@remnux/mcp-server 0.1.53 → 0.1.55

package/dist/parsers/r2.js

@@ -0,0 +1,161 @@
+/**
+ * Pure parsers for radare2 JSON output (izj/izzj strings, iSj sections, aflj
+ * functions, axtj cross-references) plus the marker-split for the batched
+ * "Pass 2" command used by verify_string_usage.
+ *
+ * Every parser is defensive and NEVER throws — malformed/partial r2 output
+ * returns an empty result so the classifier can degrade to `unknown` rather
+ * than mistaking a parse failure for a real "no xref" answer. Field shapes were
+ * captured from radare2 6.1.6; alternative key names seen across versions are
+ * tolerated (e.g. function address as `addr` or `offset`).
+ */
+/** Self-generated markers (emitted via `?e`) that delimit the Pass-2 sections. */
+export const R2_MARKERS = {
+    sections: "__R2MCP_SEC__",
+    functions: "__R2MCP_FNS__",
+    xref: "__R2MCP_XR__",
+};
+/** The connector caps stdout at 10MB and appends this sentinel when it does. */
+const TRUNCATION_SENTINEL = "[OUTPUT TRUNCATED";
+function asArray(json) {
+    try {
+        const data = JSON.parse(json);
+        return Array.isArray(data) ? data : [];
+    }
+    catch {
+        return [];
+    }
+}
+function num(v) {
+    return typeof v === "number" && Number.isFinite(v) ? v : undefined;
+}
+/** Parse `izj` / `izzj` string output. */
+export function parseR2Strings(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const value = r.string;
+        const vaddr = num(r.vaddr);
+        if (typeof value === "string" && vaddr !== undefined) {
+            out.push({ value, vaddr, section: typeof r.section === "string" ? r.section : "" });
+        }
+    }
+    return out;
+}
+/** Parse `iSj` section output into ranges with an exec flag. */
+export function parseR2Sections(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const vaddr = num(r.vaddr);
+        const vsize = num(r.vsize) ?? 0;
+        if (vaddr === undefined)
+            continue;
+        const perm = typeof r.perm === "string" ? r.perm : "";
+        out.push({
+            name: typeof r.name === "string" ? r.name : "",
+            vaddr,
+            vaddrEnd: vaddr + vsize,
+            exec: perm.includes("x"),
+        });
+    }
+    return out;
+}
+/** Parse `aflj` function list (address key is `addr` or `offset` across versions). */
+export function parseR2Functions(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const addr = num(r.addr) ?? num(r.offset);
+        if (addr === undefined)
+            continue;
+        out.push({ addr, name: typeof r.name === "string" ? r.name : "", size: num(r.size) ?? 0 });
+    }
+    return out;
+}
+/** Parse `axtj` cross-reference output for one address. */
+export function parseR2Xrefs(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const from = num(r.from);
+        if (from === undefined)
+            continue;
+        out.push({
+            from,
+            type: typeof r.type === "string" ? r.type : "",
+            fcnAddr: num(r.fcn_addr),
+            fcnName: typeof r.fcn_name === "string" ? r.fcn_name : undefined,
+            opcode: typeof r.opcode === "string" ? r.opcode : undefined,
+        });
+    }
+    return out;
+}
+/** Extract the radare2 version string from `?V` output (first matching line). */
+export function parseR2Version(text) {
+    const m = text.match(/radare2\s+(\S+)/i);
+    return m ? m[1] : undefined;
+}
+/**
+ * Split the batched Pass-2 stdout on the self-generated markers. The preamble
+ * (before the sections marker) carries the `?V` version line; sections sit
+ * between the sections and functions markers; functions between the functions
+ * marker and the first xref marker; each `__R2MCP_XR__ <addr>` block holds that
+ * address's axtj JSON up to the next marker or EOF.
+ */
+export function splitMarkedR2Output(stdout) {
+    const result = {
+        truncated: stdout.includes(TRUNCATION_SENTINEL),
+        sectionsJson: "",
+        functionsJson: "",
+        xrefsByVaddr: new Map(),
+    };
+    const lines = stdout.split("\n");
+    let bucket = { kind: "pre" };
+    let buf = [];
+    const flush = () => {
+        const text = buf.join("\n").trim();
+        if (bucket.kind === "pre") {
+            result.version = parseR2Version(text);
+        }
+        else if (bucket.kind === "sec") {
+            result.sectionsJson = text;
+        }
+        else if (bucket.kind === "fns") {
+            result.functionsJson = text;
+        }
+        else if (bucket.kind === "xref" && bucket.key) {
+            result.xrefsByVaddr.set(bucket.key, text);
+        }
+        buf = [];
+    };
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed === R2_MARKERS.sections) {
+            flush();
+            bucket = { kind: "sec" };
+        }
+        else if (trimmed === R2_MARKERS.functions) {
+            flush();
+            bucket = { kind: "fns" };
+        }
+        else if (trimmed.startsWith(R2_MARKERS.xref + " ")) {
+            flush();
+            bucket = { kind: "xref", key: trimmed.slice(R2_MARKERS.xref.length + 1).trim() };
+        }
+        else {
+            buf.push(line);
+        }
+    }
+    flush();
+    return result;
+}
+//# sourceMappingURL=r2.js.map

