PeMCP MCP Server

Arkana - Your entire malware analysis lab, behind one AI prompt. 250+ MCP tools for binary analysis with Claude Code or other MCP

What it actually does

From a single prompt, Arkana opens the binary, triages it (CRITICAL -- 43/72 VT detections), extracts the C2 server (cveutb.sa.com), identifies AES-256 encrypted communications via MessagePack, maps 12 MITRE ATT&CK techniques, detects anti-VM checks for VMware/VirtualBox/ Sandboxie, finds the persistence mechanism (Registry Run key), and recovers the operator's PDB path revealing a Vietnamese-speaking threat actor. See the full report.

• Session continuity — -- Notes, function renames, custom type definitions, and tool history survive context window limits and server restarts, enabling investigations that span hours or days without losing context
• SOC analysts — -- automated triage with risk scoring, MITRE mapping, and IOC extraction in seconds; web dashboard for visual review
• Malware reversers — -- natural language drives decompilation, symbolic execution, interactive debugging, and data transforms across multi-stage payloads
• Incident responders — -- rapid C2 config extraction, network indicators, and structured reports under time pressure
• Learners — -- built-in interactive RE tutor with Socratic guidance, progress tracking, and hands-on exercises using real tools
• Threat intel teams — -- automated similarity hashing, family identification, YARA rule generation, and cross-binary function matching

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.