
|
163
|
-
|
|
164
|
-
|
|
163
|
+
Built-in tool guidance: suggest_tools, get_tool_help, analyze_file
|
|
164
|
+
Optional docs MCP: https://docs.remnux.org/~gitbook/mcp
|
|
165
165
|
`);
|
|
166
166
|
}
|
|
167
167
|
// Start server
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"file-type-mappings.d.ts","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE7F,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,eAAO,MAAM,oBAAoB,EAAE,gBAAgB,
|
|
1
|
+
{"version":3,"file":"file-type-mappings.d.ts","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE7F,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,eAAO,MAAM,oBAAoB,EAAE,gBAAgB,EAqElD,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAkBnD,CAAC;AAuBF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAgDrF"}
|
|
@@ -55,9 +55,17 @@ export const FILE_TYPE_CATEGORIES = [
|
|
|
55
55
|
name: "OneNote",
|
|
56
56
|
patterns: [/OneNote/i],
|
|
57
57
|
},
|
|
58
|
+
{
|
|
59
|
+
name: "JavaScript",
|
|
60
|
+
patterns: [/HTML document/i],
|
|
61
|
+
},
|
|
58
62
|
{
|
|
59
63
|
name: "Script",
|
|
60
|
-
patterns: [/shell script/i, /script text/i, /
|
|
64
|
+
patterns: [/shell script/i, /script text/i, /Python script/i, /batch file/i],
|
|
65
|
+
},
|
|
66
|
+
{
|
|
67
|
+
name: "Python",
|
|
68
|
+
patterns: [/python.*byte-compiled/i],
|
|
61
69
|
},
|
|
62
70
|
{
|
|
63
71
|
name: "JAR",
|
|
@@ -82,7 +90,9 @@ export const CATEGORY_TAG_MAP = {
|
|
|
82
90
|
RTF: "rtf",
|
|
83
91
|
ELF: "elf",
|
|
84
92
|
OneNote: "onenote",
|
|
93
|
+
JavaScript: "javascript",
|
|
85
94
|
Script: "script",
|
|
95
|
+
Python: "python",
|
|
86
96
|
JAR: "jar",
|
|
87
97
|
Email: "email",
|
|
88
98
|
APK: "apk",
|
|
@@ -90,6 +100,12 @@ export const CATEGORY_TAG_MAP = {
|
|
|
90
100
|
Shellcode: "shellcode",
|
|
91
101
|
Unknown: "fallback",
|
|
92
102
|
};
|
|
103
|
+
/** JavaScript file extensions — used as fallback for text files. */
|
|
104
|
+
const JAVASCRIPT_EXTENSIONS = /\.(js|hta|wsf|html|htm)$/i;
|
|
105
|
+
/** Script file extensions — used as fallback for text files. */
|
|
106
|
+
const SCRIPT_EXTENSIONS = /\.(vbs|vbe|ps1|bat|cmd|sh|py|pl|rb)$/i;
|
|
107
|
+
/** Python bytecode extensions — used as fallback for data files. */
|
|
108
|
+
const PYTHON_EXTENSIONS = /\.(pyc|pyo)$/i;
|
|
93
109
|
/** Memory image extensions — used as fallback when `file` reports "data". */
|
|
94
110
|
const MEMORY_EXTENSIONS = /\.(img|raw|mem|vmem|dmp|lime)$/i;
|
|
95
111
|
/** Shellcode extensions — used as fallback when `file` reports "data". */
|
|
@@ -113,6 +129,18 @@ export function matchFileType(fileOutput, filename) {
|
|
|
113
129
|
}
|
|
114
130
|
}
|
|
115
131
|
}
|
|
132
|
+
// Fallback: extension-based classification for text files that didn't match specific patterns
|
|
133
|
+
if (filename) {
|
|
134
|
+
if (JAVASCRIPT_EXTENSIONS.test(filename)) {
|
|
135
|
+
return FILE_TYPE_CATEGORIES.find((c) => c.name === "JavaScript");
|
|
136
|
+
}
|
|
137
|
+
if (SCRIPT_EXTENSIONS.test(filename)) {
|
|
138
|
+
return FILE_TYPE_CATEGORIES.find((c) => c.name === "Script");
|
|
139
|
+
}
|
|
140
|
+
if (PYTHON_EXTENSIONS.test(filename)) {
|
|
141
|
+
return FILE_TYPE_CATEGORIES.find((c) => c.name === "Python");
|
|
142
|
+
}
|
|
143
|
+
}
|
|
116
144
|
// Fallback: if `file` says "Zip archive" and filename has OOXML extension, classify as OOXML
|
|
117
145
|
if (filename && /zip archive/i.test(typeOutput)) {
|
|
118
146
|
if (OOXML_EXTENSIONS.test(filename)) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"file-type-mappings.js","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAyB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAU,CAAC;AAS7F,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,yEAAyE;IACzE,4EAA4E;IAC5E;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;KAC9D;IACD;QACE,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,CAAC,UAAU,EAAE,oBAAoB,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE;YACR,0BAA0B;YAC1B,QAAQ;YACR,0BAA0B;YAC1B,2BAA2B;YAC3B,gCAAgC;SACjC;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE;YACR,sBAAsB;YACtB,uBAAuB;YACvB,YAAY;SACb;KACF;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,
|
|
1
|
+
