AI-Assisted Security Analysis: REMnux and Kali MCP Servers

• AI-Assisted Security Analysis: REMnux and Kali MCP Servers
  • REMnux MCP Server
    • Prerequisites
    • Architecture
    • Installation and Configuration
      • Scenario 1: Docker (recommended for local labs)
      • Scenario 1: SSH to a REMnux VM
      • Scenario 2: Local (Claude Code running on REMnux)
      • Scenario 3: HTTP Transport
      • CLI Flag Reference
    • Available Tools
    • Example Claude Prompts — REMnux Workflows
  • Kali MCP Server
    • Prerequisites
    • Installation on Kali
    • Starting the Server
    • Connecting Claude Code
      • Local connection (client and server on the same machine)
      • Remote connection via SSH tunnel (recommended for VM setups)
      • Claude Code settings.json
    • Available Tools
    • Example Claude Prompts — Kali Workflows
  • Using Both Servers Together
    • Combined Workflow: Recon to Malware Analysis
    • Combined Workflow: Malware-Dropped Infrastructure
  • Best Practices
    • Authorization and Scope
    • Isolation and Disposability
    • Prompt Injection Risk
    • Data Handling and AI Providers
    • Snapshot Discipline
  • Troubleshooting
    • REMnux MCP Server
    • Kali MCP Server
  • Further Reading

Model Context Protocol (MCP) servers let Claude Code (and other AI assistants) call tools directly — instead of you copying command output into a chat window, Claude invokes the tool, reads the output, chains the next tool, and synthesizes findings, all within one session. Two MCP servers are particularly relevant to this course:

• REMnux MCP Server (@remnux/mcp-server) — purpose-built for malware analysis; encodes domain expertise about 200+ REMnux tools, selects appropriate tools by file type, extracts IOCs, and mitigates confirmation bias in AI verdicts.
• MCP Kali Server (Wh0am123/MCP-Kali-Server) — a lightweight bridge that exposes a running Kali Linux instance to any MCP client, enabling AI-assisted penetration testing, recon, and CTF work.

These two servers have fundamentally different orientations: REMnux is defensive/analytical (what does this artifact do?), while Kali is offensive/operational (what can I do to a target?). Together they cover a common real-world workflow: discover and capture artifacts with Kali, then analyze them on REMnux.

This page covers setup, configuration, tool references, and combined workflows for both. The separate REMnux MCP Server page covers the REMnux server in additional depth.

REMnux MCP Server

Prerequisites

• A working REMnux installation (see REMnux Install)
• Node.js >= 18 on the machine where the MCP server process will run
• Claude Code installed (workstation or directly on REMnux)
• Docker (for container mode) or SSH access (for VM mode)

Architecture

The REMnux MCP server supports three deployment scenarios. Choose the one that matches your lab configuration.

Scenario 1 — Server on your workstation, REMnux as Docker or VM

The MCP server runs on your analysis machine and reaches into a separate REMnux environment via Docker exec or SSH. Your AI tool talks to the server locally over stdio.

Scenario 2 — Everything on REMnux

Claude Code (or OpenCode) runs directly inside the REMnux VM. The MCP server runs on the same host via stdio. No network hop; simplest possible configuration. REMnux v8 ships with OpenCode and the MCP server pre-configured for this mode.

Scenario 3 — MCP server inside REMnux, AI tool connects over HTTP

The MCP server starts with HTTP transport inside REMnux. Your workstation’s Claude Code connects over the network. Useful when REMnux is a self-contained lab VM you want to keep isolated from your workstation filesystem.

