@remnux/mcp-server 0.1.34 → 0.1.35
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -477,6 +477,7 @@ To counteract this confirmation bias, the server uses neutral language ("notable
|
|
|
477
477
|
- [REMnux Docs MCP](https://docs.remnux.org/~gitbook/mcp) - Tool discovery and documentation
|
|
478
478
|
- [REMnux salt-states](https://github.com/REMnux/salt-states) - Tool definitions and installation
|
|
479
479
|
- [Model Context Protocol](https://modelcontextprotocol.io) - MCP specification
|
|
480
|
+
- [Using AI Agents to Analyze Malware on REMnux](https://zeltser.com/ai-malware-analysis-remnux) - Walkthrough of AI-assisted malware analysis using this MCP server
|
|
480
481
|
|
|
481
482
|
## License
|
|
482
483
|
|
|
@@ -6,17 +6,15 @@
|
|
|
6
6
|
* boundary — not this module.
|
|
7
7
|
*
|
|
8
8
|
* This module prevents:
|
|
9
|
-
* 1.
|
|
10
|
-
*
|
|
9
|
+
* 1. Null byte injection (truncates paths in C-based functions).
|
|
10
|
+
* 2. Catastrophic commands (rm -rf /, mkfs) that destroy the analysis session.
|
|
11
11
|
*
|
|
12
|
-
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
17
|
-
*
|
|
18
|
-
* threat class as pipe-to-interpreter (already allowed). Container/VM
|
|
19
|
-
* isolation handles the risk.
|
|
12
|
+
* Shell injection patterns ($(), backticks, ${}, eval, exec, source, pipes to
|
|
13
|
+
* interpreters, process substitution) are NOT blocked: same threat class —
|
|
14
|
+
* all allow arbitrary code execution inside the container. Blocking one while
|
|
15
|
+
* allowing others is inconsistent and blocks legitimate analysis workflows
|
|
16
|
+
* (e.g., file $(which python3), echo ${PATH}). Container/VM isolation is the
|
|
17
|
+
* security boundary, not in-band command filtering.
|
|
20
18
|
*
|
|
21
19
|
* Path sandboxing (isPathSafe, validateFilePath) is available as an opt-in
|
|
22
20
|
* workflow aid via --sandbox, not as a security control.
|
|
@@ -68,10 +66,10 @@ export declare function validateFilePath(relativePath: string, baseDir: string):
|
|
|
68
66
|
export declare const DANGEROUS_PIPE_PATTERNS: BlockedPattern[];
|
|
69
67
|
/**
|
|
70
68
|
* Check if a command string is safe to execute
|
|
71
|
-
* Validates against BLOCKED_PATTERNS (
|
|
69
|
+
* Validates against BLOCKED_PATTERNS (null byte injection, catastrophic commands)
|
|
72
70
|
*
|
|
73
|
-
* Note:
|
|
74
|
-
* is the security boundary for code execution
|
|
71
|
+
* Note: Shell injection and pipe-to-interpreter patterns were removed in 2026-02;
|
|
72
|
+
* container/VM isolation is the security boundary for code execution.
|
|
75
73
|
*
|
|
76
74
|
* @param command - The full command string to validate
|
|
77
75
|
* @returns { safe: boolean, error?: string }
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"blocklist.d.ts","sourceRoot":"","sources":["../../src/security/blocklist.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"blocklist.d.ts","sourceRoot":"","sources":["../../src/security/blocklist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAc5C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAmCjE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAMnC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAc,EAAO,CAAC;AAE5D;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAqBhF"}
|
|
@@ -6,17 +6,15 @@
|
|
|
6
6
|
* boundary — not this module.
|
|
7
7
|
*
|
|
8
8
|
* This module prevents:
|
|
9
|
-
* 1.
|
|
10
|
-
*
|
|
9
|
+
* 1. Null byte injection (truncates paths in C-based functions).
|
|
10
|
+
* 2. Catastrophic commands (rm -rf /, mkfs) that destroy the analysis session.
|
|
11
11
|
*
|
|
12
|
-
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
17
|
-
*
|
|
18
|
-
* threat class as pipe-to-interpreter (already allowed). Container/VM
|
|
19
|
-
* isolation handles the risk.