{"version":3,"file":"file-type-mappings.js","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAyB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAU,CAAC;AAS7F,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,yEAAyE;IACzE,4EAA4E;IAC5E;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;KAC9D;IACD;QACE,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,CAAC,UAAU,EAAE,oBAAoB,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE;YACR,0BAA0B;YAC1B,QAAQ;YACR,0BAA0B;YAC1B,2BAA2B;YAC3B,gCAAgC;SACjC;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE;YACR,sBAAsB;YACtB,uBAAuB;YACvB,YAAY;SACb;KACF;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KAC7B;IACD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,CAAC;KAC7E;IACD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,wBAAwB,CAAC;KACrC;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;KACxC;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC;KACjD;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,cAAc,CAAC;KAC3B;CACF,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,UAAU;CACpB,CAAC;AAEF,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAE1D,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AAElE,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAE1C,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;AAE5D,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;AAE9D,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAE/D,iEAAiE;AACjE,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,QAAiB;IACjE,iHAAiH;IACjH,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAElH,KAAK,MAAM,QAAQ,IAAI,oBAAoB,EAAE,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC;QACpE,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAE,CAAC;QAChE,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,IAAI,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,IAAI,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IAC9D,CAAC;IAED,uEAAuE;IACvE,IAAI,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,mFAAmF;IACnF,IAAI,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC3C,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze-file.d.ts","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"analyze-file.d.ts","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAgD3D,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,eAAe;;;;;;GA2MtB"}
|
|
@@ -7,17 +7,25 @@ import { formatResponse, formatError } from "../response.js";
|
|
|
7
7
|
import { REMnuxError } from "../errors/remnux-error.js";
|
|
8
8
|
import { toREMnuxError } from "../errors/error-mapper.js";
|
|
9
9
|
import { extractIOCs } from "../ioc/extractor.js";
|
|
10
|
-
|
|
11
|
-
const
|
|
10
|
+
import { filterStderrNoise } from "../utils/stderr-filter.js";
|
|
11
|
+
const DEFAULT_OUTPUT_BUDGET = 40 * 1024; // 40KB default
|
|
12
|
+
const TOTAL_RESPONSE_BUDGET = 120 * 1024; // 120KB total across all tools
|
|
12
13
|
/** Per-tool output budgets — tools known to produce large output get tighter limits. */
|
|
13
14
|
const TOOL_OUTPUT_BUDGETS = {
|
|
15
|
+
capa: 30 * 1024,
|
|
16
|
+
"capa-vv": 30 * 1024,
|
|
14
17
|
floss: 20 * 1024,
|
|
15
18
|
ilspycmd: 15 * 1024,
|
|
19
|
+
pcodedmp: 15 * 1024,
|
|
20
|
+
strings: 15 * 1024,
|
|
16
21
|
rtfdump: 10 * 1024,
|
|
17
22
|
olevba: 30 * 1024,
|
|
18
23
|
oledump: 20 * 1024,
|
|
19
24
|
exiftool: 10 * 1024,
|
|
20
25
|
zipdump: 15 * 1024,
|
|
26
|
+
base64dump: 15 * 1024,
|
|
27
|
+
"js-beautify": 15 * 1024,
|
|
28
|
+
"box-js": 20 * 1024,
|
|
21
29
|
};
|
|
22
30
|
export async function handleAnalyzeFile(deps, args) {
|
|
23
31
|
const startTime = Date.now();
|
|
@@ -71,6 +79,20 @@ export async function handleAnalyzeFile(deps, args) {
|
|
|
71
79
|
// Step 3: Run each tool
|
|
72
80
|
for (const tool of tools) {
|
|
73
81
|
const cmd = buildCommandFromDefinition(tool, filePath, config.outputDir);
|
|
82
|
+
// Ensure output directories exist for tools that write to --output-dir
|
|
83
|
+
if (tool.fixedArgs && config.outputDir) {
|
|
84
|
+
const dirIdx = tool.fixedArgs.indexOf("--output-dir");
|
|
85
|
+
if (dirIdx !== -1 && tool.fixedArgs[dirIdx + 1]) {
|
|
86
|
+
const rawDir = tool.fixedArgs[dirIdx + 1];
|
|
87
|
+
const resolvedDir = rawDir.startsWith("/tmp/")
|
|
88
|
+
? rawDir.replace("/tmp/", config.outputDir + "/")
|
|
89
|
+
: rawDir;
|
|
90
|
+
try {
|
|
91
|
+
await connector.execute(["mkdir", "-p", resolvedDir], { timeout: 5000 });
|
|
92
|
+
}
|
|
93
|
+
catch { /* best effort */ }
|
|
94
|
+
}
|
|
95
|
+
}
|
|
74
96
|
// Use the greater of user-specified timeout and tool's own timeout
|
|
75
97
|
const effectiveTimeout = Math.max(perToolTimeout, (tool.timeout ?? 60) * 1000);
|
|
76
98
|
try {
|
|
@@ -79,10 +101,13 @@ export async function handleAnalyzeFile(deps, args) {
|
|
|
79
101
|
cwd: config.samplesDir,
|
|
80
102
|
});
|
|
81
103
|
let stderr = result.stderr || "";
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
//
|
|
85
|
-
|
|
104
|
+
stderr = filterStderrNoise(stderr);
|
|
105
|
+
// Detect missing tools — only match shell "command not found" or exit code 127,
|
|
106
|
+
// not tool output that happens to contain "not found" (e.g., pescan "section not found")
|
|
107
|
+
const isNotInstalled = result.exitCode === 127 ||
|
|
108
|
+
/command not found/i.test(stderr) ||
|
|
109
|
+
(result.exitCode !== 0 && /^.*: No such file or directory$/m.test(stderr) && stderr.includes(tool.command));
