A Model Context Protocol (MCP) server that gives AI agents live, stateful Windows RPC attack-surface research, built on James Forshaw's NtObjectManager (NtCoreLib).
Stateful Windows RPC Research MCP — 2024–2026 CVE methodologies as one-click tools
A Model Context Protocol server that gives an AI agent live, stateful access to Windows RPC attack-surface research, built on James Forshaw's NtObjectManager (NtCoreLib).
Three things a generic PowerShell MCP cannot do — and the reason this exists:
1. Stateful RPC connections — a persistent PowerShell engine keeps parsed RpcServer objects and connected RPC clients alive across tool calls: rpcconnect once, rpccall many times (auth handshakes, context-handle chains, session variables survive). 2. CVE methodology as fixed tools — the standard hunting workflows from 2024–2026 public research are one-click, not prompt-engineering. 3. Stateful execution inside a lab VM — the same one-engine principle applied in the guest: rpcvmexec keeps variables and connected RPC clients alive across calls through a single persistent guest runspace, never a fresh shell per call (the vmrun fallback is reported as stateful: false).
Tool Purpose --------------- rpcparse(file, symbolpath?) Parse a PE for RPC servers, cache (keys fileN) rpcstate() Cached servers + live sessions rpcgetinterface(key) Procedures, NDR params, context handles, strictness rpcqueryendpoints(ifid?, searchbinding?, findalpcport?) EPM query (local or remote) rpcrunningservers(pid?/service?) Live process/service enumeration rpcconnect(session, key, binding?, auth?) Generate + connect client (stateful) rpcmethods(session) Signatures with opnum mapping rpccall(session, method, argsjson, storeas?) Reflection invoke; {"var"} passes stored object
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/lupingQAQ--ntobjmanager-mcp.html)
面向可信个人开发机的 MCP 编程运行时：Agent Transport、Windows Workbench、证据优先的项目连续性 | Personal-workstation MCP coding runtime
XiaoPuOuO/openchatx-mcpTurn ChatGPT into a local agent runtime. Operate your computer, use local tools, discover MCP servers, and delegate work to your own models through one MCP connection.
sgateway/s-gwLocal credential control for AI coding agents.
nettanvirdev/inertiainertia-ai: a desktop workspace for AI agents. Chat, built-in tools, MCP and OpenAPI integrations, Docker/Daytona sandboxes with a live desktop, routines and memory. Bring your own model and keys.
gignit/leap-mcpLeap gives any AI agent x-ray vision into desktop apps (native accessibility and screenshots) along with full mouse and keyboard control. It works in the background without taking over your screen, us
aksmfosef11/agent-seatGive your AI its own Windows desktop session while you keep using yours. Local viewer, CLI and MCP. Experimental preview for Windows 11.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.