REMnux Documentation MCP Server

An MCP server that lets AI assistants search and retrieve REMnux documentation.

What Is This?

REMnux is a Linux toolkit for reverse-engineering and analyzing malicious software. This MCP server gives AI assistants direct access to REMnux documentation, so you can ask questions about malware analysis tools and get accurate, up-to-date answers.

What it enables:

• Search for tools by name, category, or functionality
• Retrieve detailed information about specific tools
• Answer questions about which REMnux tools to use for particular tasks

Your AI assistant queries the current documentation index rather than relying on potentially outdated training data.

Getting Started

To use this MCP server, add it to your AI tool's configuration. The server is publicly hosted and ready to use.

Claude Desktop

Add to your Claude Desktop configuration file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "remnux-docs": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://docs-mcp.remnux.org/sse"]
    }
  }
}

Claude Code (CLI)

claude mcp add remnux-docs --transport sse https://docs-mcp.remnux.org/sse

Cursor

Add to .cursor/mcp.json in your project or global settings:

{
  "mcpServers": {
    "remnux-docs": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://docs-mcp.remnux.org/sse"]
    }
  }
}

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "remnux-docs": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://docs-mcp.remnux.org/sse"]
    }
  }
}

Other MCP-Compatible Tools

For any MCP-compatible AI tool:

• Server URL: https://docs-mcp.remnux.org/sse
• Transport: SSE (Server-Sent Events)

Most tools connect via the mcp-remote npm package, which handles SSE transport.

Example Queries

Once connected, you can ask your AI assistant questions like:

• "What REMnux tools can I use to analyze a suspicious PDF?"
• "How do I extract strings from a malware sample using REMnux?"
• "What's the difference between peframe and pefile?"
• "Which tools in REMnux can deobfuscate JavaScript?"
• "What network analysis tools are available in REMnux?"

The AI will search the REMnux documentation and provide accurate, current information.

MCP Tools

The server exposes these tools to AI assistants:

Architecture

This server deploys cloudflare-mcp-for-static-sites, a reusable framework for adding MCP search to any static website. The framework runs on Cloudflare Workers, which simplifies building remote MCP servers by handling transport, authentication, and scaling.

┌─────────────────┐     MCP Protocol      ┌─────────────────────┐
│   AI Assistant  │◄────────────────────►│  Cloudflare Worker  │
│  (Claude, etc.) │        (SSE)          │  (MCP Server)       │
└─────────────────┘                       └──────────┬──────────┘
                                                     │
                                                     │ Reads
                                                     ▼
                                          ┌─────────────────────┐
                                          │   Cloudflare R2     │
                                          │  (Search Index)     │
                                          └─────────────────────┘
                                                     ▲
                                                     │ Generated from
                                                     │
                                          ┌─────────────────────┐
                                          │  REMnux salt-states │
                                          │  (Source of Truth)  │
                                          └─────────────────────┘

Components

Cloudflare Worker — Runs the MCP server at docs-mcp.remnux.org. Handles AI assistant requests using MCP over SSE (Server-Sent Events). Built with Cloudflare's Agents SDK and the McpAgent class in src/index.ts.

Cloudflare R2 — Object storage for the search index. The Worker caches the index in memory for 1 hour to reduce latency.

Search Engine — Powered by Fuse.js for fuzzy matching. Searches across tool names, descriptions, categories, and full content with weighted relevance scoring.

MCP Protocol — Model Context Protocol, an open standard for connecting AI assistants to external data sources.

Search Index Generation

The search index comes from the REMnux salt-states repository, the authoritative source for REMnux tool configurations and documentation.

The generation process:

1. The generate-mcp-index.py script in the salt-states CI directory parses tool metadata from the Salt state files
2. It extracts tool names, descriptions, categories, and documentation URLs
3. The script produces a JSON search index conforming to the schema in src/types.ts
4. The index is uploaded to the Cloudflare R2 bucket, where the Worker retrieves it

This process runs automatically during REMnux releases. The search index stays synchronized with official tool documentation.

Source Files

This repository contains the REMnux-specific deployment. The Worker code builds on cloudflare-mcp-for-static-sites.

Development

To run the MCP server locally:

# Install dependencies
bun install

# Start local development server
bun run dev

# Type checking
bun run type-check

# Format and lint
bun run format
bun run lint:fix

For local testing, you'll need a search-index.json file in your R2 bucket. You can generate one using the generate-mcp-index.py script from the salt-states repository.

Contributing

This project is part of the REMnux ecosystem.

• Bug reports and feature requests: Open an issue in this repository
• Code contributions: Submit a pull request with a clear description of changes
• Documentation improvements: PRs welcome for README or code comments

Before submitting code, run bun run type-check and bun run format to ensure consistency.