Ntobjmanager Mcp

io.github.lupingQAQPublished by GitHub account lupingQAQv1.0.0Updated Oct 24, 2026

Stateful Windows RPC attack-surface research for AI agents: 22 tools on NtObjectManager.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A Windows-only MCP server that gives an AI assistant stateful tools for researching Windows RPC attack surfaces via NtObjectManager.

What you can do
Parse PE files for RPC servers, inspect interfaces, endpoints and running services, and keep parsed state across calls. Connect to RPC servers, list opnum-mapped methods, invoke methods with stored return objects, and disconnect sessions. Run PowerShell inside a lab VM through a persistent guest runspace. Apply fixed CVE-hunting workflows: context-handle scanning, attack-surface inventory, dry-run fuzzing, hijackable-interface discovery, ETW checks, ALPC security audits and flag decoding. Export generated C# client source, build NDR structs, squat ALPC ports and list user-startable tasks. Manage session variables and the parse cache, with every call logged to an audit file.
When to use it
For authorized Windows RPC security research and CVE methodology work on an isolated lab VM, where an assistant should keep live RPC sessions and parsed objects between steps instead of re-running one-off PowerShell. Not intended for production or daily-driver hosts.
Requirements
Runs locally as a Python stdio process on Windows PowerShell 5.1 (pwsh 7 untested). Needs the NtObjectManager PowerShell module installed and the Python mcp package. Some tools (ETW tracing, ALPC security descriptors) require administrator rights; VM tools need a configured lab VM.
Before you install
Tools invoke real RPC methods and can crash services, so use an isolated VM only. Several tools write or change system state: ALPC port squatting, VM listener deployment, fuzzing (dry-run by default) and method calls. ETW and ALPC audits need admin privileges. Every call is written to an audit log. Findings require responsible disclosure.

Installation

In SourceWeft

  1. Open Ntobjmanager Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

🛰️ NtObjectManager-MCP

Stateful Windows RPC Research MCP — 2024–2026 CVE methodologies as one-click tools

[Python] [License] [PowerShell] [MCP]

🌐 中文版

What is NtObjectManager-MCP?

A Model Context Protocol server that gives an AI agent live, stateful access to Windows RPC attack-surface research, built on James Forshaw's NtObjectManager (NtCoreLib).

Three things a generic PowerShell MCP cannot do — and the reason this exists:

  1. Stateful RPC connections — a persistent PowerShell engine keeps parsed RpcServer objects and connected RPC clients alive across tool calls: rpc_connect once, rpc_call many times (auth handshakes, context-handle chains, session variables survive).
  2. CVE methodology as fixed tools — the standard hunting workflows from 2024–2026 public research are one-click, not prompt-engineering.
  3. Stateful execution inside a lab VM — the same one-engine principle applied in the guest: rpc_vm_exec keeps variables and connected RPC clients alive across calls through a single persistent guest runspace, never a fresh shell per call (the vmrun fallback is reported as stateful: false).
┌────────────────────────────────────────────────────────────────────┐│  AI Agent (Claude Code / OpenCode / any MCP client)                ││      │  MCP (stdio, 24 tools)                                      ││      ▼                                                             ││  server.py ── snippets.py (PS templates, @@TOKEN@@ + ps_str escape)││      │                                                             ││      ▼                                                             ││  ps_engine.py ── persistent powershell.exe (base64 + __MCP_DONE__) ││      │            state: $RPCMCP = @{ Servers; Clients; vars }     ││      ▼                                                             ││  NtObjectManager / NtCoreLib  ──►  RPC runtime (ALPC / pipe / TCP) │└────────────────────────────────────────────────────────────────────┘

Tool Matrix (24)

