JoasASantos/Malvex

AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server

About Malvex

Reverse engineer malware with agents, from packed droppers down to memory-resident payloads.

Malvex is a local-first orchestration harness that connects AI agents to 126 reverse-engineering and malware-analysis tools through MCP (Model Context Protocol). Point it at a binary, a memory dump, a document, or a packet capture. Malvex triages the sample, fans out parallel agents over IDA, Ghidra, radare2, Frida, volatility3, YARA, and dozens of other backends, and returns evidence-grounded findings — IOCs, MITRE ATT&CK mappings, detection rules, and attack-chain graphs — without uploading anything.

Analysis runs locally. Results include the evidence and limitations behind each conclusion.

Important rule: LLM output is not evidence. The model may propose hypotheses, likely function names, algorithm matches, or ATT&CK mappings. Malvex treats those as analyst leads until they are tied to static or runtime evidence.

Target What Malvex recovers Backends --------- Native binaries (PE, ELF, Mach-O, FAT) Pseudocode, call graphs, xrefs, imports, strings, resources, compiler/packer ID IDA, Ghidra, radare2, rizin, Binary Ninja, Cutter, otool, readelf, objdump, nm, lief Packed / obfuscated OEP recovery, unpacked payload, decoded strings, API hash resolution, de-virtualized control flow UPX, DIE, PEiD, capa, FLOSS, unicorn, angr, VMProtect/Themida stub analysis Memory dumps Injected regions, hollowed processes, decrypted config, loaded modules, handle tables, process trees volatility3, rekall, custom RWX scanners Documents (Office, PDF, RTF, HTA) Macros, embedded objects, exploit payload

From the project README.

Maintaining this server?

Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:

[![On MCP Radar](https://mcp.liqiwa.com/badge.svg)](https://mcp.liqiwa.com/s/JoasASantos--Malvex.html)

Related MCP servers