Skip to content
Conduit

mcp server

flarevm-mcp

MCP server bridging Kali and FlareVM for automated Windows malware analysis. 48 tools, 5 prompts, 5 resources, composite playbooks (triage, behavioral, unpack, persistence audit).

zixuantemp/flarevm-mcpcommunitylistedunreviewed
Use tool

Set up

Runs on your computer. Pick your agent and operating system.

Before you start

  • uv (`curl -LsSf https://astral.sh/uv/install.sh | sh`)
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "flarevm-mcp": {
      "command": "uvx",
      "args": [
        "flarevm-mcp"
      ]
    }
  }
}

same format Cursor, GitHub Copilot CLI, Junie, JetBrains AI Assistant, Augment (Auggie CLI), Factory Droid, Kiro, Devin CLI +12

Values in angle brackets are placeholders. Restart Claude Desktop after editing its config.Claude Desktop docs

README

synced Oct 21, 2026

FlareVM MCP Server

CI Tools Python License: MIT

An MCP server that lets an AI agent (Claude Code or any MCP client) drive an isolated, air-gapped FlareVM from a Linux analyst host. Static triage, detonation with monitoring, unpacking, debugging, Frida and IDA Pro — 52 tools behind one interface, with the malware never leaving the VM.

Claude / MCP client ──stdio──▶ flarevm-mcp (Kali) ──WinRM 5985──▶ FlareVM (Windows, no network)
                                        └──SMB KaliShare──▶  files > 8 KB
                                        └──HTTP JSON-RPC───▶  IDA :13337 · WinDbg :13338 (VM-local)

Quick start

git clone https://github.com/zixuantemp/flarevm-mcp.git && cd flarevm-mcp
pip install -e .            # deps: mcp, pywinrm, keyring, requests
python3 flarevm_setup.py            # stores the VM password in your keyring, enables WinRM + the
                            # SMB share on the VM, writes .env, prints the MCP client snippet

Then paste the printed snippet into ~/.claude.json (or a project .mcp.json) and run check_connection from your client. Prefer a manual route? See docs/INSTALLATION.md.

The only required setting is the VM address, FLAREVM_HOST — there is deliberately no default. Copy .env.example to .env or pass it in the client's env block. All settings: docs/CONFIGURATION.md.

Documentation

DocWhat it covers
docs/INSTALLATION.mdRequirements, install paths (setup script · pip · Docker), preparing the VM, registering the MCP client, verifying
docs/CONFIGURATION.mdEvery environment variable, .env, credentials, lab-network layout, FakeNet host protection
docs/USAGE.mdAnalysis workflows, the bundled prompts / resources / skills, safety rules
docs/TOOLS.mdReference for all 52 MCP tools
docs/TROUBLESHOOTING.mdSymptoms → causes → fixes
resources/tools-reference.mdThe Windows binaries the tools call on the VM, and their paths
SECURITY.mdThreat model, credential handling, reporting a vulnerability

MCP capabilities

  • 52 tools — connection & transfer, static analysis, monitoring & detonation, FakeNet, memory/injection scanning, unpacking, x64dbg/WinDbg, Frida, IDA Pro, and composite workflows.
  • 5 prompts — triage_unknown_sample, behavioral_analysis, unpack_workflow, injection_hunt, persistence_audit_report.
  • 5 resources — flarevm://tools/inventory, flarevm://config/fakenet-default, flarevm://docs/yara-rules, flarevm://docs/cheatsheet, flarevm://status/connection.
  • 3 Claude Code skills in skills/ — triage-malware-sample, incident-response-windows, automated-unpacking.

Security in one paragraph

The analyst host is trusted and never executes samples; the VM is hostile and assumed compromised after any detonation — snapshot before, revert after. WinRM uses NTLM (message-level encryption, no Basic auth) over HTTP, or HTTPS with certificate validation if you configure a listener; either way the VM sits on an isolated host-only network and port 5985/5986 must never be exposed beyond it. FakeNet's HostBlackList shields the analyst host's own control traffic. Every value sent to the VM is quoted, every result is hash-checked or wrapped as untrusted, and tampered tool binaries are refused. Full model: SECURITY.md.

Contributing

Issues and pull requests are welcome. CI runs import/registration checks, ruff, and bandit on every push; keep docs/TOOLS.md in sync when adding a tool (see the note at the end of that file).

License

MIT — © 2026 zixuantemp.

Hardening (1.2.0)

The tool assumes the VM is hostile. Highlights — details in SECURITY.md and docs/CONFIGURATION.md:

  • NTLM (or HTTPS) WinRM; SMB password never on a command line; no default credentials.
  • Every client value is quoted before it reaches PowerShell; VM output is sanitised and wrapped in an UNTRUSTED VM OUTPUT envelope so a sample's strings cannot pose as instructions.
  • verify_tools records SHA256s of the analysis binaries on a clean snapshot and blocks tools whose binary changed.
  • Staged scripts are hash-verified and deleted in the same PowerShell invocation; transfers are SHA256-verified both ways.
  • Circuit breaker + concurrency cap + output cap keep the server responsive when the VM hangs or floods.
  • vm_health / vm_snapshot report and restore VM state; detonation tools refuse a dirty VM unless acknowledged.
  • Kali-side path allow-lists for uploads and downloads.

After provisioning a clean snapshot run verify_tools(record=true) once, then revert to that snapshot.

↑↓ navigate openesc close