Core stateful pipeline

ToolPurpose
rpc_parse(file, symbol_path?)Parse a PE for RPC servers, cache (keys file_N)
rpc_state()Cached servers + live sessions
rpc_get_interface(key)Procedures, NDR params, context handles, strictness
rpc_query_endpoints(ifid?, search_binding?, find_alpc_port?)EPM query (local or remote)
rpc_running_servers(pid?/service?)Live process/service enumeration
rpc_connect(session, key, binding?, auth?)Generate + connect client (stateful)
rpc_methods(session)Signatures with opnum mapping
rpc_call(session, method, args_json, store_as?)Reflection invoke; {"__var__"} passes stored objects
rpc_disconnect(session)Drop session

VM lab bridge (stateful guest execution)

ToolPurpose
rpc_vm_exec(ps, timeout?, vm?)Run PowerShell inside a lab VM; state survives across calls (persistent guest runspace)
rpc_vm_start_listener(vm?)Deploy/start the persistent guest HTTP engine (vm_listener.ps1)

2024–2026 CVE methodology tools

ToolMethodology source
rpc_scan_context_handles(paths)Context-handle type confusion — CVE-2025-48815 pattern (whereisk0shl 2026)
rpc_inventory(paths?, limit?)Attack-surface inventory + EPM cross-check — MS-RPC-Fuzzer phase 1 (CVE-2025-26651)
rpc_fuzz(session, dry_run=True)Primitive-only default-value fuzzing with ok/denied/error classification — dry-run by default
rpc_find_hijackable()Unregistered interfaces of stopped services — EPM poisoning / RPC-Racer (CVE-2025-49760/59200/59230)
rpc_etw_unreachable(duration, trigger_script?)Clients calling dead servers — PhantomRPC (Kaspersky 2026), admin required
rpc_interface_security(key)ALPC SD / anonymous-ACE audit — MS-NRPC null session (SafeBreach/Securelist 2025)
rpc_decode_flags(flags)RpcServerRegisterIf3 flag bitmask decoding
rpc_format_client(key)Export generated C# client source (offline grep workflow)
rpc_new_struct(session, type, store_as)Build NDR complex types as session vars
rpc_alpc_squat(name, duration)ALPC port squat + connection capture (race validation primitive)
rpc_accessible_tasks()User-startable tasks (Dark-Elevator chain material, CVE-2026-66804 pattern)
rpc_vars / rpc_clear_cacheSession-variable and cache management (eviction cap 150)

Every tool call is appended to output/mcp_audit.log.

Field-Tested (real machine, full hunting round)

CandidateResult
srvsvc.dll 98716d03… flagged HIGHIdentified as XactSrv (XsOpenPrinter/XsClosePrinter/XsAddJob/XsScheduleJob) — single printer-handle type; live probe: non-admin connect OK but XsOpenPrinter → ACCESS_DENIED (authorization gate works). Scanner false-positive mode documented
ssdpsrv.dll (CVE-2025-48815 original)All 20 context handles strict — patched state on current builds
51-module sweep31 findings, 6 HIGH, all "one producer → many consumers"; NDR layer cannot prove multi-type handles (needs RE)
EPM hijack surface10 stopped services with unregistered interfaces (AppIDSvc, ClipSVC, dcsvc…)
Task chains44 user-startable SYSTEM tasks inventoried
VerdictNo confirmable exploitable vuln on the tested host — with per-step evidence

🚀 Quick Start

powershell
# 1) Prerequisites (one-time)Install-Module NtObjectManager -Scope CurrentUser -Forcepip install -r requirements.txt            # mcp>=1.2.0 (1.x / 2.x compatible)
# 2) Verify — three suites, all greenpython tests\smoke_test.py                 # 17 checks (live MCP stdio round-trip)python tests\var_test.py                   # 10 checks (store_as / __var__ mechanics)python tests\audit.py                      # 43 checks (edge cases, hostile paths, concurrency)
# 3) Run the serverpython server.py                           # stdio MCP

Claude Code:

bash
claude mcp add ntobjectmanager-rpc -- python C:\path\to\ntobjmanager-mcp\server.py