package/dist/parsers/r2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2.js","sourceRoot":"","sources":["../../src/parsers/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,QAAQ,EAAE,eAAe;IACzB,SAAS,EAAE,eAAe;IAC1B,IAAI,EAAE,cAAc;CACZ,CAAC;AAEX,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAkChD,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC9C,KAAK;YACL,QAAQ,EAAE,KAAK,GAAG,KAAK;YACvB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC9C,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxB,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAChE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9B,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,MAAM,GAAkB;QAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAC/C,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;QACjB,YAAY,EAAE,IAAI,GAAG,EAAE;KACxB,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,MAAM,GAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACrC,IAAI,GAAG,GAAa,EAAE,CAAC;IAEvB,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;QAC7B,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAChD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,GAAG,GAAG,EAAE,CAAC;IACX,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;YACpC,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,OAAO,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;YAC5C,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACrD,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/parsers/types.d.ts

@@ -11,7 +11,26 @@ export interface Finding {
     category?: string;
     /** Raw evidence from tool output */
     evidence?: string;
+    /**
+     * For capability findings (e.g. capa): the kind(s) of evidence the match
+     * actually relied on, derived from the feature nodes that matched. An
+     * unordered, deduplicated set describing HOW the rule matched — not a verdict
+     * on what the sample does. Absent when it cannot be determined (treat absence
+     * as "unknown", not "none").
+     *   - artifact   — matched on strings/regex/bytes (data present, not necessarily executed)
+     *   - behavior   — matched on API calls, mnemonics, or other code semantics
+     *   - structural — matched on sections, file characteristics, format/arch
+     *   - linking    — matched on imports / runtime-linking
+     */
+    evidence_types?: EvidenceType[];
 }
+/**
+ * The kind of evidence a capability match relied on (see Finding.evidence_types).
+ * A `string` artifact match proves the data is present; it does NOT prove the
+ * binary executes the corresponding behavior. Only a `behavior` match (API
+ * calls, mnemonics) is code-level evidence.
+ */
+export type EvidenceType = "artifact" | "behavior" | "structural" | "linking";
 /** Structured metadata extracted from tool output. */
 export interface ParsedToolOutput {
     /** Tool that produced this output */

package/dist/parsers/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/parsers/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,gBAAgB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/parsers/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;AAE9E,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,gBAAgB,CAAC"}