|
|
110
|
+
if (isNotInstalled) {
|
|
86
111
|
toolsSkipped.push({ name: tool.name, command: cmd, reason: "Tool not installed" });
|
|
87
112
|
continue;
|
|
88
113
|
}
|
|
@@ -111,10 +136,11 @@ export async function handleAnalyzeFile(deps, args) {
|
|
|
111
136
|
}
|
|
112
137
|
totalOutputSize += output.length;
|
|
113
138
|
const parsed = parseToolOutput(tool.name, output);
|
|
114
|
-
//
|
|
139
|
+
// Check for tool-specific exit code hints
|
|
115
140
|
const extraMetadata = {};
|
|
116
|
-
|
|
117
|
-
|
|
141
|
+
const hint = tool.exitCodeHints?.[result.exitCode];
|
|
142
|
+
if (hint) {
|
|
143
|
+
extraMetadata.analyst_note = hint;
|
|
118
144
|
}
|
|
119
145
|
toolsRun.push({
|
|
120
146
|
name: tool.name,
|
|
@@ -139,7 +165,8 @@ export async function handleAnalyzeFile(deps, args) {
|
|
|
139
165
|
}
|
|
140
166
|
}
|
|
141
167
|
}
|
|
142
|
-
const combinedOutput = toolsRun.map(t => t.output).join("\n\n")
|
|
168
|
+
const combinedOutput = toolsRun.map(t => t.output).join("\n\n")
|
|
169
|
+
.replace(/^\s*"command":\s*".*"$/gm, "");
|
|
143
170
|
const iocResult = extractIOCs(combinedOutput);
|
|
144
171
|
// Filter out the analyzed file's own hashes from IOC results
|
|
145
172
|
if (ownHashes.size > 0) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze-file.js","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"analyze-file.js","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAe9D,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,eAAe;AACxD,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,+BAA+B;AAEzE,wFAAwF;AACxF,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,EAAE,GAAG,IAAI;IACf,SAAS,EAAE,EAAE,GAAG,IAAI;IACpB,KAAK,EAAE,EAAE,GAAG,IAAI;IAChB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,MAAM,EAAE,EAAE,GAAG,IAAI;IACjB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,UAAU,EAAE,EAAE,GAAG,IAAI;IACrB,aAAa,EAAE,EAAE,GAAG,IAAI;IACxB,QAAQ,EAAE,EAAE,GAAG,IAAI;CACpB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAiB,EACjB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACL,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAc,CAAC;QAEtD,6CAA6C;QAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,UAAU,CAAC,KAAK,IAAI,mBAAmB,EACvC,cAAc,EACd,YAAY,EACZ,kDAAkD,CACnD,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1H,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAE5D,2BAA2B;QAC3B,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,qDAAqD,EACrD,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACtG,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,GAAG,EACH,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CACxC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAC7J,EAAE,OAAO,EAAE,KAAK,EAAE,CACnB,CAAC;YACF,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzC,IAAI,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/C,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,4DAA4D,CAAC,CAAC;QAExE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;QAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,YAAY,GAAkB,EAAE,CAAC;QACvC,IAAI,eAAe,GAAG,CAAC,CAAC;QAExB,wBAAwB;QACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAEzE,uEAAuE;YACvE,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBACtD,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;oBAChD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC5C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;wBACjD,CAAC,CAAC,MAAM,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC3E,CAAC;oBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,mEAAmE;YACnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAE/E,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE;oBAC/C,OAAO,EAAE,gBAAgB;oBACzB,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBAEH,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBACjC,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACnC,gFAAgF;gBAChF,yFAAyF;gBACzF,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,KAAK,GAAG;oBAC5C,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;oBACjC,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9G,IAAI,cAAc,EAAE,CAAC;oBACnB,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBACnF,SAAS;gBACX,CAAC;gBAED,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,IAAI,aAAa,CAAC;gBACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,wEAAwE;gBACxE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,qBAAqB,GAAG,eAAe,CAAC,CAAC;gBACpF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,EAAE,eAAe,CAAC,CAAC;gBAClG,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC/C,IAAI,eAAmC,CAAC;gBACxC,IAAI,eAAe,EAAE,CAAC;oBACpB,qDAAqD;oBACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;oBAC5D,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,MAAM,CAAC;oBACnD,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