Any MCP client (e.g. OpenCode opencode.json):

json
{  "mcp": {    "ntobjectmanager-rpc": {      "type": "local",      "command": ["python", "C:\\path\\to\\ntobjmanager-mcp\\server.py"],      "enabled": true    }  }}

Example: context-handle type confusion (CVE-2025-48815 pattern)

1. rpc_parse  C:\Windows\System32\target.dll  [symbol_path optional]2. rpc_scan_context_handles ["C:\\Windows\\System32\\target.dll"]3. rpc_get_interface target_0                 → producer ([out] ctx) / consumer ([in] ctx) pairs4. rpc_connect s1 target_0                    → auto-discovers binding via EPM5. rpc_methods s1                            → opnum-mapped signatures6. rpc_call s1 XsOpenPrinter-like args store_as="h"   → keep the raw handle object7. rpc_call s1 XsClosePrinter-like [{"__var__":"h"}] → feed it to the other type

store_as / {"__var__"} is the core chain primitive: RPC return objects flow between calls without serialization round-trips, which is exactly what producer→consumer handle-confusion testing needs.

📁 Project Structure

ntobjmanager-mcp/├── server.py            # 24 MCP tools + audit logging wrapper├── snippets.py          # PowerShell templates (@@TOKEN@@ render + ps_str escaping)├── ps_engine.py         # Persistent engine: base64 cmds + __MCP_DONE__ markers, timeouts├── wrapper.ps1          # PS-side loop (state lives in $RPCMCP)├── vm_listener.ps1      # Persistent guest HTTP bridge (stateful VM exec)├── tests/│   ├── smoke_test.py    # 17 checks — live stdio end-to-end│   ├── var_test.py      # 10 checks — store_as/__var__ object passing│   ├── audit.py         # 43 checks — hostile inputs, concurrency, engine kill/restart│   ├── hunt.py          # Full dogfood hunting round (safe policy)│   ├── hunt2_static.py  # Deep-dive: symbols + producer/consumer map│   ├── hunt2_wide.py    # 51-module sweep│   └── hunt2_probe.py   # Safe runtime probes (exposure / task cross-ref)├── ARCHITECTURE.md      # Engine protocol + design decisions├── CHANGELOG.md         # Decision history (R1–R13)├── SECURITY.md          # Authorized-use policy + MSRC disclosure├── CONTRIBUTING.md      # Development invariants└── LICENSE              # MIT

🛡️ Honest Capability Boundaries

ClaimStatus
Stateful clients across tool callsYes — persistent engine + $RPCMCP
Stateful execution inside a lab VMYes — one persistent guest runspace (rpc_vm_exec); the vmrun fallback is stateless
Context-handle chaining (producer → consumer)Yes — store_as / __var__ raw-object passing
Auto-confirm type confusionNo — NDR cannot prove distinct handle types; verify via RE (see XactSrv case)
Full rogue-RPC hostingNo — NtObjectManager 2.0.1 ships no server builder; rpc_alpc_squat covers race-capture only
ETW tracing / ALPC SDDLRequires admin (logman / SeDebugPrivilege)
Symbol-resolved procedure namesEnvironment-dependent (symsrv chain); heuristic fallback names otherwise
Runs anywhere but Windows PS 5.1Not yet (pwsh 7 untested)

📖 Documentation

  • ARCHITECTURE.md — engine protocol, state model, design decisions
  • CHANGELOG.md — R1–R13 decision history incl. two PS 5.1 marshaling bugs
  • SECURITY.md — authorized use, VM isolation, MSRC disclosure
  • CONTRIBUTING.md — development invariants and test requirements

⚠️ Disclaimer

For lawful security research, education, and authorized testing only. rpc_call invokes real RPC methods and can crash services — run it against an isolated VM, never a production or daily-driver host. Vulnerabilities found through this tool must follow responsible disclosure (MSRC).

📄 License

MIT — Copyright (c) 2026 ntobjmanager-mcp Contributors

Source: README.md at commit 0c3f0f6

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestSep 30, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts