@remnux/mcp-server 0.1.54 → 0.1.56

package/dist/parsers/types.d.ts

@@ -11,7 +11,26 @@ export interface Finding {
     category?: string;
     /** Raw evidence from tool output */
     evidence?: string;
+    /**
+     * For capability findings (e.g. capa): the kind(s) of evidence the match
+     * actually relied on, derived from the feature nodes that matched. An
+     * unordered, deduplicated set describing HOW the rule matched — not a verdict
+     * on what the sample does. Absent when it cannot be determined (treat absence
+     * as "unknown", not "none").
+     *   - artifact   — matched on strings/regex/bytes (data present, not necessarily executed)
+     *   - behavior   — matched on API calls, mnemonics, or other code semantics
+     *   - structural — matched on sections, file characteristics, format/arch
+     *   - linking    — matched on imports / runtime-linking
+     */
+    evidence_types?: EvidenceType[];
 }
+/**
+ * The kind of evidence a capability match relied on (see Finding.evidence_types).
+ * A `string` artifact match proves the data is present; it does NOT prove the
+ * binary executes the corresponding behavior. Only a `behavior` match (API
+ * calls, mnemonics) is code-level evidence.
+ */
+export type EvidenceType = "artifact" | "behavior" | "structural" | "linking";
 /** Structured metadata extracted from tool output. */
 export interface ParsedToolOutput {
     /** Tool that produced this output */

package/dist/parsers/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/parsers/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,gBAAgB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/parsers/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;AAE9E,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,gBAAgB,CAAC"}

package/dist/report/triage-discipline.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Pre-claim triage discipline checklist — server-authored, bundled, offline.
+ *
+ * This is operational guidance on USING the analysis tools and reasoning about
+ * evidence (the gates to pass before asserting a behavioral claim). It is
+ * deliberately distinct from the report-WRITING guidelines in
+ * content.generated.ts, which are synced from zeltser.com; this content is the
+ * same category as the server's other locally-authored guidance (the
+ * analyze_file analysis_guidance, the advisories, the suggest_tools hints) and
+ * is therefore authored and versioned here.
+ *
+ * Upgrade path: if this should later be published and reused on zeltser.com, it
+ * can graduate to the synced report-guidance pipeline without changing the
+ * `triage_checklist` topic's interface. Until then it is bundled and offline —
+ * no live network fetch (the server's works-offline guarantee is load-bearing
+ * for air-gapped REMnux deployments).
+ */
+export declare const TRIAGE_DISCIPLINE: {
+    readonly version: "1.0.0";
+    readonly title: "Malware triage discipline — gates to pass before making a claim";
+    readonly provenance: "Server-authored operational guidance, bundled and offline (not synced from zeltser.com).";
+    readonly core_principle: string;
+    readonly before_claiming_a_behavior: readonly ["Are the required APIs imported, or resolvable at runtime (GetProcAddress + LoadLibrary*)? If neither, the behavior is not statically supported.", "If the required APIs are absent but the binary is packed / encrypted / high-entropy, the honest answer is 'indeterminate — unpack first', not 'incapable'. Static absence on an obscured binary proves nothing.", "Are the relevant data artifacts (strings, wallet addresses, regexes) cross-referenced from executable code? Data sitting in .rdata with no code xref is an artifact, not an operational indicator.", "Is the relevant code reachable from the entry point, or only from unused / initializer-only code?", "Did dynamic analysis (emulation, sandbox) actually exercise the suspected path? Static analysis alone cannot confirm a runtime behavior.", "Distinguish 'the code to do X is present' (a capability) from 'the sample does X' (a confirmed behavior). Until confirmed, write 'capable of' or 'consistent with', not 'performs'."];
+    readonly for_each_ioc: readonly ["Operationally used (referenced by reachable code, or observed in traffic) vs. vestigial (present in the file but unreferenced)?", "Pyramid-of-Pain tier — trivially changed by the adversary (hash, IP) or costly (tooling, TTP)?", "Pivotable to other samples / campaigns, or unique to this sample?"];
+    readonly for_confidence: readonly ["Direct evidence vs. inferential leap — how many assumptions sit between the observation and the claim?", "Single-source vs. corroborated across independent tools or methods.", "Use ICD-203 estimative language; state attribution confidence separately from detection confidence."];
+    readonly using_this_server: readonly ["capa findings carry evidence_types (artifact / behavior / structural / linking), and analyze_file returns a capability_evidence field separating behavior_capable from artifact_only — read those before asserting a behavior.", "A YARA family match is resemblance, not identity. A family name in the filename is a lead to test, never a finding.", "When you need behavioral confirmation, plan for emulation (speakeasy) or sandbox detonation rather than inferring it from static artifacts."];
+};
+//# sourceMappingURL=triage-discipline.d.ts.map