Installation and Configuration

Scenario 1: Docker (recommended for local labs)

# Pull the REMnux container image
docker pull remnux/remnux-distro:noble

# Start the container
docker run -d --name remnux remnux/remnux-distro:noble

# Register the MCP server with Claude Code
claude mcp add remnux -- npx @remnux/mcp-server --mode=docker --container=remnux

Add to .claude/settings.json (or the user-level ~/.claude/settings.json):

{
  "mcpServers": {
    "remnux": {
      "command": "npx",
      "args": ["@remnux/mcp-server", "--mode=docker", "--container=remnux"]
    }
  }
}

Scenario 1: SSH to a REMnux VM

# Key-based authentication (preferred — ensure key is loaded in ssh-agent)
claude mcp add remnux -- npx @remnux/mcp-server \
  --mode=ssh --host=YOUR_VM_IP --user=remnux

# Password authentication
claude mcp add remnux -- npx @remnux/mcp-server \
  --mode=ssh --host=YOUR_VM_IP --user=remnux --password=malware

JSON config equivalent:

{
  "mcpServers": {
    "remnux": {
      "command": "npx",
      "args": [
        "@remnux/mcp-server",
        "--mode=ssh",
        "--host=YOUR_VM_IP",
        "--user=remnux",
        "--password=malware"
      ]
    }
  }
}

Scenario 2: Local (Claude Code running on REMnux)

{
  "mcpServers": {
    "remnux": {
      "command": "remnux-mcp-server"
    }
  }
}

No additional flags are needed. local mode and stdio transport are both defaults.

Scenario 3: HTTP Transport

On REMnux, start the server:

export MCP_TOKEN=$(openssl rand -hex 32)
echo "Token: $MCP_TOKEN"    # save this — you will need it on the client
remnux-mcp-server --mode=local --transport=http --http-host=0.0.0.0

On your workstation, add to settings.json:

{
  "mcpServers": {
    "remnux": {
      "type": "streamable-http",
      "url": "http://REMNUX_IP:3000/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN"
      }
    }
  }
}

Or register via the CLI:

claude mcp add remnux --transport http http://REMNUX_IP:3000/mcp \
  --header "Authorization: Bearer YOUR_TOKEN"

CLI Flag Reference

Available Tools

Example Claude Prompts — REMnux Workflows

Initial triage of an unknown sample:

Upload /path/to/unknown.bin to REMnux and perform a quick triage.
I want: file type, packing indicators, notable strings, and any network IOCs.

Review the tool plan before running anything:

What tools should I use to analyze invoice.docx on REMnux?
Don't run anything yet — show me the plan and explain each tool's purpose.

Deep analysis of a Windows PE:

Perform a deep analysis of malware.exe. I want:
1. PE header details and section entropy
2. Import table with anything suspicious flagged
3. Strings including stack strings via FLOSS
4. Capability detection via capa
5. A summary of likely malware family or behavior category

Run a specific piped command:

Run: zipdump.py -s 3 -d invoice.docx | xmldump.py pretty
Look for embedded scripts, URLs, or encoded payloads in the output.

Extract and format IOCs after analysis:

Take the output from the last analysis session and extract all indicators of
compromise. Format as a table with columns: type, value, confidence, source tool.

Analyze a downloaded sample:

Download the file at https://malshare.com/sample.php?action=getfile&hash=<sha256>
and perform a standard analysis. Start with file identification and hashing.

Kali MCP Server

The community Kali MCP server with the most active maintenance and broadest adoption is MCP-Kali-Server by Wh0am123 (GitHub: Wh0am123/MCP-Kali-Server). It is also available as an official Kali package (mcp-kali-server), which makes installation trivial.

Unlike the REMnux server — which is purpose-built with deep domain knowledge about specific tools — the Kali server is a general command-execution bridge. It exposes a Flask-based HTTP API on port 5000 that accepts any terminal command. Named-tool wrappers for common penetration testing tools are included, but the server’s real power is that Claude can construct and run arbitrary shell commands on a live Kali instance.

Prerequisites

• A running Kali Linux instance (VM, container, cloud instance, or bare metal)
• Python 3 on the Kali machine
• Claude Code on your workstation (or on the Kali machine itself)
• Network connectivity between the MCP client machine and the Kali machine (or SSH access for tunneling)

Installation on Kali

From the official Kali package repository (recommended):

sudo apt update
sudo apt install mcp-kali-server

From source:

git clone https://github.com/Wh0am123/MCP-Kali-Server.git
cd MCP-Kali-Server
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

Starting the Server

# Default: bind to localhost only (secure)
kali-server-mcp
# or from source:
./server.py

# Bind to a specific IP (for remote access via SSH tunnel)
./server.py --ip 127.0.0.1 --port 5000

# Debug mode (verbose logging)
./server.py --debug

Do not bind the server to 0.0.0.0 without a firewall or VPN. The server has no authentication layer. Anyone who can reach port 5000 can execute arbitrary commands as the Kali user.