;wBACrD,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;wBACjE,eAAe,GAAG,WAAW,CAAC;oBAChC,CAAC;oBAAC,MAAM,CAAC;wBACP,0DAA0D;oBAC5D,CAAC;oBACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;wBAC9B,qBAAqB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU;wBAC3F,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,eAAe,mCAAmC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC1G,CAAC;gBAED,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC;gBAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAElD,0CAA0C;gBAC1C,MAAM,aAAa,GAA4B,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,IAAI,EAAE,CAAC;oBACT,aAAa,CAAC,YAAY,GAAG,IAAI,CAAC;gBACpC,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,GAAG;oBACZ,MAAM;oBACN,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,GAAG,CAAC,eAAe,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;oBACxE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI;wBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,aAAa,EAAE;qBACnD,CAAC;oBACF,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;iBAC5F,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACrE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC1C,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC1E,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5D,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAE9C,6DAA6D;QAC7D,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,cAAc,CAAC,cAAc,EAAE;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa,EAAE,UAAU;YACzB,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAC/B,KAAK;YACL,iBAAiB,EACf,0GAA0G;gBAC1G,4GAA4G;gBAC5G,uFAAuF;gBACvF,6DAA6D;gBAC7D,wFAAwF;gBACxF,+CAA+C;gBAC/C,uEAAuE;gBACvE,8GAA8G;YAChH,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI;gBACxB,OAAO,EAAE,qCAAqC,QAAQ,CAAC,IAAI,eAAe,KAAK,+CAA+C;aAC/H,CAAC;YACF,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,WAAW,EAAE,SAAS,CAAC,OAAO;YAC9B,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,YAAY;SAC5B,EAAE,SAAS,CAAC,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
import type { HandlerDeps } from "./types.js";
|
|
2
|
+
import type { GetToolHelpArgs } from "../schemas/tools.js";
|
|
3
|
+
export declare function handleGetToolHelp(deps: HandlerDeps, args: GetToolHelpArgs): Promise<{
|
|
4
|
+
content: Array<{
|
|
5
|
+
type: "text";
|
|
6
|
+
text: string;
|
|
7
|
+
}>;
|
|
8
|
+
isError?: boolean;
|
|
9
|
+
}>;
|
|
10
|
+
//# sourceMappingURL=get-tool-help.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"get-tool-help.d.ts","sourceRoot":"","sources":["../../src/handlers/get-tool-help.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAO3D,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,eAAe;;;;;;GAuEtB"}
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
import { formatResponse, formatError } from "../response.js";
|
|
2
|
+
import { REMnuxError } from "../errors/remnux-error.js";
|
|
3
|
+
import { toREMnuxError } from "../errors/error-mapper.js";
|
|
4
|
+
const TOOL_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
|
|
5
|
+
export async function handleGetToolHelp(deps, args) {
|
|
6
|
+
const startTime = Date.now();
|
|
7
|
+
try {
|
|
8
|
+
const { connector } = deps;
|
|
9
|
+
const tool = args.tool;
|
|
10
|
+
if (!TOOL_NAME_RE.test(tool)) {
|
|
11
|
+
return formatError("get_tool_help", new REMnuxError(`Invalid tool name: "${tool}". Use a simple name like 'capa' or 'pdfid.py' (no paths, flags, or shell metacharacters).`, "INVALID_INPUT", "validation", "Provide just the tool name, e.g., 'olevba' not 'olevba -a'"), startTime);
|
|
12
|
+
}
|
|
13
|
+
// Try --help first, fall back to -h
|
|
14
|
+
let output = "";
|
|
15
|
+
let exitCode = 0;
|
|
16
|
+
for (const flag of ["--help", "-h"]) {
|
|
17
|
+
try {
|
|
18
|
+
const result = await connector.execute([tool, flag], { timeout: 10000 });
|
|
19
|
+
const combined = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
|
|
20
|
+
exitCode = result.exitCode;
|
|
21
|
+
// Detect tool not installed (exit code 127 is the standard shell signal)
|
|
22
|
+
if (result.exitCode === 127) {
|
|
23
|
+
return formatError("get_tool_help", new REMnuxError(`Tool '${tool}' not found. It may not be installed on this REMnux system.`, "NOT_FOUND", "not_found", "Use check_tools to see installed tools, or install with apt/pip"), startTime);
|
|
24
|
+
}
|
|
25
|
+
if (combined) {
|
|
26
|
+
output = combined;
|
|
27
|
+
break;
|
|
28
|
+
}
|
|
29
|
+
}
|
|
30
|
+
catch (error) {
|
|
31
|
+
const msg = error instanceof Error ? error.message : String(error);
|
|
32
|
+
if (/timeout/i.test(msg)) {
|
|
33
|
+
return formatError("get_tool_help", new REMnuxError(`Timed out running '${tool} ${flag}'`, "COMMAND_TIMEOUT", "timeout", "The tool may require input or not support help flags"), startTime);
