NexusCore MCP

English | 한국어

NexusCore MCP is an advanced Model Context Protocol (MCP) server specifically designed for AI-driven dynamic malware analysis. It bridges the gap between Large Language Models (LLMs) like Claude/GPT-4 and low-level system instrumentation, enabling AI agents to actively debug, inspect, and analyze evasive malware in real-time.

Why NexusCore? Traditional sandboxes give you a static report. NexusCore allows an AI agent to interactively manipulate malware execution—bypassing anti-debugging checks (Themida/VMProtect) via Frida, dumping memory, and performing forensic triage on the fly.

📑 Table of Contents

• Architecture
• Features & Tools
• Prerequisites
• Quick Start
• AI Integration Guide
• Usage Examples
• Tool Reference
• Analysis Scenarios
• Troubleshooting
• Disclaimer

---

🏗️ Architecture

graph TD
    A["AI Agent (Claude/Cursor)"] -- "MCP Protocol (Stdio)" --> B["NexusCore MCP Server"]
    
    subgraph "Core Analysis Engine"
        B -- "Persistent DB" --> C[("Sled Cache / Job Queue")]
        B -- "Large Data" --> D["StreamManager (Dumps)"]
        B -- "Observability" --> E["OpenTelemetry (Jaeger)"]
    end
    
    subgraph "SOTA Analysis Tools"
        B -- "Micro-Emu" --> F["Unicorn Engine"]
        B -- "Ref Bridge" --> G["Ghidra/IDA/x64dbg"]
        B -- "Py Sandbox" --> H["AI Decryptor Tester"]
        B -- "Self-Correction" --> I["YARA Verifier"]
    end
    
    subgraph "Host OS (Virtualized)"
        B -- "Inject" --> J["Frida Engine (Stealth)"]
        B -- "API" --> K["External (DIE, Capa, PE-Sieve)"]
    end

---

🚀 Features & Tools

🌟 State-of-the-Art (SOTA) Capabilities

Tool	Description	Innovation
micro_emulate	Executes isolated code snippets/functions.	Zero-Execution Analysis
sync_reversing_data	Bridges AI findings directly to Ghidra/IDA.	Live Tool Sync
test_decryptor	Safe sandbox for AI-generated Python decryptors.	Custom Logic Reversing
verify_yara	Autonomously verifies YARA rules against samples.	Self-Correction Loop
read_memory_chunk	Handles GB-scale memory dumps in chunks.	Context Window Optimization

🛡️ Malware Triage & Dynamic Analysis

Tool	Description	Key Tech
spawn_process	Spawns process via Frida spawn, optionally injects stealth hooks. Use resume_process to continue.	Frida
api_monitor	Monitors Windows API calls (Registry, Network, Files).	Frida
dump_ssl_keys	Hooks libraries to dump keys for HTTPS decryption.	Frida
generate_yara	Auto-generates initial YARA signatures.	Native
scan_pe_sieve	Detects process hollowing and DLL injection.	PE-Sieve
die_scan / capa_scan	High-speed static analysis with Sled caching.	DIE / CAPA

🔧 Session-Based Debugging (src/tools/malware/debug/)

Tool	Description
session_start	Start persistent cdb.exe debug session (headless).
session_command	Send single command to active session.
session_batch	Send multiple commands at once.
session_end	Terminate debug session.
debug_help	Common cdb.exe command reference.

🔗 Frida Session Management (src/tools/common/frida_session.rs)

| Tool | Description

... View full README on GitHub