package/dist/report/triage-discipline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-discipline.d.ts","sourceRoot":"","sources":["../../src/report/triage-discipline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;CA+BpB,CAAC"}

package/dist/report/triage-discipline.js

@@ -0,0 +1,49 @@
+/**
+ * Pre-claim triage discipline checklist — server-authored, bundled, offline.
+ *
+ * This is operational guidance on USING the analysis tools and reasoning about
+ * evidence (the gates to pass before asserting a behavioral claim). It is
+ * deliberately distinct from the report-WRITING guidelines in
+ * content.generated.ts, which are synced from zeltser.com; this content is the
+ * same category as the server's other locally-authored guidance (the
+ * analyze_file analysis_guidance, the advisories, the suggest_tools hints) and
+ * is therefore authored and versioned here.
+ *
+ * Upgrade path: if this should later be published and reused on zeltser.com, it
+ * can graduate to the synced report-guidance pipeline without changing the
+ * `triage_checklist` topic's interface. Until then it is bundled and offline —
+ * no live network fetch (the server's works-offline guarantee is load-bearing
+ * for air-gapped REMnux deployments).
+ */
+export const TRIAGE_DISCIPLINE = {
+    version: "1.0.0",
+    title: "Malware triage discipline — gates to pass before making a claim",
+    provenance: "Server-authored operational guidance, bundled and offline (not synced from zeltser.com).",
+    core_principle: "Separate ARTIFACT-level evidence (a string, regex, constant, or capa pattern is PRESENT in the file) from " +
+        "BEHAVIORAL evidence (reachable code actually performs the action). The presence of an artifact is not proof " +
+        "the behavior executes. Most over-confident triage errors come from restating an artifact as a behavior.",
+    before_claiming_a_behavior: [
+        "Are the required APIs imported, or resolvable at runtime (GetProcAddress + LoadLibrary*)? If neither, the behavior is not statically supported.",
+        "If the required APIs are absent but the binary is packed / encrypted / high-entropy, the honest answer is 'indeterminate — unpack first', not 'incapable'. Static absence on an obscured binary proves nothing.",
+        "Are the relevant data artifacts (strings, wallet addresses, regexes) cross-referenced from executable code? Data sitting in .rdata with no code xref is an artifact, not an operational indicator.",
+        "Is the relevant code reachable from the entry point, or only from unused / initializer-only code?",
+        "Did dynamic analysis (emulation, sandbox) actually exercise the suspected path? Static analysis alone cannot confirm a runtime behavior.",
+        "Distinguish 'the code to do X is present' (a capability) from 'the sample does X' (a confirmed behavior). Until confirmed, write 'capable of' or 'consistent with', not 'performs'.",
+    ],
+    for_each_ioc: [
+        "Operationally used (referenced by reachable code, or observed in traffic) vs. vestigial (present in the file but unreferenced)?",
+        "Pyramid-of-Pain tier — trivially changed by the adversary (hash, IP) or costly (tooling, TTP)?",
+        "Pivotable to other samples / campaigns, or unique to this sample?",
+    ],
+    for_confidence: [
+        "Direct evidence vs. inferential leap — how many assumptions sit between the observation and the claim?",
+        "Single-source vs. corroborated across independent tools or methods.",
+        "Use ICD-203 estimative language; state attribution confidence separately from detection confidence.",
+    ],
+    using_this_server: [
+        "capa findings carry evidence_types (artifact / behavior / structural / linking), and analyze_file returns a capability_evidence field separating behavior_capable from artifact_only — read those before asserting a behavior.",
+        "A YARA family match is resemblance, not identity. A family name in the filename is a lead to test, never a finding.",
+        "When you need behavioral confirmation, plan for emulation (speakeasy) or sandbox detonation rather than inferring it from static artifacts.",
+    ],
+};
+//# sourceMappingURL=triage-discipline.js.map

package/dist/report/triage-discipline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-discipline.js","sourceRoot":"","sources":["../../src/report/triage-discipline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,iEAAiE;IACxE,UAAU,EAAE,0FAA0F;IACtG,cAAc,EACZ,4GAA4G;QAC5G,8GAA8G;QAC9G,yGAAyG;IAC3G,0BAA0B,EAAE;QAC1B,iJAAiJ;QACjJ,iNAAiN;QACjN,oMAAoM;QACpM,mGAAmG;QACnG,0IAA0I;QAC1I,qLAAqL;KACtL;IACD,YAAY,EAAE;QACZ,iIAAiI;QACjI,gGAAgG;QAChG,mEAAmE;KACpE;IACD,cAAc,EAAE;QACd,wGAAwG;QACxG,qEAAqE;QACrE,qGAAqG;KACtG;IACD,iBAAiB,EAAE;QACjB,gOAAgO;QAChO,qHAAqH;QACrH,6IAA6I;KAC9I;CACO,CAAC"}