package/dist/report/triage-discipline.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Pre-claim triage discipline checklist — server-authored, bundled, offline.
+ *
+ * This is operational guidance on USING the analysis tools and reasoning about
+ * evidence (the gates to pass before asserting a behavioral claim). It is
+ * deliberately distinct from the report-WRITING guidelines in
+ * content.generated.ts, which are synced from zeltser.com; this content is the
+ * same category as the server's other locally-authored guidance (the
+ * analyze_file analysis_guidance, the advisories, the suggest_tools hints) and
+ * is therefore authored and versioned here.
+ *
+ * Upgrade path: if this should later be published and reused on zeltser.com, it
+ * can graduate to the synced report-guidance pipeline without changing the
+ * `triage_checklist` topic's interface. Until then it is bundled and offline —
+ * no live network fetch (the server's works-offline guarantee is load-bearing
+ * for air-gapped REMnux deployments).
+ */
+export declare const TRIAGE_DISCIPLINE: {
+    readonly version: "1.0.0";
+    readonly title: "Malware triage discipline — gates to pass before making a claim";
+    readonly provenance: "Server-authored operational guidance, bundled and offline (not synced from zeltser.com).";
+    readonly core_principle: string;
+    readonly before_claiming_a_behavior: readonly ["Are the required APIs imported, or resolvable at runtime (GetProcAddress + LoadLibrary*)? If neither, the behavior is not statically supported.", "If the required APIs are absent but the binary is packed / encrypted / high-entropy, the honest answer is 'indeterminate — unpack first', not 'incapable'. Static absence on an obscured binary proves nothing.", "Are the relevant data artifacts (strings, wallet addresses, regexes) cross-referenced from executable code? Data sitting in .rdata with no code xref is an artifact, not an operational indicator.", "Is the relevant code reachable from the entry point, or only from unused / initializer-only code?", "Did dynamic analysis (emulation, sandbox) actually exercise the suspected path? Static analysis alone cannot confirm a runtime behavior.", "Distinguish 'the code to do X is present' (a capability) from 'the sample does X' (a confirmed behavior). Until confirmed, write 'capable of' or 'consistent with', not 'performs'."];
+    readonly for_each_ioc: readonly ["Operationally used (referenced by reachable code, or observed in traffic) vs. vestigial (present in the file but unreferenced)?", "Pyramid-of-Pain tier — trivially changed by the adversary (hash, IP) or costly (tooling, TTP)?", "Pivotable to other samples / campaigns, or unique to this sample?"];
+    readonly for_confidence: readonly ["Direct evidence vs. inferential leap — how many assumptions sit between the observation and the claim?", "Single-source vs. corroborated across independent tools or methods.", "Use ICD-203 estimative language; state attribution confidence separately from detection confidence."];
+    readonly using_this_server: readonly ["capa findings carry evidence_types (artifact / behavior / structural / linking), and analyze_file returns a capability_evidence field separating behavior_capable from artifact_only — read those before asserting a behavior.", "A YARA family match is resemblance, not identity. A family name in the filename is a lead to test, never a finding.", "When you need behavioral confirmation, plan for emulation (speakeasy) or sandbox detonation rather than inferring it from static artifacts."];
+};
+//# sourceMappingURL=triage-discipline.d.ts.map

package/dist/report/triage-discipline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-discipline.d.ts","sourceRoot":"","sources":["../../src/report/triage-discipline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;CA+BpB,CAAC"}

package/dist/report/triage-discipline.js

@@ -0,0 +1,49 @@
+/**
