Qu1cksc0pe

All-in-One malware analysis tool.

Generate Convert Improve

Install / Use

claude mcp add CYB3RMX -- npx -y github:CYB3RMX/Qu1cksc0pe

If the server publishes to npm under a different name, use that package instead — check the repo README.

About this skill

🔌

MCP Server

Model Context Protocol server

Quality Score

87/100

Skill content

View source on GitHub

Qu1cksc0pe

<img width="400" src="https://user-images.githubusercontent.com/42123683/216772963-0b035e5a-c9db-4a6e-ac32-ebca22921405.png" alt="logo"> All-in-One malware analysis tool for analyze many file types, from Windows binaries to E-Mail files.

You can get:

What DLL files are used.
Functions and APIs.
Sections and segments.
URLs, IP addresses and emails.
Android permissions (Dangerous/Special/Info).
MITRE ATT&CK mappings (Windows + Linux static analysis).
File extensions and their names.
Embedded executables/exploits. And so on...

Qu1cksc0pe aims to get even more information about suspicious files and helps user realize what that file is capable of.

Qu1cksc0pe Can Analyze Currently

MCP Server

Qu1cksc0pe ships an MCP server (Modules/mcp_server.py) that exposes its static-analysis features as tools for MCP-aware clients (Claude Code, Claude Desktop, etc.). It shells out to qu1cksc0pe.py the same way the Web UI does, so it needs no code changes to stay in sync with the CLI, and it only imports the mcp package itself at startup (the individual analyzers' own dependencies are only needed once a tool actually runs).

Install the extra dependency (already included in requirements.txt):

pip install "mcp>=2.0.0"

Launch it through the --mcp flag, same as every other Qu1cksc0pe command:

python3 qu1cksc0pe.py --mcp

Transport defaults to streamable-http (binds 127.0.0.1:8765/mcp), so the server is a persistent process any number of clients can attach to and detach from independently -- run it once in its own terminal, point clients at http://127.0.0.1:8765/mcp. Override with:

SC0PE_MCP_TRANSPORT=stdio python3 qu1cksc0pe.py --mcp   # traditional one-client-per-process model

A project-level .mcp.json is included so Claude Code picks the server up automatically for this repo. It pins stdio explicitly (via env), since Claude Code spawns and owns a fresh process per session rather than attaching to one you started yourself:

{
  "mcpServers": {
    "qu1cksc0pe": {
      "command": "python3",
      "args": ["qu1cksc0pe.py", "--mcp"],
      "env": { "SC0PE_MCP_TRANSPORT": "stdio" }
    }
  }
}

If python3 on your PATH isn't the interpreter with Qu1cksc0pe's dependencies installed (common on Windows, or with multiple Python installs), change command to the full path of the right python/python.exe, or run python3 -c "import mcp" first to check.

Tools: analyze_file, analyze_document, analyze_archive, detect_packer, detect_language, extract_iocs, check_resources, check_signatures, scan_hash, scan_virustotal, configure_virustotal_api_key, configure_ai_api_key, update_hash_database, list_supported_file_types. Each tool validates its input file/folder locally (rejecting files >= 50MB, since the CLI would otherwise prompt interactively) before invoking the CLI, and returns the resulting JSON report(s) plus captured console output. Interactive-only features (--watch dynamic analysis, --ui, --install) are intentionally not exposed as tools.

The five analysis tools that support ai=True also take an ai_provider argument ("auto"/"ollama" (default, local), "claude", "openai", "deepseek", "kimi", or "glm") -- see AI Analysis Providers below. Configure a cloud key first with configure_ai_api_key(provider="claude", api_key="...") (or whichever provider).

Logs: every tool call and CLI dispatch (command, duration, exit code, reports collected) is logged to stderr and to sc0pe_reports/mcp/mcp_server.log. Set SC0PE_MCP_LOG_LEVEL=DEBUG for full stderr output too, or SC0PE_MCP_LOG_FILE=0 to disable the file sink.

AI Analysis Providers

--ai (and the MCP tools' ai=True) summarizes a generated report with an LLM. Ollama (local) is the default; five cloud backends are also supported.

Ollama needs no key -- install Ollama and select the model via [Ollama] model in Systems/Multiple/multiple.conf. For a cloud provider, either set its env var above, or save a key through the interactive key manager:

python qu1cksc0pe.py --key_init
# >>> Qu1cksc0pe API Key Manager
#   1) VirusTotal
#   2) Claude (Anthropic)
#   3) OpenAI
#   4) DeepSeek
#   5) Kimi (Moonshot AI)
#   6) GLM (Zhipu AI)
#   0) Exit

--key_init --key_provider <name> (e.g. --key_provider claude) skips the menu and prompts for just that one key -- useful for scripts (this is what the MCP server's configure_ai_api_key/configure_virustotal_api_key tools do under the hood).