package/dist/schemas/tools.d.ts

@@ -146,11 +146,64 @@ export type ExtractIOCsArgs = z.infer<typeof extractIOCsSchema>;
 export declare const getReportTemplateSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
 export type GetReportTemplateArgs = z.infer<typeof getReportTemplateSchema>;
 export declare const getReportGuidanceSchema: z.ZodObject<{
-    topic: z.ZodDefault<z.ZodOptional<z.ZodEnum<["all", "sections", "confidence", "capabilities", "pyramid_of_pain", "anti_patterns", "review", "writing", "frameworks", "profiles"]>>>;
+    topic: z.ZodDefault<z.ZodOptional<z.ZodEnum<["all", "sections", "confidence", "capabilities", "pyramid_of_pain", "anti_patterns", "review", "writing", "frameworks", "profiles", "triage_checklist"]>>>;
 }, "strip", z.ZodTypeAny, {
-    topic: "all" | "sections" | "confidence" | "capabilities" | "pyramid_of_pain" | "anti_patterns" | "review" | "writing" | "frameworks" | "profiles";
+    topic: "all" | "sections" | "confidence" | "capabilities" | "pyramid_of_pain" | "anti_patterns" | "review" | "writing" | "frameworks" | "profiles" | "triage_checklist";
 }, {
-    topic?: "all" | "sections" | "confidence" | "capabilities" | "pyramid_of_pain" | "anti_patterns" | "review" | "writing" | "frameworks" | "profiles" | undefined;
+    topic?: "all" | "sections" | "confidence" | "capabilities" | "pyramid_of_pain" | "anti_patterns" | "review" | "writing" | "frameworks" | "profiles" | "triage_checklist" | undefined;
 }>;
 export type GetReportGuidanceArgs = z.input<typeof getReportGuidanceSchema>;
+export declare const getOsintGuidanceSchema: z.ZodObject<{
+    topic: z.ZodDefault<z.ZodOptional<z.ZodEnum<["all", "tradecraft", "workflow", "access", "resources"]>>>;
+    ioc_type: z.ZodOptional<z.ZodEnum<["hash", "url", "domain", "ip", "family", "host_artifact"]>>;
+}, "strip", z.ZodTypeAny, {
+    topic: "all" | "tradecraft" | "workflow" | "access" | "resources";
+    ioc_type?: "url" | "hash" | "domain" | "ip" | "family" | "host_artifact" | undefined;
+}, {
+    topic?: "all" | "tradecraft" | "workflow" | "access" | "resources" | undefined;
+    ioc_type?: "url" | "hash" | "domain" | "ip" | "family" | "host_artifact" | undefined;
+}>;
+export type GetOsintGuidanceArgs = z.input<typeof getOsintGuidanceSchema>;
+export declare const checkBehaviorPrerequisitesSchema: z.ZodObject<{
+    file: z.ZodString;
+    behavior: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    file: string;
+    behavior?: string | undefined;
+}, {
+    file: string;
+    behavior?: string | undefined;
+}>;
+export type CheckBehaviorPrerequisitesArgs = z.infer<typeof checkBehaviorPrerequisitesSchema>;
+export declare const verifyStringUsageSchema: z.ZodObject<{
+    file: z.ZodString;
+    query: z.ZodString;
+    depth: z.ZodOptional<z.ZodEnum<["standard", "deep"]>>;
+    max_matches: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    file: string;
+    query: string;
+    depth?: "standard" | "deep" | undefined;
+    max_matches?: number | undefined;
+}, {
+    file: string;
+    query: string;
+    depth?: "standard" | "deep" | undefined;
+    max_matches?: number | undefined;
+}>;
+export type VerifyStringUsageArgs = z.infer<typeof verifyStringUsageSchema>;
+export declare const compareFilesSchema: z.ZodObject<{
+    file_a: z.ZodString;
+    file_b: z.ZodString;
+    depth: z.ZodOptional<z.ZodEnum<["quick", "standard"]>>;
+}, "strip", z.ZodTypeAny, {
+    file_a: string;
+    file_b: string;
+    depth?: "quick" | "standard" | undefined;
+}, {
+    file_a: string;
+    file_b: string;
+    depth?: "quick" | "standard" | undefined;
+}>;
+export type CompareFilesArgs = z.infer<typeof compareFilesSchema>;
 //# sourceMappingURL=tools.d.ts.map