+ * Pre-claim triage discipline checklist — server-authored, bundled, offline.
+ *
+ * This is operational guidance on USING the analysis tools and reasoning about
+ * evidence (the gates to pass before asserting a behavioral claim). It is
+ * deliberately distinct from the report-WRITING guidelines in
+ * content.generated.ts, which are synced from zeltser.com; this content is the
+ * same category as the server's other locally-authored guidance (the
+ * analyze_file analysis_guidance, the advisories, the suggest_tools hints) and
+ * is therefore authored and versioned here.
+ *
+ * Upgrade path: if this should later be published and reused on zeltser.com, it
+ * can graduate to the synced report-guidance pipeline without changing the
+ * `triage_checklist` topic's interface. Until then it is bundled and offline —
+ * no live network fetch (the server's works-offline guarantee is load-bearing
+ * for air-gapped REMnux deployments).
+ */
+export const TRIAGE_DISCIPLINE = {
+    version: "1.0.0",
+    title: "Malware triage discipline — gates to pass before making a claim",
+    provenance: "Server-authored operational guidance, bundled and offline (not synced from zeltser.com).",
+    core_principle: "Separate ARTIFACT-level evidence (a string, regex, constant, or capa pattern is PRESENT in the file) from " +
+        "BEHAVIORAL evidence (reachable code actually performs the action). The presence of an artifact is not proof " +
+        "the behavior executes. Most over-confident triage errors come from restating an artifact as a behavior.",
+    before_claiming_a_behavior: [
+        "Are the required APIs imported, or resolvable at runtime (GetProcAddress + LoadLibrary*)? If neither, the behavior is not statically supported.",
+        "If the required APIs are absent but the binary is packed / encrypted / high-entropy, the honest answer is 'indeterminate — unpack first', not 'incapable'. Static absence on an obscured binary proves nothing.",
+        "Are the relevant data artifacts (strings, wallet addresses, regexes) cross-referenced from executable code? Data sitting in .rdata with no code xref is an artifact, not an operational indicator.",
+        "Is the relevant code reachable from the entry point, or only from unused / initializer-only code?",
+        "Did dynamic analysis (emulation, sandbox) actually exercise the suspected path? Static analysis alone cannot confirm a runtime behavior.",
+        "Distinguish 'the code to do X is present' (a capability) from 'the sample does X' (a confirmed behavior). Until confirmed, write 'capable of' or 'consistent with', not 'performs'.",
+    ],
+    for_each_ioc: [
+        "Operationally used (referenced by reachable code, or observed in traffic) vs. vestigial (present in the file but unreferenced)?",
+        "Pyramid-of-Pain tier — trivially changed by the adversary (hash, IP) or costly (tooling, TTP)?",
+        "Pivotable to other samples / campaigns, or unique to this sample?",
+    ],
+    for_confidence: [
+        "Direct evidence vs. inferential leap — how many assumptions sit between the observation and the claim?",
+        "Single-source vs. corroborated across independent tools or methods.",
+        "Use ICD-203 estimative language; state attribution confidence separately from detection confidence.",
+    ],
+    using_this_server: [
+        "capa findings carry evidence_types (artifact / behavior / structural / linking), and analyze_file returns a capability_evidence field separating behavior_capable from artifact_only — read those before asserting a behavior.",
+        "A YARA family match is resemblance, not identity. A family name in the filename is a lead to test, never a finding.",
+        "When you need behavioral confirmation, plan for emulation (speakeasy) or sandbox detonation rather than inferring it from static artifacts.",
+    ],
+};
+//# sourceMappingURL=triage-discipline.js.map

