An AI-Powered Malware Detection Framework with MCP Integration
A research malware triage framework built around the Model Context Protocol that combines static analysis, reverse engineering, threat-intelligence lookups, optional sandbox detonation, SHAP-based explainability and a multi-agent reporting pipeline, focused on Windows PE files.
This is an MCP-based malware analysis server for research-oriented triage, combining local static analysis, reverse engineering, threat-intelligence lookups, optional sandbox detonation, SHAP explainability, HybridRAG knowledge retrieval and a multi-agent reporting pipeline. It targets Windows malware triage, especially PE files, with reverse-engineering paths that also handle Python-packaged, .NET, Go, Rust and native binaries, though the machine-learning classifier and SHAP explanation path currently accept only Windows PE and .NET files.
Its explainability contribution is framed as an analyst-support layer rather than a standalone verdict: a feature extractor replays feature hashing so SHAP feature indices can be traced back to specific imports, APIs, sections, exports and Rich Header artifacts, the analyst report separates actionable leads from weak metadata-only correlations, and each piece of evidence carries a trace confidence, an analyst utility note and verification steps rather than being treated as confirmed behavior.
An actively evolving graduation-thesis and research prototype, useful for assisted triage, evidence collection, report drafting and CTF-style reverse engineering, but not intended as a sole source of truth for enterprise incident response. Built with Python. GPL-3.0 licensed.