|
|
12
|
+
* Shell injection patterns ($(), backticks, ${}, eval, exec, source, pipes to
|
|
13
|
+
* interpreters, process substitution) are NOT blocked: same threat class —
|
|
14
|
+
* all allow arbitrary code execution inside the container. Blocking one while
|
|
15
|
+
* allowing others is inconsistent and blocks legitimate analysis workflows
|
|
16
|
+
* (e.g., file $(which python3), echo ${PATH}). Container/VM isolation is the
|
|
17
|
+
* security boundary, not in-band command filtering.
|
|
20
18
|
*
|
|
21
19
|
* Path sandboxing (isPathSafe, validateFilePath) is available as an opt-in
|
|
22
20
|
* workflow aid via --sandbox, not as a security control.
|
|
@@ -27,13 +25,9 @@ export const BLOCKED_PATTERNS = [
|
|
|
27
25
|
// Null byte injection - truncates paths in C-based functions
|
|
28
26
|
// Newlines allowed: enables multi-line scripts; container isolation is security boundary
|
|
29
27
|
{ pattern: /\x00/, category: "null byte injection" },
|
|
30
|
-
// Shell
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
{ pattern: /\$\{[^}]+\}/, category: "shell escape (variable expansion)" },
|
|
34
|
-
// Note: Simple $var (like $f in for-loops) is intentionally NOT blocked
|
|
35
|
-
// The threat is command substitution ($(), ${}), not variable reference
|
|
36
|
-
{ pattern: /\$[0-9?$!@#]/, category: "shell escape (special variable)" },
|
|
28
|
+
// Shell expansion ($(), ${}, backticks, $VAR) is NOT blocked (removed 2026-02):
|
|
29
|
+
// Same threat class as eval/pipe-to-interpreter (already allowed).
|
|
30
|
+
// Container/VM isolation is the security boundary.
|
|
37
31
|
// Catastrophic command guard — prevents AI from accidentally destroying the analysis session
|
|
38
32
|
// Only blocks root-level wipes (rm -rf /), not targeted deletes (rm -rf subdir/)
|
|
39
33
|
{ pattern: /rm\s+-[rR].*\s\/\s*$/, category: "catastrophic command (root wipe)" },
|
|
@@ -118,10 +112,10 @@ export function validateFilePath(relativePath, baseDir) {
|
|
|
118
112
|
export const DANGEROUS_PIPE_PATTERNS = [];
|
|
119
113
|
/**
|
|
120
114
|
* Check if a command string is safe to execute
|
|
121
|
-
* Validates against BLOCKED_PATTERNS (
|
|
115
|
+
* Validates against BLOCKED_PATTERNS (null byte injection, catastrophic commands)
|
|
122
116
|
*
|
|
123
|
-
* Note:
|
|
124
|
-
* is the security boundary for code execution
|
|
117
|
+
* Note: Shell injection and pipe-to-interpreter patterns were removed in 2026-02;
|
|
118
|
+
* container/VM isolation is the security boundary for code execution.
|
|
125
119
|
*
|
|
126
120
|
* @param command - The full command string to validate
|
|
127
121
|
* @returns { safe: boolean, error?: string }
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"blocklist.js","sourceRoot":"","sources":["../../src/security/blocklist.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"blocklist.js","sourceRoot":"","sources":["../../src/security/blocklist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAW3C,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,6DAA6D;IAC7D,yFAAyF;IACzF,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IAEpD,gFAAgF;IAChF,mEAAmE;IACnE,mDAAmD;IAEnD,6FAA6F;IAC7F,iFAAiF;IACjF,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,kCAAkC,EAAE;IACjF,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,kCAAkC,EAAE;IAC/E,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,0CAA0C,EAAE;CAC9E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe;IACtD,mDAAmD;IACnD,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAE9B,8DAA8D;IAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,wBAAwB;IACxB,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnC,qDAAqD;IACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,0DAA0D;IAC1D,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7C,mCAAmC;IACnC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,6DAA6D;IAC7D,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAEvC,kFAAkF;IAClF,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnF,gDAAgD;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC,uDAAuD;IACvD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,cAAc,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,OAAe;IAEf,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAqB,EAAE,CAAC;AAE5D;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,2CAA2C;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACjD,CAAC;IAED,iCAAiC;IACjC,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,EAAE,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,uBAAuB,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,EAAE,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}
|