← MCP servers · cyb3rmx
Qu1cksc0pe
BLOCKgrade F · trust 40/100Overview
From the repository's own README, as read at the audited commit.
# Qu1cksc0pe<a href="https://www.buymeacoffee.com/cyb3rmx"><img src="https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png" height="40px"></a><br><br><img src="https://img.shields.io/badge/-Linux-black?style=for-the-badge&logo=Linux&logoColor=white"> <img src="https://img.shields.io/badge/-Python-black?style=for-the-badge&logo=python&logoColor=white"> <img src="https://img.shields.io/badge/-Terminal-black?style=for-the-badge&logo=GNU%20Bash&logoColor=white"> <img src="https://img.shields.io/badge/-GPL%203.0-black?style=for-the-badge&Color=white"><p align="center"> <img width="400" src="https://user-images.githubusercontent.com/42123683/216772963-0b035e5a-c9db-4a6e-ac32-ebca22921405.png" alt="logo"></p><br>All-in-One malware analysis tool for analyze many file types, from Windows binaries to E-Mail files.<br>*You can get*: - What DLL files are used.- Functions and APIs.- Sections and segments.- URLs, IP addresses and emails.- Android permissions (Dangerous/Special/Info).- MITRE ATT&CK mappings (Windows + Linux static analysis).- File extensions and their names.- Embedded executables/exploits.<br><b>And so on...</b><br>Qu1cksc0pe aims to get even more information about suspicious files and helps user realize what that file is capable of.# Qu1cksc0pe Can Analyze Currently| Files | Analysis Type || :--- | :--- || Windows Executables (.exe, .dll, .msi, .bin) | Static, Dynamic || Linux Executables (.elf, .bin) | Static, Dynamic || MacOS Executables (mach-o) | Static || Android Files (.apk, .jar, .dex) | Static, Dynamic(for now .apk only) || Golang Binaries (Linux) | Static || Document Files | Static; sandboxed VBA behavior emulation when macros are present || VBScript/VBA Family (.vbs, .vbe, .vba, .vb, .bas, .cls, .frm) | Static + sandboxed behavior emulation (`--docs`) || AppleScript Source (.applescript, including content detected under misleading VB-family extensions) | Static (`--analyze`) || HTML Documents (.html, .htm) | Static + isolated inline Ja
Exposed tools (14) 11 read · 3 write · 0 destructive
| Tool | Risk | Description |
|---|---|---|
analyze_archive | read | Analyze an archive file (.zip, .rar, .ace, ...): lists contents and scans nested files for IOCs/YARA matches. |
analyze_document | read | Analyze a document/macro/VBScript-family file (.doc*, .xls*, .vbs, .vbe, .vba, .vb, .bas, .cls, .frm, ...). |
analyze_file | read | Auto-detect a file |
check_resources | read | Extract and inspect a PE file |
check_signatures | read | Scan a file for embedded/carved file signatures (e.g. an EXE hidden inside another file type). |
configure_ai_api_key | write | Save an API key for one of the cloud AI providers used by ai_provider on the analysis tools. |
configure_virustotal_api_key | write | Save a VirusTotal API key for use by scan_virustotal (equivalent to `qu1cksc0pe.py --key_init --key_provider virustotal`). |
detect_language | read | Fingerprint the programming language(s) used to build a binary. |
detect_packer | read | Check whether a binary (or every file in a folder) is packed with a known packer. |
extract_iocs | read | Extract URLs, IP addresses and email addresses embedded in a file. |
list_supported_file_types | read | List the file types Qu1cksc0pe recognizes and which tool to use for each. Call this first if unsure which tool applies to a file. |
scan_hash | read | Look up a file |
scan_virustotal | read | Look up a file |
update_hash_database | write | Download/refresh Qu1cksc0pe |
Details
- Source
- cyb3rmx/qu1cksc0pe
- Transports
- streamable-http
- Credentials it reads
SC0PE_AI_INTERESTING_PATTERNS_MAX_KEYSSC0PE_WEB_SECRET- License
- GPL-3.0
- Stars
- 2,056 · pushed 10d ago
Trust audit
Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | WARN |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (15 observation(s))
- Network
- declared (20 observation(s))
- Shell
- declared (10 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94
Modules/pcap_analyzer.py:500
unhexlify( ... os.system(
Why it matters. decodes a payload and executes it
HIGHInventory / provenance · inv.suspicious_name · CWE-1104
Systems/Android/YaraRules/backdoor.yara
backdoor.yara
Why it matters. member named after an attack tool
Fix. remove or justify
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
Modules/apple_analyzer.py:142