package/dist/schemas/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/schemas/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,aAAa;;;;;;;;;;;;EAIxB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAExD,eAAO,MAAM,iBAAiB;;;;;;EAE5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,eAAe;;;;;;EAE1B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE5D,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAO7B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAM5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,gBAAgB,gDAAe,CAAC;AAC7C,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE9D,eAAO,MAAM,kBAAkB;;;;;;;;;EAK7B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;EAmBhC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAExE,eAAO,MAAM,iBAAiB;;;;;;EAI5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAI5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,uBAAuB,gDAAe,CAAC;AACpD,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE5E,eAAO,MAAM,uBAAuB;;;;;;EAiBlC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/schemas/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,aAAa;;;;;;;;;;;;EAIxB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAExD,eAAO,MAAM,iBAAiB;;;;;;EAE5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,eAAe;;;;;;EAE1B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE5D,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAO7B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAM5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,gBAAgB,gDAAe,CAAC;AAC7C,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE9D,eAAO,MAAM,kBAAkB;;;;;;;;;EAK7B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;EAmBhC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAExE,eAAO,MAAM,iBAAiB;;;;;;EAI5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAI5B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE,eAAO,MAAM,uBAAuB,gDAAe,CAAC;AACpD,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE5E,eAAO,MAAM,uBAAuB;;;;;;EAoBlC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE5E,eAAO,MAAM,sBAAsB;;;;;;;;;EAyBjC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE1E,eAAO,MAAM,gCAAgC;;;;;;;;;EAO3C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE9F,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAOlC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE5E,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAM7B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/schemas/tools.js

@@ -67,8 +67,50 @@ export const getReportGuidanceSchema = z.object({
         "writing",
         "frameworks",
         "profiles",
-    ]).optional().default("all").describe("Which slice of the writing guidelines to return. 'all' (default) returns the full digest; " +
+        "triage_checklist",
+    ]).optional().default("all").describe("Which slice of guidance to return. 'all' (default) returns the full writing-guidelines digest; " +
         "narrow to 'sections', 'confidence', 'capabilities', 'pyramid_of_pain', 'anti_patterns', " +
-        "'review', 'writing', 'frameworks', or 'profiles' to reduce size."),
+        "'review', 'writing', 'frameworks', or 'profiles' to reduce size. " +
+        "'triage_checklist' returns the pre-claim triage discipline checklist (artifact-vs-behavior gates to pass " +
+        "before drawing a behavioral conclusion) — useful at the START of an analysis, not just when writing up."),
+});
+export const getOsintGuidanceSchema = z.object({
+    topic: z.enum([
+        "all",
+        "tradecraft",
+        "workflow",
+        "access",
+        "resources",
+    ]).optional().default("all").describe("Which slice of guidance prose to return. 'all' (default) returns tradecraft + workflow + access guidance " +
+        "plus a CONDENSED resource catalog. 'tradecraft' returns the OPSEC principles, 'workflow' the per-IOC " +
+        "decision tree, 'access' the free-vs-paid handling, 'resources' the FULL catalog with per-entry detail. " +
+        "Lean flow for a real sample: call once with 'all' for prose plus a condensed index, then 'resources' with " +
+        "an ioc_type per indicator type for detail without re-emitting the prose."),
+    ioc_type: z.enum([
+        "hash",
+        "url",
+        "domain",
+        "ip",
+        "family",
+        "host_artifact",
+    ]).optional().describe("Optional. When set, narrows the resource catalog to full-detail entries relevant to that IOC type. " +
+        "Orthogonal to `topic` (which selects the prose): `topic` picks guidance, `ioc_type` picks catalog rows."),
+});
+export const checkBehaviorPrerequisitesSchema = z.object({
+    file: z.string().describe("Filename relative to the samples directory, or an absolute path in local mode."),
+    behavior: z.string().optional().describe("Behavior to check (omit to scan ALL known behaviors). One of: clipboard_hijacking, http_c2_wininet, " +
+        "winhttp_c2, socket_c2, process_injection_remote, process_injection_self, registry_persistence_run, " +
+        "lnk_persistence, browser_credential_theft, screen_capture, keylog_polling, keylog_hook, network_share_enum."),
+});
+export const verifyStringUsageSchema = z.object({
+    file: z.string().describe("Filename relative to the samples directory, or an absolute path in local mode."),
+    query: z.string().describe("The string (or substring) to locate in the binary and cross-reference against code."),
+    depth: z.enum(["standard", "deep"]).optional().describe("Analysis depth: 'standard' (radare2 aa; aar — default) or 'deep' (aaa — slower, more thorough)."),
+    max_matches: z.number().optional().describe("Cap on the number of distinct matching strings to classify (default 50)."),
+});
+export const compareFilesSchema = z.object({
+    file_a: z.string().describe("First file (relative to the samples directory, or absolute in local mode)."),
+    file_b: z.string().describe("Second file to compare against file_a."),
+    depth: z.enum(["quick", "standard"]).optional().describe("'standard' (default) includes a capa capability diff (slower — runs capa on both files); 'quick' skips capa (imports/sections/compiler/entropy only)."),
 });
 //# sourceMappingURL=tools.js.map

