Built for red teamers, by red teamers — MCP-помощник для разработки вредоносных программ, тестирования OPSEC и разработки пользовательских загрузчиков во время участия красных команд.

MalDev Analyzer MCP разработан, чтобы помочь наступательным специалистам по безопасности и разработчикам вредоносных программ быстро оценить двоичные файлы Windows по признакам, которые могут повлиять на скрытность, функциональность или OPSEC. Независимо от того, создаете ли вы погрузчик, совершенствуете имплантат или проверяете позу безопасности полезной нагрузки, этот инструмент обеспечивает быструю, целевую информацию.

TL’DR: хотите перейти к установке? Перейдите в раздел «Предпосылки и быстрая установка».**

Ключевые особенности

MCP Integration — работает с протоколом Model Context для непосредственного взаимодействия с совместимыми помощниками ИИ, такими как Cursor. -Binary Trait Analysis - Идентификация шаблонов, распространенных в реальных вредоносных программах и инструментах красной команды. OPSEC Checks — особенности пятен, которые могут повысить риск обнаружения во время заданий. **Поддержка погрузчика ** - разработана с учетом рабочих процессов погрузчика.

#мотивация

Как красная команда, время - это роскошь.

MalDev Analyzer MCP

Built for red teamers, by red teamers - an MCP-powered assistant for malware development, OPSEC testing, and custom loader design during red team engagements.

MalDev Analyzer MCP is designed to help offensive security professionals and malware developers quickly evaluate Windows binaries for traits that may impact stealth, functionality, or OPSEC. Whether you’re building a loader, refining an implant, or validating payload security posture, this tool provides fast, targeted insights.

TL’DR: want to jump to installation? Go to Prerequisites & Quick Installation section.

✨ Key Features

• MCP Integration – Works with the Model Context Protocol to interact directly with compatible AI assistants like Cursor.
• Binary Trait Analysis – Identify patterns common in real-world malware and red team tooling.
• OPSEC Checks – Spot traits that could raise detection risk during engagements.
• Custom Loader Support – Designed with loader development workflows in mind.

Motivation

As a red-teamer, time is a luxury.
In real-world red team engagements, malware analysis and OPSEC checks often require juggling a patchwork of GUI tools — PE-Bear, Detect-It-Easy, Resource Hacker, YARA scanners, and more. Each demands manual clicks, constant context switching, and repetitive steps just to extract the handful of indicators you actually care about.

MalDev Analyzer MCP was built to eliminate that friction.
By embedding a full suite of PE inspection, loader analysis, and OPSEC heuristics directly into your MCP-compatible IDE (like Cursor or Claude’s MCP mode), you can query and analyze binaries without leaving your workflow.

With MalDev Analyzer MCP you can:

• Correlate IAT entries vs. runtime strings to uncover IAT hiding & dynamic API resolution.
• Classify sections using known baselines, flag anomalies, and detect packer indicators (e.g., .upx, .rsrc2, .textbss).
• Detect real-world malicious traits like AMSI/ETW patch patterns, C2 framework indicators, embedded shellcode, or encrypted blobs.
• …and much more.

By performing contextual scoring instead of raw dumping, you immediately know whether a finding is benign, suspicious, or likely malicious.

The goal: bridge the gap between generic PE analysis and practical OPSEC testing for loader and implant development - all inside an MCP workflow, without bouncing between multiple GUIs or command-line tools.

This means faster turnarounds, less human error, and more focus on developing and refining your custom loaders - not wrestling with a dozen disconnected tools.

🛠 Included Analysis Tools