rb"\.ssh/", rb"id_rsa", rb"authorized_keys", rb"/root/",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
Systems/Linux/linux_func_categories.json:487
"~/.ssh/authorized_keys",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
Systems/Linux/linux_func_categories.json:488
"authorized_keys",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
Systems/Linux/mitre_for_linux.json:198
"~/.ssh/authorized_keys",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
Systems/Linux/mitre_for_linux.json:199
"authorized_keys",
Why it matters. touches a credential store
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
Dockerfile:7
RUN apt update && apt install -y curl wget git binutils sudo unzip python3 python3-pip default-jre file
Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
Modules/analysis/linux/linux_emulator.py:369
print(f"{infoS} Add your user to docker group or use sudo for Docker-based emulation.")Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
Modules/apkAnalyzer.py:549
print(f"{infoS} Install Java (example): [bold green]sudo apt-get install default-jre-headless[white]")Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
Modules/apple_analyzer.py:136
rb"sudo ", rb"/usr/bin/sudo", rb"chmod +s", rb"chown root",
Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
Modules/document_analyzer.py:168
print("Try 'sudo -H pip3 install -U oletools' command.")Why it matters. asks for elevated privileges
MEDIUMInventory / provenance · inv.binary · CWE-1104
Systems/Windows/windows_debug_signatures
windows_debug_signatures
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
Modules/analysis/multiple/smart_analyzer.py:526
"powershell", "cmd.exe", "wscript", "cscript", "rundll32", "reg.exe", "schtasks",
MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
Modules/analysis/multiple/smart_analyzer.py:594
"execution": ("cmd.exe", "powershell", "wscript", "cscript", "rundll32", "mshta", "regsvr32", "schtasks", "shell.run"),MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
Modules/analysis/multiple/smart_analyzer.py:596
"persistence": ("currentversion\\run", "runonce", "startup", "schtasks", "service"),MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
Modules/analysis/multiple/smart_analyzer.py:1114
"rundll32", "reg", "reg.exe", "schtasks", "schtasks.exe", "mshta", "mshta.exe",
MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
Modules/apple_analyzer.py:133
rb"com.apple.launchd", rb"crontab",
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
Modules/apple_analyzer.py:131
rb"/Library/LaunchDaemons/", rb"/Library/LaunchAgents/",
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
Modules/apple_analyzer.py:141
rb"/etc/passwd", rb"/private/etc/sudoers",
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
Modules/apple_analyzer.py:142
rb"\.ssh/", rb"id_rsa", rb"authorized_keys", rb"/root/",
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
Modules/installer.sh:18
CONF_FILE="/etc/qu1cksc0pe.conf"
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
Systems/Linux/linux_func_categories.json:396
"/etc/passwd",
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
Modules/vba_emulator/builtins_funcs.py:711
# enumerating files to exfiltrate/tamper with.
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
Modules/vba_emulator/scoring.py:173
# direct network calls from the VBA layer -- the actual C2/exfil
Gates applied: critical_finding, no_behavioural_pass.
Audited 2026-09-12 · audit v0.1.0 · source sha 66e037a7b48f · full audit: observations/trust-audit/mcp-server/cyb3rmx__qu1cksc0pe.json · Report an issue or request a re-scan
Audit history
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-12 | 66e037a7b48f | BLOCK | F | 40 | first audit |
Also audited
Servers with a similar trust profile.
Questions
What tools does Qu1cksc0pe expose?
14 in total: 11 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Qu1cksc0pe safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (40/100) and found 12 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Qu1cksc0pe need?
It reads SC0PE_AI_INTERESTING_PATTERNS_MAX_KEYS and SC0PE_WEB_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Qu1cksc0pe run?
It speaks streamable-http, so it runs as a service you connect to over the network.
How current is this page?
The grade is for one exact copy of the source (66e037a7b48f), read on 2026-09-12. The repository is watched and re-audited when it changes.
Provenance: OBSERVED · read 2026-09-12 · job trust-audit-2026-09-12