# Explicit provider selection (auto/ollama is the default -- no flag needed for local analysis)
python qu1cksc0pe.py --file suspicious_file --analyze --ai --ai_provider claude

The default (auto/unset) is unchanged from prior versions: Ollama, falling back to a heuristic summary if it's unavailable. Cloud providers are strictly opt-in -- report data is only sent off-machine if you explicitly pass --ai_provider <name> or set SC0PE_AI_PROVIDER. See the Environment Variables table for model/base-URL/timeout/token tuning per provider.

Usage

python qu1cksc0pe.py --file suspicious_file --analyze

# Launch Web UI
python3 qu1cksc0pe.py --ui

Screenshot

Updates

12/08/2026

[X] New feature: added an MCP server (--mcp, Modules/mcp_server.py, .mcp.json) exposing Qu1cksc0pe as tools for MCP clients like Claude Code, defaulting to streamable-http (persistent, multi-client; stdio/sse also available) with logging to stderr and sc0pe_reports/mcp/mcp_server.log (SC0PE_MCP_LOG_LEVEL/SC0PE_MCP_LOG_FILE). See the "MCP Server" section above.
[X] New feature: --ai now supports Claude, OpenAI, DeepSeek, Kimi, and GLM as alternative backends to Ollama via --ai_provider/SC0PE_AI_PROVIDER (or the MCP tools' ai_provider argument). Ollama stays the local-only default unless a cloud provider is explicitly selected; see "AI Analysis Providers" above.
[X] New feature: --key_init is now an interactive menu covering VirusTotal + all five AI providers instead of a single VirusTotal-only prompt. --key_init --key_provider <name> skips the menu for scripted use.
[X] Bug fix: --key_init saved (and could silently overwrite) an empty API key if you pressed Enter without typing anything. Empty input is now rejected.
[X] Bug fix: execute_module()'s os.system() call mis-quoted its command on Windows, silently breaking every analysis whenever the interpreter or project path contained a space.

Available On

Recommended Systems

[X] Parrot OS
[X] Kali Linux
[X] Windows 10 or 11

And also another Linux distributions like as Kali/Parrot

Setup and Installation

[!NOTE] If you encounter issues with the Python modules, creating a Python virtual environment (python_venv) should resolve them. For detailed setup and troubleshooting (dependencies, Docker usage, Windows notes), see the <a href="https://zread.ai/CYB3RMX/Qu1cksc0pe/1-overview">project overview documentation</a>. AI model selection is manual: set [Ollama] model in Systems/Multiple/multiple.conf to the exact model you want to use.

# First you need to clone Qu1cksc0pe with this command
git clone --depth 1 https://github.com/CYB3RMX/Qu1cksc0pe

# After cloning the repository YOU MUST create a python virtual environment (for handling python modules)
virtualenv -p python3 sc0pe_venv
source sc0pe_venv/bin/activate

# You can simply execute the following command it will do everything for you!
bash setup.sh
#
# setup.sh also installs required system tools (e.g. adb, strings, unzip, 7z) and sets up JADX.

# If you want to install Qu1cksc0pe on your system just execute the following commands.
python qu1cksc0pe.py --install # Optional

# To prevent interpreter errors after installation, use dos2unix.
dos2unix /usr/bin/qu1cksc0pe

# Or you can use Qu1cksc0pe from Docker!
docker build -t qu1cksc0pe .
docker run -it --rm -v $(pwd):/data qu1cksc0pe:latest --file /data/suspicious_file --analyze

# For Windows systems you need to execute the following command (Powershell)
# PS C:\Users\user\Desktop\Qu1cksc0pe> .\setup.ps1
#
# setup.ps1 handles winget dependency fallback, Python + 7-Zip setup,
# Sysinternals strings EULA acceptance, and resilient Ollama installation.
# If cloud model auth is needed, run:
# ollama signin
# ollama pull kimi-k2.5:cloud

Environment Variables

You can change some analyzer behaviors via environment variables (useful for CI, reproducibility, or controlling report size/timeouts).

Linux/macOS (bash/zsh) example

SC0PE_ANDROID_REPORT_DETAILED=1 python qu1cksc0pe.py --file app.apk --analyze --report

Windows (PowerShell) example

$env:SC0PE_ANDROID_REPORT_DETAILED="1"
python .\\qu1cksc0pe.py --file app.apk --analyze --report

| Variable | Default | What It Does | | :--- | :--- | :--- | | SC0PE_ANDROID_REPORT_DETAILED | 0 | Android analyzer JSON becomes more verbose (keeps larger fields and higher limits). Includes more details under resource_scan, and keeps large duplicat

Truncated for display — read the full file on GitHub.