|
|
34
|
+
}
|
|
35
|
+
// Continue to next flag
|
|
36
|
+
}
|
|
37
|
+
}
|
|
38
|
+
if (!output) {
|
|
39
|
+
return formatError("get_tool_help", new REMnuxError(`No help output from '${tool}'. The tool may not be installed or may not support --help/-h.`, "EMPTY_OUTPUT", "tool_failure", "Check that the tool is installed with check_tools, or try run_tool with a specific command"), startTime);
|
|
40
|
+
}
|
|
41
|
+
return formatResponse("get_tool_help", {
|
|
42
|
+
tool,
|
|
43
|
+
help: output,
|
|
44
|
+
exit_code: exitCode,
|
|
45
|
+
}, startTime);
|
|
46
|
+
}
|
|
47
|
+
catch (error) {
|
|
48
|
+
return formatError("get_tool_help", toREMnuxError(error, deps.config.mode), startTime);
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
//# sourceMappingURL=get-tool-help.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"get-tool-help.js","sourceRoot":"","sources":["../../src/handlers/get-tool-help.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAiB,EACjB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,uBAAuB,IAAI,4FAA4F,EACvH,eAAe,EACf,YAAY,EACZ,4DAA4D,CAC7D,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,oCAAoC;QACpC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzE,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClF,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAE3B,yEAAyE;gBACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;oBAC5B,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,SAAS,IAAI,6DAA6D,EAC1E,WAAW,EACX,WAAW,EACX,iEAAiE,CAClE,EAAE,SAAS,CAAC,CAAC;gBAChB,CAAC;gBAED,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,GAAG,QAAQ,CAAC;oBAClB,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,sBAAsB,IAAI,IAAI,IAAI,GAAG,EACrC,iBAAiB,EACjB,SAAS,EACT,sDAAsD,CACvD,EAAE,SAAS,CAAC,CAAC;gBAChB,CAAC;gBACD,wBAAwB;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,wBAAwB,IAAI,gEAAgE,EAC5F,cAAc,EACd,cAAc,EACd,4FAA4F,CAC7F,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,OAAO,cAAc,CAAC,eAAe,EAAE;YACrC,IAAI;YACJ,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,QAAQ;SACpB,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,eAAe,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-tool.d.ts","sourceRoot":"","sources":["../../src/handlers/run-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"run-tool.d.ts","sourceRoot":"","sources":["../../src/handlers/run-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASvD,wBAAsB,aAAa,CACjC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,WAAW;;;;;;GA2FlB"}
|
|
@@ -4,6 +4,7 @@ import { REMnuxError } from "../errors/remnux-error.js";
|
|
|
4
4
|
import { toREMnuxError } from "../errors/error-mapper.js";
|
|
5
5
|
import { parseToolOutput, hasParser } from "../parsers/index.js";
|
|
6
6
|
import { toolRegistry } from "../tools/registry.js";
|
|
7
|
+
import { filterStderrNoise } from "../utils/stderr-filter.js";
|
|
7
8
|
export async function handleRunTool(deps, args) {
|
|
8
9
|
const startTime = Date.now();
|
|
9
10
|
const { connector, config } = deps;
|
|
@@ -37,8 +38,7 @@ export async function handleRunTool(deps, args) {
|
|
|
37
38
|
});
|
|
38
39
|
let stdout = result.stdout || "";
|
|
39
40
|
let stderr = result.stderr || "";
|
|
40
|
-
|
|
41
|
-
stderr = stderr.replace(/^Progress:\s+[\d.]+\s+.*$/gm, "").trim();
|
|
41
|
+
stderr = filterStderrNoise(stderr);
|
|
42
42
|
let truncated = false;
|
|
43
43
|
const fullStdoutLength = stdout.length;
|
|
44
44
|
if (stdout.length > MAX_STDOUT_RESPONSE) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-tool.js","sourceRoot":"","sources":["../../src/handlers/run-tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"run-tool.js","sourceRoot":"","sources":["../../src/handlers/run-tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAiB,EACjB,IAAiB;IAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEnC,qBAAqB;IACrB,IAAI,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;IAC/B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,mDAAmD;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAC5E,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBACzB,OAAO,WAAW,CAAC,UAAU,EAAE,IAAI,WAAW,CAC5C,cAAc,CAAC,KAAK,IAAI,yBAAyB,EACjD,cAAc,EACd,YAAY,EACZ,kDAAkD,CACnD,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,6EAA6E;QAC7E,0FAA0F;QAC1F,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,WAAW,EAAE,CAAC;QAC7I,WAAW,GAAG,GAAG,IAAI,CAAC,OAAO,KAAK,iBAAiB,GAAG,CAAC;IACzD,CAAC;IAED,+CAA+C;IAC/C,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,WAAW,CAAC,UAAU,EAAE,IAAI,WAAW,CAC5C,UAAU,CAAC,KAAK,IAAI,iBAAiB,EACrC,iBAAiB,EACjB,UAAU,EACV,4EAA4E,CAC7E,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC;IAED,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,8BAA8B;IACtE,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,WAAW,EAAE;YACvD,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI;YAChD,GAAG,EAAE,MAAM,CAAC,UAAU;SACvB,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACjC,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QAEjC,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAEnC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;QAEvC,IAAI,MAAM,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAC9C,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAC9C,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,kEAAkE;QAClE,IAAI,QAAQ,CAAC;QACb,IAAI,cAAc,CAAC;QACnB,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAC3B,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YACnC,CAAC;QACH,CAAC;QAED,OAAO,cAAc,CAAC,UAAU,EAAE;YAChC,OAAO,EAAE,WAAW;YACpB,MAAM;YACN,MAAM;YACN,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,SAAS;YACT,GAAG,CAAC,SAAS,IAAI;gBACf,iBAAiB,EAAE,6GAA6G;gBAChI,kBAAkB,EAAE,gBAAgB;aACrC,CAAC;YACF,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;SAC/D,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,8DAA8D;IAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAEpE,gDAAgD;IAChD,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,iEAAiE;IACjE,IAAI,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACvC,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"suggest-tools.d.ts","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"suggest-tools.d.ts","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAkL5D,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,gBAAgB;;;;;;GA8FvB"}
|
|
@@ -9,14 +9,21 @@ import { toREMnuxError } from "../errors/error-mapper.js";
|
|
|
9
9
|
*/
|
|
10
10
|
const BASE_HINTS = {
|
|
11
11
|
DOTNET: "Start with peframe and diec for triage. diec detects packers/protectors. " +
|
|
12
|
+
"capa identifies capabilities like C2, persistence, or file manipulation. " +
|
|
13
|
+
"floss extracts obfuscated strings. yara-rules scans against community signatures. " +
|
|
12
14
|
"ilspycmd decompiles .NET to C# source. " +
|
|
13
|
-
"capa
|
|
15
|
+
"For deep analysis, capa -vv shows matched rule details with addresses.",
|
|
14
16
|
PE: "Start with peframe and diec for triage — diec detects packers and compilers. " +
|
|
15
17
|
"capa maps capabilities to MITRE ATT&CK. floss extracts obfuscated strings. " +
|
|
16
|
-
"
|
|
18
|
+
"portex provides comprehensive PE structure analysis including anomaly detection. " +
|
|
19
|
+
"yara-rules scans against community signatures for known malware families. " +
|
|
20
|
+
"For deep analysis, capa -vv shows matched rule details with addresses. " +
|
|
21
|
+
"pedump shows raw PE structure and brxor bruteforces XOR-encoded strings.",
|
|
17
22
|
PDF: "Start with pdfid to identify notable elements (/JS, /JavaScript, /OpenAction, /Launch). " +
|
|
18
23
|
"Use pdf-parser --stats for structural overview. If notable objects found, " +
|
|
19
|
-
"extract them with pdf-parser -o <obj_id> -d.
|
|
24
|
+
"extract them with pdf-parser -o <obj_id> -d. " +
|
|
25
|
+
"pdfresurrect extracts previous versions of content — useful for detecting swapped or hidden payloads. " +
|
|
26
|
+
"peepdf-3 provides interactive deep analysis. " +
|
|
20
27
|
"qpdf decrypts permission-locked PDFs. pdftk extracts metadata and document info.",
|
|
21
28
|
OLE2: "Start with oleid for risk indicators (macros, encryption, external links). " +
|
|
22
29
|
"olevba extracts and analyzes VBA macros — look for auto-execute triggers and notable keywords. " +
|
|
@@ -32,14 +39,24 @@ const BASE_HINTS = {
|
|
|
32
39
|
"Look for embedded executables, shellcode, or CVE exploits in objects.",
|
|
33
40
|
ELF: "readelf -h shows ELF header (type, arch, entry point). " +
|
|
34
41
|
"readelf -S lists sections — look for unusual section names or sizes. " +
|
|
35
|
-
"capa detects capabilities in ELF binaries similar to PE analysis."
|
|
36
|
-
|
|
37
|
-
|
|
42
|
+
"capa detects capabilities in ELF binaries similar to PE analysis. " +
|
|
43
|
+
"For deep analysis, capa -vv shows matched rule details with addresses.",
|
|
44
|
+
JavaScript: "js-beautify reformats and deobfuscates JavaScript — look for eval(), " +
|
|
38
45
|
"document.write(), String.fromCharCode(), and unescape() patterns. " +
|
|
39
|
-
"base64dump finds and decodes Base64 and other encoded strings — " +
|
|
40
|
-
"common in PowerShell, bash, and JavaScript malware. " +
|
|
41
46
|
"box-js analyzes and deobfuscates JavaScript malware in a sandbox environment. " +
|
|
42
|
-
"
|
|
47
|
+
"base64dump finds and decodes Base64 and other encoded strings. " +
|
|
48
|
+
"For deep analysis, JStillery uses AST partial evaluation for deobfuscation, and " +
|
|
49
|
+
"SpiderMonkey with -f /usr/share/remnux/objects.js emulates browser/PDF viewer objects. " +
|
|
50
|
+