package/dist/report/triage-discipline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-discipline.js","sourceRoot":"","sources":["../../src/report/triage-discipline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,iEAAiE;IACxE,UAAU,EAAE,0FAA0F;IACtG,cAAc,EACZ,4GAA4G;QAC5G,8GAA8G;QAC9G,yGAAyG;IAC3G,0BAA0B,EAAE;QAC1B,iJAAiJ;QACjJ,iNAAiN;QACjN,oMAAoM;QACpM,mGAAmG;QACnG,0IAA0I;QAC1I,qLAAqL;KACtL;IACD,YAAY,EAAE;QACZ,iIAAiI;QACjI,gGAAgG;QAChG,mEAAmE;KACpE;IACD,cAAc,EAAE;QACd,wGAAwG;QACxG,qEAAqE;QACrE,qGAAqG;KACtG;IACD,iBAAiB,EAAE;QACjB,gOAAgO;QAChO,qHAAqH;QACrH,6IAA6I;KAC9I;CACO,CAAC"}

package/dist/schemas/tools.d.ts

@@ -146,11 +146,53 @@ export type ExtractIOCsArgs = z.infer<typeof extractIOCsSchema>;
 export declare const getReportTemplateSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
 export type GetReportTemplateArgs = z.infer<typeof getReportTemplateSchema>;
 export declare const getReportGuidanceSchema: z.ZodObject<{
-    topic: z.ZodDefault<z.ZodOptional<z.ZodEnum<["all", "sections", "confidence", "capabilities", "pyramid_of_pain", "anti_patterns", "review", "writing", "frameworks", "profiles"]>>>;
+    topic: z.ZodDefault<z.ZodOptional<z.ZodEnum<["all", "sections", "confidence", "capabilities", "pyramid_of_pain", "anti_patterns", "review", "writing", "frameworks", "profiles", "triage_checklist"]>>>;
 }, "strip", z.ZodTypeAny, {
-    topic: "all" | "sections" | "confidence" | "capabilities" | "pyramid_of_pain" | "anti_patterns" | "review" | "writing" | "frameworks" | "profiles";
+    topic: "all" | "sections" | "confidence" | "capabilities" | "pyramid_of_pain" | "anti_patterns" | "review" | "writing" | "frameworks" | "profiles" | "triage_checklist";
 }, {
-    topic?: "all" | "sections" | "confidence" | "capabilities" | "pyramid_of_pain" | "anti_patterns" | "review" | "writing" | "frameworks" | "profiles" | undefined;
+    topic?: "all" | "sections" | "confidence" | "capabilities" | "pyramid_of_pain" | "anti_patterns" | "review" | "writing" | "frameworks" | "profiles" | "triage_checklist" | undefined;
 }>;
 export type GetReportGuidanceArgs = z.input<typeof getReportGuidanceSchema>;
+export declare const checkBehaviorPrerequisitesSchema: z.ZodObject<{
+    file: z.ZodString;
+    behavior: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    file: string;
+    behavior?: string | undefined;
+}, {
+    file: string;
+    behavior?: string | undefined;
+}>;
+export type CheckBehaviorPrerequisitesArgs = z.infer<typeof checkBehaviorPrerequisitesSchema>;
+export declare const verifyStringUsageSchema: z.ZodObject<{
+    file: z.ZodString;
+    query: z.ZodString;
+    depth: z.ZodOptional<z.ZodEnum<["standard", "deep"]>>;
+    max_matches: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    file: string;
+    query: string;
+    depth?: "standard" | "deep" | undefined;
+    max_matches?: number | undefined;
+}, {
+    file: string;
+    query: string;
+    depth?: "standard" | "deep" | undefined;
+    max_matches?: number | undefined;
+}>;
+export type VerifyStringUsageArgs = z.infer<typeof verifyStringUsageSchema>;
+export declare const compareFilesSchema: z.ZodObject<{
+    file_a: z.ZodString;
+    file_b: z.ZodString;
+    depth: z.ZodOptional<z.ZodEnum<["quick", "standard"]>>;
+}, "strip", z.ZodTypeAny, {
+    file_a: string;
+    file_b: string;
+    depth?: "quick" | "standard" | undefined;
+}, {
+    file_a: string;
+    file_b: string;
+    depth?: "quick" | "standard" | undefined;
+}>;
+export type CompareFilesArgs = z.infer<typeof compareFilesSchema>;
 //# sourceMappingURL=tools.d.ts.map

package/dist/schemas/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/schemas/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,aAAa;;;;;;;;;;;;EAIxB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAExD,eAAO,MAAM,iBAAiB;;;;;;EAE5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,eAAe;;;;;;EAE1B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE5D,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAO7B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAM5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,gBAAgB,gDAAe,CAAC;AAC7C,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE9D,eAAO,MAAM,kBAAkB;;;;;;;;;EAK7B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;EAmBhC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAExE,eAAO,MAAM,iBAAiB;;;;;;EAI5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAI5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,uBAAuB,gDAAe,CAAC;AACpD,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE5E,eAAO,MAAM,uBAAuB;;;;;;EAiBlC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/schemas/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,aAAa;;;;;;;;;;;;EAIxB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAExD,eAAO,MAAM,iBAAiB;;;;;;EAE5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,eAAe;;;;;;EAE1B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE5D,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAO7B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAM5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,gBAAgB,gDAAe,CAAC;AAC7C,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE9D,eAAO,MAAM,kBAAkB;;;;;;;;;EAK7B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;EAmBhC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAExE,eAAO,MAAM,iBAAiB;;;;;;EAI5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAI5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,uBAAuB,gDAAe,CAAC;AACpD,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE5E,eAAO,MAAM,uBAAuB;;;;;;EAoBlC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;EAO3C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE9F,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAOlC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE5E,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAM7B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/schemas/tools.js

