@remnux/mcp-server 0.1.75 → 0.1.76

package/README.md

@@ -293,8 +293,8 @@ claude mcp add remnux --transport http http://REMNUX_IP:3000/mcp \
 | `findings` | The tool's parser resolved at least one finding |
 | `clean` | The tool's parser read the output and resolved nothing. A benign verdict needs other evidence |
 | `not_assessed` | No parser reads this tool's output, so the server did not interpret it. Its `key_lines` are raw excerpts |
-| `error` | The tool exited non-zero or reported its own failure (`tool_reported_error`), or its parser could not read the output (`parse_failed`) |
-| `timeout` | The tool exited non-zero and its output mentions a timeout |
+| `error` | The tool exited with a failure code (for most tools, any non-zero exit), reported its own failure (`tool_reported_error`), or its parser could not read the output (`parse_failed`) |
+| `timeout` | The tool exited with a failure code and its output mentions a timeout |
 
 *Compatibility note:* `not_assessed` is new. Tools without a parser used to report `clean`. A client that switches exhaustively over the status values needs a branch for it.
 
@@ -360,7 +360,7 @@ All three connection modes (docker, ssh, local) execute commands inside a dispos
 
 **Where `upload_from_host` reads from, and why it matters.** The relevant boundary is **connector mode (`local` vs `docker`/`ssh`), not transport**. In `local` mode (including HTTP transport with the local connector), the AI already has shell-level read on the REMnux box by design: `run_tool` executes arbitrary commands there, so `upload_from_host` reading a file outside the samples directory adds nothing beyond what the model already grants. In `docker`/`ssh` mode, `upload_from_host` is the one tool that reads from the machine where the server runs, the analyst's workstation, via `docker cp` or SFTP. That read happens outside the container/VM isolation that bounds everything else, so a prompt-injected client could stage a host file such as `~/.ssh/id_rsa` or `~/.aws/credentials` into REMnux. Enable `--sandbox` with `--ingest-root=<host staging dir>` to confine that read. In docker/ssh mode, `--ingest-root` is required when `--sandbox` is set, because the samples directory lives inside REMnux rather than on the host.
 
-**The server process is part of the trusted computing base.** Container/VM isolation is the boundary, and in docker/ssh mode this server is the control plane that mediates it: it runs on the analyst's workstation, outside that isolation, and it handles paths and filenames that originate inside REMnux. So the code that invokes `docker` is itself security-relevant, independent of anything the container can or cannot do. Every host-side `docker` call is therefore executed as an argument vector (`execFileSync`, no shell), which is what keeps a filename a filename. Building those calls as shell command strings was [GHSA-qp43-2vqh-w88w](https://github.com/REMnux/remnux-mcp-server/security/advisories/GHSA-qp43-2vqh-w88w): POSIX single-quote escaping is inert under `cmd.exe`, so on a Windows workstation a crafted filename reached by `download_file` became host command execution. The mitigation is removing the shell, not escaping better. Escaping is shell-specific and was silently wrong on one platform, and a filter strict enough to be safe under `cmd.exe` would have to reject characters that are legal in filenames analysts really encounter (`%VAR%` alone is expanded before metacharacters are parsed). Argument-vector execution makes the question moot: a filename stays a filename.
+**The server process is part of the trusted computing base.** Container/VM isolation is the boundary, and in docker/ssh mode this server is the control plane that mediates it: it runs on the analyst's workstation, outside that isolation, and it handles paths and filenames that originate inside REMnux. So the code that invokes `docker` is itself security-relevant, independent of anything the container can or cannot do. Every host-side `docker` call is therefore executed as an argument vector (`execFileSync`, no shell), which is what keeps a filename a filename. Before version 0.1.73, the server built its `docker cp` file-transfer calls as shell command strings. POSIX single-quote escaping is inert under `cmd.exe`, so on a Windows workstation a crafted filename reached by `download_file` became host command execution. The mitigation is removing the shell, not escaping better. Escaping is shell-specific and was silently wrong on one platform, and a filter strict enough to be safe under `cmd.exe` would have to reject characters that are legal in filenames analysts really encounter (`%VAR%` alone is expanded before metacharacters are parsed). Argument-vector execution makes the question moot: a filename stays a filename.
 
 **Other considerations:** A theoretical TOCTOU race exists between path validation and tool execution; container isolation is the primary mitigation (use immutable sample storage for high-security contexts). The `upload_from_host` confinement closes its own check-vs-read race by reading the realpath it validated. Tool description poisoning is mitigated by using build-time constants rather than runtime lookups from external sources.
 

package/data/tools-index.json

@@ -1,6 +1,6 @@
 {
   "version": "1.0.0",
-  "updated": "2026-08-21",
+  "updated": "2026-10-07",
   "tools": [
     {
       "command": "1768",
@@ -30,6 +30,13 @@
       "description": "Find 128-bit and 256-bit AES keys in a memory image.",
       "website": "https://citp.princeton.edu/our-work/memory/"
     },
+    {
+      "command": "aidebug",
+      "name": "AIDebug",
+      "category": "Statically Analyze Code: General",
+      "description": "AI-assisted malware reverse-engineering debugger with ATT&CK, YARA, IOC, JSON, and analyst report output.",
+      "website": "https://github.com/anpa1200/AIDebug"
+    },
     {
       "command": "androguard",
       "name": "androguard",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnux/mcp-server",
-  "version": "0.1.75",
+  "version": "0.1.76",
   "packageManager": "pnpm@10.33.0",
   "description": "MCP server for using the REMnux malware analysis toolkit via AI assistants",
   "type": "module",
@@ -52,7 +52,7 @@
     "node": ">=20.0.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "dockerode": "^5.0.1",
     "ioc-extractor": "^8.2.0",
     "ssh2": "^1.15.0",