Connecting Claude Code

Local connection (client and server on the same machine)

kali-server-mcp --server http://127.0.0.1:5000
# or from source:
./client.py --server http://127.0.0.1:5000

Remote connection via SSH tunnel (recommended for VM setups)

# Terminal 1 — keep open
ssh -L 5000:localhost:5000 kali@KALI_VM_IP

# Terminal 2 — run the client or Claude Code
./client.py --server http://127.0.0.1:5000

Claude Code settings.json

{
  "mcpServers": {
    "kali": {
      "command": "python3",
      "args": [
        "/absolute/path/to/MCP-Kali-Server/client.py",
        "--server",
        "http://127.0.0.1:5000/"
      ],
      "timeout": 300
    }
  }
}

If you installed from the Kali package, replace the python3 command with the installed binary (typically /usr/bin/kali-server-mcp).

Available Tools

Because execute_command is available, Claude is not limited to this list. Any tool installed on Kali — ffuf, nuclei, crackmapexec, impacket, responder, volatility, etc. — is accessible.

Example Claude Prompts — Kali Workflows

Reconnaissance on a lab target:

Run an nmap service version scan against 10.0.0.5, ports 1–10000.
Summarize open services and flag anything that looks interesting.

Directory enumeration:

Use gobuster to enumerate directories on http://10.0.0.5/ using the
/usr/share/wordlists/dirb/common.txt wordlist. List anything that returns
a 200 or 301 status code.

Web vulnerability assessment:

Run nikto against http://10.0.0.5 and summarize any high-severity findings.
Then check if the login page at /wp-login.php is WordPress and run wpscan.

Password cracking:

I have a hash file at /root/hashes.txt in NTLM format.
Run john with the rockyou wordlist and show me any cracked passwords.

CTF web challenge:

I'm working on a CTF web challenge at http://challenge.example.com.
Start with a directory scan, then check for SQL injection on the login form,
and look for any exposed sensitive files. Report what you find step by step.

Post-exploitation enumeration:

I have shell access on 10.0.0.5. Run local enumeration: users, network
interfaces, running services, and check for common privilege escalation vectors.

Using Both Servers Together

The most powerful workflows combine both servers in a single Claude Code session. Configure both in settings.json:

{
  "mcpServers": {
    "remnux": {
      "command": "npx",
      "args": ["@remnux/mcp-server", "--mode=docker", "--container=remnux"]
    },
    "kali": {
      "command": "python3",
      "args": [
        "/absolute/path/to/MCP-Kali-Server/client.py",
        "--server",
        "http://127.0.0.1:5000/"
      ],
      "timeout": 300
    }
  }
}

Claude Code will have access to both tool sets simultaneously and can reference them naturally in the same session.

Combined Workflow: Recon to Malware Analysis

A common scenario: enumerate a target, recover a dropped payload, then analyze it statically before dynamic analysis.

Step 1 — Network recon (Kali):

Use nmap to do a full service scan of 10.0.0.50.
Then run gobuster against any HTTP services you find.
Summarize what's exposed.

Step 2 — Retrieve an artifact (Kali):

The web server at http://10.0.0.50:8080 has a directory traversal.
Use it to download /var/www/update.sh to /root/loot/update.sh.

Step 3 — Transfer to REMnux and analyze (REMnux):

Upload /root/loot/update.sh to REMnux and perform a standard analysis.
Is this malicious? Extract any IOCs.

Note: The Kali and REMnux servers share no filesystem. Use upload_from_host to bring files from your workstation into REMnux. If the file was downloaded to Kali, scp it to your workstation first, then upload it to REMnux from there.

Step 4 — Cross-reference IOCs:

Take the IOCs extracted from update.sh and check whether any of those IPs or
domains appeared in the nmap scan results. Build a connection map.

Combined Workflow: Malware-Dropped Infrastructure

Reverse direction: analyze a malware sample to extract C2 infrastructure, then probe that infrastructure with Kali.