@@ -67,8 +67,28 @@ export const getReportGuidanceSchema = z.object({
         "writing",
         "frameworks",
         "profiles",
-    ]).optional().default("all").describe("Which slice of the writing guidelines to return. 'all' (default) returns the full digest; " +
+        "triage_checklist",
+    ]).optional().default("all").describe("Which slice of guidance to return. 'all' (default) returns the full writing-guidelines digest; " +
         "narrow to 'sections', 'confidence', 'capabilities', 'pyramid_of_pain', 'anti_patterns', " +
-        "'review', 'writing', 'frameworks', or 'profiles' to reduce size."),
+        "'review', 'writing', 'frameworks', or 'profiles' to reduce size. " +
+        "'triage_checklist' returns the pre-claim triage discipline checklist (artifact-vs-behavior gates to pass " +
+        "before drawing a behavioral conclusion) — useful at the START of an analysis, not just when writing up."),
+});
+export const checkBehaviorPrerequisitesSchema = z.object({
+    file: z.string().describe("Filename relative to the samples directory, or an absolute path in local mode."),
+    behavior: z.string().optional().describe("Behavior to check (omit to scan ALL known behaviors). One of: clipboard_hijacking, http_c2_wininet, " +
+        "winhttp_c2, socket_c2, process_injection_remote, process_injection_self, registry_persistence_run, " +
+        "lnk_persistence, browser_credential_theft, screen_capture, keylog_polling, keylog_hook, network_share_enum."),
+});
+export const verifyStringUsageSchema = z.object({
+    file: z.string().describe("Filename relative to the samples directory, or an absolute path in local mode."),
+    query: z.string().describe("The string (or substring) to locate in the binary and cross-reference against code."),
+    depth: z.enum(["standard", "deep"]).optional().describe("Analysis depth: 'standard' (radare2 aa; aar — default) or 'deep' (aaa — slower, more thorough)."),
+    max_matches: z.number().optional().describe("Cap on the number of distinct matching strings to classify (default 50)."),
+});
+export const compareFilesSchema = z.object({
+    file_a: z.string().describe("First file (relative to the samples directory, or absolute in local mode)."),
+    file_b: z.string().describe("Second file to compare against file_a."),
+    depth: z.enum(["quick", "standard"]).optional().describe("'standard' (default) includes a capa capability diff (slower — runs capa on both files); 'quick' skips capa (imports/sections/compiler/entropy only)."),
 });
 //# sourceMappingURL=tools.js.map

package/dist/schemas/tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/schemas/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;IACrH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;IAC7I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;CAC7E,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CACrG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;CAChG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;IAC5G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6FAA6F,CAAC;IACvI,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;CACjJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mQAAmQ,CAAC;IACnS,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;IAChH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC;CACjH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CACpD,iFAAiF;QACjF,gGAAgG,CACjG;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IAC7F,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAClF,mLAAmL,CACpL;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAG7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAClF,uGAAuG,CACxG;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACtE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,sEAAsE,CACvE;IACD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,gDAAgD;QAChD,8DAA8D,CAC/D;IACD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAClE,8DAA8D;QAC9D,0EAA0E,CAC3E;IACD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CACvD,qDAAqD,CACtD;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACrC,uDAAuD,CACxD;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CACvB,mFAAmF,CACpF;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACvG,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sEAAsE,CAAC;CAC5I,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAGpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;QACZ,KAAK;QACL,UAAU;QACV,YAAY;QACZ,cAAc;QACd,iBAAiB;QACjB,eAAe;QACf,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,UAAU;KACX,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CACnC,4FAA4F;QAC5F,0FAA0F;QAC1F,kEAAkE,CACnE;CACF,CAAC,CAAC"}
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/schemas/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;IACrH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;IAC7I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;CAC7E,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CACrG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;CAChG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;IAC5G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6FAA6F,CAAC;IACvI,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;CACjJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mQAAmQ,CAAC;IACnS,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;IAChH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC;CACjH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CACpD,iFAAiF;QACjF,gGAAgG,CACjG;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IAC7F,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAClF,mLAAmL,CACpL;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAG7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAClF,uGAAuG,CACxG;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACtE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,sEAAsE,CACvE;IACD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,gDAAgD;QAChD,8DAA8D,CAC/D;IACD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAClE,8DAA8D;QAC9D,0EAA0E,CAC3E;IACD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CACvD,qDAAqD,CACtD;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACrC,uDAAuD,CACxD;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CACvB,mFAAmF,CACpF;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACvG,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sEAAsE,CAAC;CAC5I,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAGpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;QACZ,KAAK;QACL,UAAU;QACV,YAAY;QACZ,cAAc;QACd,iBAAiB;QACjB,eAAe;QACf,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CACnC,iGAAiG;QACjG,0FAA0F;QAC1F,mEAAmE;QACnE,2GAA2G;QAC3G,yGAAyG,CAC1G;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;IAC3G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,sGAAsG;QACtG,qGAAqG;QACrG,6GAA6G,CAC9G;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;IAC3G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qFAAqF,CAAC;IACjH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACrD,iGAAiG,CAClG;IACD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0EAA0E,CAAC;CACxH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4EAA4E,CAAC;IACzG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACrE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,uJAAuJ,CACxJ;CACF,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnux/mcp-server",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "packageManager": "pnpm@10.33.0",
   "description": "MCP server for using the REMnux malware analysis toolkit via AI assistants",
   "type": "module",