"To extract scripts from HTML, use ExtractScripts via run_tool.",
|
|
51
|
+
Script: "base64dump finds and decodes Base64 and other encoded strings — " +
|
|
52
|
+
"common in PowerShell, bash, and VBScript malware. " +
|
|
53
|
+
"decode-vbe.py decodes VBE-encoded VBScript files to readable source. " +
|
|
54
|
+
"re-search extracts patterns using regular expressions. " +
|
|
55
|
+
"For PowerShell deobfuscation, consider running pwsh via run_tool. " +
|
|
56
|
+
"translate.py applies byte-level transforms. numbers-to-string.py decodes numeric payloads.",
|
|
57
|
+
Python: "pycdc decompiles Python bytecode (.pyc) to readable source code. " +
|
|
58
|
+
"For PyInstaller bundles (which produce PE files), use pyinstxtractor via run_tool " +
|
|
59
|
+
"to extract contents, then analyze the resulting .pyc files with pycdc.",
|
|
43
60
|
JAR: "zipdump lists the JAR archive contents (JAR files are ZIP format). " +
|
|
44
61
|
"Look for unusual class files, embedded resources, or manifest entries. " +
|
|
45
62
|
"exiftool reveals metadata about the archive.",
|
|
@@ -59,9 +76,10 @@ const BASE_HINTS = {
|
|
|
59
76
|
"For deep analysis, qltool (Qiling) provides multi-platform emulation and tracesc traces execution via Wine. " +
|
|
60
77
|
"Use strings and xorsearch for static indicators before emulation.",
|
|
61
78
|
Memory: "Memory image detected. Start with vol3-info to identify OS and kernel version. " +
|
|
62
|
-
"vol3-pslist and vol3-pstree reveal running processes
|
|
63
|
-
"vol3-netscan shows network connections. vol3-
|
|
64
|
-
"vol3-
|
|
79
|
+
"vol3-pslist and vol3-pstree reveal running processes. " +
|
|
80
|
+
"vol3-netscan shows network connections. vol3-psscan finds hidden/unlinked processes. " +
|
|
81
|
+
"vol3-cmdline extracts process arguments. vol3-dlllist shows loaded DLLs. " +
|
|
82
|
+
"vol3-filescan finds file objects. vol3-hivelist lists registry hives. " +
|
|
65
83
|
"For deeper analysis, vol3-malfind detects injected code and vol3-handles lists open handles. " +
|
|
66
84
|
"For Linux memory images, use vol3-linux-pslist.",
|
|
67
85
|
Unknown: "File type not recognized. strings and exiftool provide basic triage. " +
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"suggest-tools.js","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;GAEG;AACH,MAAM,UAAU,GAA2B;IACzC,MAAM,EACJ,2EAA2E;QAC3E,yCAAyC;QACzC,
|
|
1
|
+
{"version":3,"file":"suggest-tools.js","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;GAEG;AACH,MAAM,UAAU,GAA2B;IACzC,MAAM,EACJ,2EAA2E;QAC3E,2EAA2E;QAC3E,oFAAoF;QACpF,yCAAyC;QACzC,wEAAwE;IAC1E,EAAE,EACA,+EAA+E;QAC/E,6EAA6E;QAC7E,mFAAmF;QACnF,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;IAC5E,GAAG,EACD,0FAA0F;QAC1F,4EAA4E;QAC5E,+CAA+C;QAC/C,wGAAwG;QACxG,+CAA+C;QAC/C,kFAAkF;IACpF,IAAI,EACF,6EAA6E;QAC7E,iGAAiG;QACjG,gFAAgF;QAChF,oEAAoE;QACpE,+CAA+C;IACjD,KAAK,EACH,uDAAuD;QACvD,kFAAkF;QAClF,uEAAuE;QACvE,sFAAsF;IACxF,GAAG,EACD,mEAAmE;QACnE,oEAAoE;QACpE,uEAAuE;IACzE,GAAG,EACD,yDAAyD;QACzD,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;IAC1E,UAAU,EACR,uEAAuE;QACvE,oEAAoE;QACpE,gFAAgF;QAChF,iEAAiE;QACjE,kFAAkF;QAClF,yFAAyF;QACzF,gEAAgE;IAClE,MAAM,EACJ,kEAAkE;QAClE,oDAAoD;QACpD,uEAAuE;QACvE,yDAAyD;QACzD,oEAAoE;QACpE,4FAA4F;IAC9F,MAAM,EACJ,mEAAmE;QACnE,oFAAoF;QACpF,wEAAwE;IAC1E,GAAG,EACD,qEAAqE;QACrE,yEAAyE;QACzE,8CAA8C;IAChD,KAAK,EACH,2DAA2D;QAC3D,iFAAiF;QACjF,qEAAqE;QACrE,kEAAkE;IACpE,GAAG,EACD,8DAA8D;QAC9D,+FAA+F;QAC/F,4EAA4E;IAC9E,OAAO,EACL,uFAAuF;QACvF,gGAAgG;QAChG,oFAAoF;IACtF,SAAS,EACP,kFAAkF;QAClF,4EAA4E;QAC5E,wHAAwH;QACxH,8GAA8G;QAC9G,mEAAmE;IACrE,MAAM,EACJ,iFAAiF;QACjF,wDAAwD;QACxD,uFAAuF;QACvF,2EAA2E;QAC3E,wEAAwE;QACxE,+FAA+F;QAC/F,iDAAiD;IACnD,OAAO,EACL,uEAAuE;QACvE,4EAA4E;QAC5E,iGAAiG;QACjG,+FAA+F;QAC/F,8EAA8E;CACjF,CAAC;AAWF,gEAAgE;AAChE,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;SAC7C,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;SACxD,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC;SAC9D,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;IAE/D,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,WAAW,CAAC;SAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC;SACtD,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;SAC1D,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAE/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,QAAgB,EAAE,UAAkB;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC;IACxD,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CACT,oBAAoB,KAAK,CAAC,MAAM,IAAI;YACpC,2DAA2D;YAC3D,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK;gBACrB,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,yEAAyE,CAAC,CAC/E,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,QAAQ,6DAA6D,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,GAAG,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAiB,EACjB,IAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACL,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAc,CAAC;QAEtD,6CAA6C;QAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,UAAU,CAAC,KAAK,IAAI,mBAAmB,EACvC,cAAc,EACd,YAAY,EACZ,kDAAkD,CACnD,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1H,mBAAmB;QACnB,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,qDAAqD,EACrD,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACtG,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,GAAG,EACH,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;QACjE,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAE3D,wEAAwE;QACxE,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5C,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,gDAAgD;gBAChD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjG,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE;oBACjD,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBACH,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBACxB,IAAI,GAAG;wBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;gBAC1D,KAAK,MAAM,CAAC,IAAI,cAAc;oBAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAc,EAAE,CAAC;SAC3E,CAAC,CAAC,CAAC;QAEJ,OAAO,cAAc,CAAC,eAAe,EAAE;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa,EAAE,UAAU;YACzB,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAC/B,KAAK;YACL,iBAAiB,EAAE,WAAW;YAC9B,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI;gBAC9B,OAAO,EAAE,qCAAqC,QAAQ,CAAC,IAAI,eAAe,KAAK,+CAA+C;aAC/H,CAAC;YACF,cAAc,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;SACzD,EAAE,SAAS,CAAC,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,eAAe,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAoB,MAAM,yCAAyC,CAAC;AAOtF,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAoB,MAAM,yCAAyC,CAAC;AAOtF,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA+B9E,MAAM,WAAW,YAAa,SAAQ,eAAe;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,sBA6QtD;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,iBAuBrD"}
|
package/dist/index.js
CHANGED
|
@@ -6,7 +6,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
|
|
|
6
6
|
import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
|
|
7
7
|
import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
|
|
8
8
|
import { createConnector } from "./connectors/index.js";
|
|
9
|
-
import { runToolSchema, getFileInfoSchema, listFilesSchema, extractArchiveSchema, uploadFromHostSchema, downloadFromUrlSchema, downloadFileSchema, analyzeFileSchema, suggestToolsSchema, extractIOCsSchema, checkToolsSchema, } from "./schemas/tools.js";
|
|
9
|
+
import { runToolSchema, getFileInfoSchema, listFilesSchema, extractArchiveSchema, uploadFromHostSchema, downloadFromUrlSchema, downloadFileSchema, analyzeFileSchema, suggestToolsSchema, extractIOCsSchema, checkToolsSchema, getToolHelpSchema, } from "./schemas/tools.js";
|
|
10
10
|
import { SessionState, DEFAULT_ARCHIVE_PASSWORD } from "./state/session.js";
|
|
11
11
|
import { handleRunTool } from "./handlers/run-tool.js";
|
|
12
12
|
import { handleGetFileInfo } from "./handlers/get-file-info.js";
|
|
@@ -19,6 +19,7 @@ import { handleAnalyzeFile } from "./handlers/analyze-file.js";
|
|
|
19
19
|
import { handleExtractIOCs } from "./handlers/extract-iocs.js";
|
|
20
20
|
import { handleCheckTools } from "./handlers/check-tools.js";
|
|
21
21
|
import { handleSuggestTools } from "./handlers/suggest-tools.js";
|
|
22
|
+
import { handleGetToolHelp } from "./handlers/get-tool-help.js";
|
|
22
23
|
import { toolRegistry } from "./tools/registry.js";
|
|
23
24
|
export async function createServer(config) {
|
|
24
25
|
const _require = createRequire(import.meta.url);
|
|
@@ -105,6 +106,9 @@ export async function createServer(config) {
|
|
|
105
106
|
"Pass output from run_tool or analyze_file to identify indicators. " +
|
|
106
107
|
"Works well with Volatility 3 plugin output (netscan, cmdline, filescan). " +
|
|
107
108
|
"Returns deduplicated IOCs with confidence scores.", extractIOCsSchema.shape, (args) => handleExtractIOCs(deps, args));
|
|
109
|
+
// Tool: get_tool_help - Get usage help for a REMnux tool
|
|
110
|
+
server.tool("get_tool_help", "Get usage help for a REMnux tool. Returns the tool's --help output " +
|
|
111
|
+
"so you can understand available flags, options, and usage patterns.", getToolHelpSchema.shape, (args) => handleGetToolHelp(deps, args));
|
|
108
112
|
// Tool: check_tools - Check tool availability
|
|
109
113
|
server.tool("check_tools", "Check which REMnux analysis tools are installed and available. Returns a summary of installed vs missing tools across all file type categories.", checkToolsSchema.shape, () => handleCheckTools(deps));
|
|
110
114
|
// ── MCP Resources: Tool Registry ──────────────────────────────────────────
|