package/dist/schemas/tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/schemas/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;IACrH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;IAC7I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;CAC7E,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CACrG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;CAChG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;IAC5G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6FAA6F,CAAC;IACvI,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;CACjJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mQAAmQ,CAAC;IACnS,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;IAChH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC;CACjH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CACpD,iFAAiF;QACjF,gGAAgG,CACjG;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IAC7F,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAClF,mLAAmL,CACpL;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAG7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAClF,uGAAuG,CACxG;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACtE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,sEAAsE,CACvE;IACD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,gDAAgD;QAChD,8DAA8D,CAC/D;IACD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAClE,8DAA8D;QAC9D,0EAA0E,CAC3E;IACD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CACvD,qDAAqD,CACtD;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACrC,uDAAuD,CACxD;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CACvB,mFAAmF,CACpF;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACvG,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sEAAsE,CAAC;CAC5I,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAGpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;QACZ,KAAK;QACL,UAAU;QACV,YAAY;QACZ,cAAc;QACd,iBAAiB;QACjB,eAAe;QACf,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,UAAU;KACX,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CACnC,4FAA4F;QAC5F,0FAA0F;QAC1F,kEAAkE,CACnE;CACF,CAAC,CAAC"}
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/schemas/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;IACrH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;IAC7I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;CAC7E,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CACrG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;CAChG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;IAC5G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6FAA6F,CAAC;IACvI,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;CACjJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mQAAmQ,CAAC;IACnS,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;IAChH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC;CACjH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CACpD,iFAAiF;QACjF,gGAAgG,CACjG;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IAC7F,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAClF,mLAAmL,CACpL;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAG7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAClF,uGAAuG,CACxG;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACtE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,sEAAsE,CACvE;IACD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,gDAAgD;QAChD,8DAA8D,CAC/D;IACD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAClE,8DAA8D;QAC9D,0EAA0E,CAC3E;IACD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CACvD,qDAAqD,CACtD;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACrC,uDAAuD,CACxD;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CACvB,mFAAmF,CACpF;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IACnG,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACvG,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sEAAsE,CAAC;CAC5I,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAGpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;QACZ,KAAK;QACL,UAAU;QACV,YAAY;QACZ,cAAc;QACd,iBAAiB;QACjB,eAAe;QACf,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CACnC,iGAAiG;QACjG,0FAA0F;QAC1F,mEAAmE;QACnE,2GAA2G;QAC3G,yGAAyG,CAC1G;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;QACZ,KAAK;QACL,YAAY;QACZ,UAAU;QACV,QAAQ;QACR,WAAW;KACZ,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CACnC,2GAA2G;QAC3G,uGAAuG;QACvG,yGAAyG;QACzG,4GAA4G;QAC5G,0EAA0E,CAC3E;IACD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;QACf,MAAM;QACN,KAAK;QACL,QAAQ;QACR,IAAI;QACJ,QAAQ;QACR,eAAe;KAChB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACpB,qGAAqG;QACrG,yGAAyG,CAC1G;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;IAC3G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,sGAAsG;QACtG,qGAAqG;QACrG,6GAA6G,CAC9G;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;IAC3G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qFAAqF,CAAC;IACjH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACrD,iGAAiG,CAClG;IACD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0EAA0E,CAAC;CACxH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4EAA4E,CAAC;IACzG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACrE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,uJAAuJ,CACxJ;CACF,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnux/mcp-server",
-  "version": "0.1.54",
+  "version": "0.1.56",
   "packageManager": "pnpm@10.33.0",
   "description": "MCP server for using the REMnux malware analysis toolkit via AI assistants",
   "type": "module",
@@ -36,6 +36,7 @@
     "!dist/__tests__/",
     "!dist/**/__tests__/",
     "data/tools-index.json",
+    "data/osint-resources.json",
     "README.md",
     "LICENSE"
   ],