Step 1 — Analyze malware sample (REMnux):

Perform a deep analysis of /samples/rat.exe.
Extract all network IOCs — IPs, domains, ports.

Step 2 — Probe extracted infrastructure (Kali):

The malware analysis found these C2 candidates: 185.220.101.45:443 and
cdn-update[.]net. Using Kali, check if port 443 is open on that IP,
grab the TLS certificate, and run a basic nmap service fingerprint.
Do not make active connections beyond passive scanning.

Step 3 — Correlate findings:

Compare the TLS certificate subject names and the domain from the malware IOCs.
Do they belong to the same infrastructure? Summarize your confidence.

Best Practices

Authorization and Scope

The Kali MCP server executes commands as your Kali user without additional access controls. Claude can run anything the Kali user can — including active network exploitation, lateral movement tools, and data exfiltration commands.

• Only use the Kali server against systems you own or have explicit written authorization to test. This applies whether commands come from your keyboard or from Claude.
• For CTF work, scope is defined by the competition rules. For lab work, scope is the lab network only.
• Never configure the Kali server to bind on a public interface without firewalling. The server has no authentication.

Isolation and Disposability

• Run REMnux as a snapshot-restored VM or a freshly started Docker container. Take a clean snapshot before each session; restore or rebuild after.
• Run Kali in a VM or container, not on your primary workstation. The execute_command tool is effectively a remote code execution interface — treat it accordingly.
• Keep Kali and REMnux on an isolated lab network segment, not on your production LAN.
• Never save malware samples on your host filesystem outside of a dedicated, isolated directory.

Prompt Injection Risk

Malware routinely embeds strings designed to manipulate automated analysis systems. When strings, run_tool, or any output-returning tool extracts these from a sample, Claude reads them as text. The REMnux MCP server delivers instructions at handshake to treat all tool output as untrusted, and analyze_file wraps findings in neutral framing to reduce confirmation bias. These are mitigations, not guarantees.

In practice:

• Review raw tool output, not just Claude’s summary. The summary is a starting point.
• If Claude’s conclusions seem inconsistent with what the tools reported, check for injected strings in the tool output.
• Treat unexpected AI behavior during analysis as an indicator of prompt injection — which is itself analytically interesting.
• For high-confidence verdicts, always verify against at least two independent tools.

Data Handling and AI Providers

When Claude analyzes files or runs commands via either server:

• REMnux: The binary sample stays on REMnux. Text output — strings, IOC lists, behavioral reports — travels to the AI provider as part of your session.
• Kali: Command output (scan results, password dumps, network captures) also travels to the AI provider.

For samples or targets involving victim data, sensitive infrastructure, or proprietary information, evaluate your organization’s data handling requirements before using any cloud-hosted model. For offline or air-gapped analysis, use local mode with a self-hosted model via OpenCode and a local Ollama instance.

Lenny Zeltser’s guidance applies: “Choose an AI provider whose data handling policies you trust” when working with sensitive material.

Snapshot Discipline

1. Take a clean snapshot of REMnux before any analysis session.
2. Take a clean snapshot of Kali before any engagement.
3. Restore (or rebuild) after each session.
4. Never reuse an analysis VM across different samples or targets without restoring to a known-clean state.

Troubleshooting

REMnux MCP Server

Debug connectivity:

# Docker
docker exec remnux echo "connection ok"

# SSH
ssh remnux@YOUR_VM_IP echo "connection ok"

# Verify core tools
docker exec remnux which capa floss olevba

Kali MCP Server

Test Kali server connectivity:

# Health check
curl -s http://127.0.0.1:5000/ | python3 -m json.tool

# Verify a tool is reachable
curl -s -X POST http://127.0.0.1:5000/execute \
  -H "Content-Type: application/json" \
  -d '{"command": "nmap --version"}'

Further Reading

• REMnux MCP Server — GitHub
• MCP Kali Server — GitHub
• REMnux documentation — Using AI
• Lenny Zeltser. “Using AI Agents to Analyze Malware on REMnux.”
• Model Context Protocol specification
• REMnux install guide
• REMnux MCP Server deep dive