This project equips Claude Code with advanced binary analysis capabilities for tasks such as incident response, malware investigation, and vulnerability assessment
How to install claude-plugins?
deepbitstechnology/claude-plugins
$git clone https://github.com/deepbitstechnology/claude-pluginsInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install claude-plugins by running `git clone https://github.com/deepbitstechnology/claude-plugins`, then use it for the current task and follow its documentation at https://github.com/deepbitstechnology/claude-plugins.
README.md
| 1 | # Deepbits Cyber Assistant Plugin for Claude Code |
| 2 | |
| 3 | The Plugin equips Claude Code with advanced binary analysis capabilities for tasks such as incident response, malware investigation, and vulnerability assessment. It connects to the remote Dr. Binary MCP server over HTTP — no local server to install — and combines that with local system tools. To analyze a local file, Claude calls `prepare_upload` to obtain a one-time `curl` command, runs it to stream the file into a remote workspace, and then analyzes it with `inspect_binary` (Rizin triage), `run_sandbox` (`rizin -qc` and a full reverse-engineering toolkit), and `dump_data` (Ghidra decompilation). The plugin also exposes an Android/AOSP kernel CVE database for vulnerability research. Together with local Windows system scanning, browser hijacking detection, and registry/network monitoring, it transforms Claude Code into a powerful AI-assisted workspace for comprehensive system and binary security analysis. |
| 4 | |
| 5 | ## Overview |
| 6 | |
| 7 | The Claude Code Security Analysis Plugin extends Claude Code with advanced cybersecurity and binary-analysis capabilities, enabling developers and analysts to perform in-depth system investigations directly within their coding environment. |
| 8 | |
| 9 | This plugin seamlessly integrates with both cloud-based analysis platforms and local security tools via the Model Context Protocol (MCP), creating a unified workspace for intelligent, AI-assisted security analysis. |
| 10 | |
| 11 | Designed for incident response, malware forensics, and vulnerability research, the plugin empowers users to: |
| 12 | |
| 13 | - 🧩 Investigate compromised systems to identify indicators of compromise (IoCs) and attack traces. |
| 14 | |
| 15 | - 🦠 Analyze malware samples to uncover behaviors, persistence methods, and payloads. |
| 16 | |
| 17 | - 🛡️ Perform vulnerability and exploit analysis, including Android/AOSP kernel CVE research and patch-status assessment. |
| 18 | |
| 19 | - ⚙️ Combine cloud automation with local expertise, integrating Deepbits’ agentic binary-analysis capabilities into Claude Code. |
| 20 | |
| 21 | Specialized Cybersecurity Capabilities |
| 22 | |
| 23 | This plugin provides Claude Code with specialized cybersecurity features, including: |
| 24 | |
| 25 | - 💻 Local Windows system scanning for malware, configuration weaknesses, and security issues. |
| 26 | |
| 27 | - 🌐 Browser hijacking detection to identify malicious extensions or modified settings. |
| 28 | |
| 29 | - 🧮 Windows Registry analysis to reveal persistence mechanisms or misconfigurations. |
| 30 | |
| 31 | - 🧾 Suspicious file detection through behavioral and signature-based analysis. |
| 32 | |
| 33 | - 🔗 Network connection monitoring for unusual or unauthorized communications. |
| 34 | |
| 35 | - 🧠 Remote binary file analysis powered by Rizin/radare2, Ghidra, angr, qiling, and other advanced analysis frameworks. |
| 36 | |
| 37 | Together, these capabilities transform Claude Code into a comprehensive cybersecurity co-pilot—bridging the gap between code intelligence, system defense, and binary analysis. |
| 38 | |
| 39 | ## Features |
| 40 | |
| 41 | ### 🛡️ Security Scanning |
| 42 | - Comprehensive system security assessments |
| 43 | - Browser hijacking detection across Chrome, Firefox, Edge, and IE |
| 44 | - Windows Registry malware persistence detection |
| 45 | - Suspicious file system scanning |
| 46 | - Active network connection monitoring |
| 47 | |
| 48 | ### 🔍 Binary Analysis |
| 49 | - Upload local files to the remote workspace via a one-time `curl` (bytes never pass through the model context) |
| 50 | - Compare binaries with DeepDiff through the remote Dr. Binary MCP server |
| 51 | - Lightweight Rizin (rz-bin) triage with `inspect_binary` |
| 52 | - Deep, sandboxed analysis with `run_sandbox` + `rizin -qc` and a full RE toolkit (radare2, binwalk, angr, qiling, qemu, apktool, jadx, …) |
| 53 | - Full Ghidra decompilation with `dump_data` |
| 54 | - Malware classification, threat assessment, and IoC extraction |
| 55 | |
| 56 | ### 🧬 Android Kernel CVE Research |
| 57 | - Look up individual CVEs and their affected version ranges, fixes, and bug-inducing commits |
| 58 | - Find CVEs by AOSP kernel version, build date, or branch |
| 59 | - Identify unpatched and exploitable vulnerabilities for a branch at a point in time |
| 60 | |
| 61 | ### 🤖 Specialized Agent |
| 62 | The **Cyber Security Analyst** agent provides expert-level security analysis with: |
| 63 | - Structured threat assessment workflow |
| 64 | - Evidence-based reporting |
| 65 | - Risk prioritization (Critical/High/Medium/Low) |
| 66 | - Actionable remediation steps |
| 67 | |
| 68 | ## Installation |
| 69 | |
| 70 | The plugin connects directly to the remote Dr. Binary MCP server (`https://mcp.deepbits.com/mcp`) over HTTP — **there is no local MCP server to install or run.** |
| 71 | |
| 72 | 1. Run Claude Code: |
| 73 | ```bash |
| 74 | claude |
| 75 | ``` |
| 76 | 2. Add the marketplace: |
| 77 | ``` |
| 78 | /plugin marketplace add DeepBitsTechnology/claude-plugins |
| 79 | ``` |
| 80 | 3. Install the plugin: |
| 81 | ``` |
| 82 | /plugin install drbinary-chat-plugin@deepbits |
| 83 | ``` |
| 84 | 4. Connect and authenticate: |
| 85 | ``` |
| 86 | /mcp |
| 87 | ``` |
| 88 | Connecting to the `drbinary` server opens a browser-based sign-in. Log in with **Google or GitHub SSO** — no manual account creation is required. Once authenticated, the binary-analysis and kernel-CVE tools are available. |
| 89 | |
| 90 | ### Important Configuration |
| 91 | |
| 92 | #### MCP Timeout Setting |
| 93 | |
| 94 | Some remote analysis steps — sandboxed Rizin runs, `dump_data` (Ghidra) decompilation o |
Related
6 picksType
- mcp-scannerA tool to scan MCP servers and tools for security findingsJul 2026
- hol-guardOpen-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs.Jul 2026
- agent-scanAgent supply chain security scanner.Jul 2026
- falcon-mcpConnects AI agents with CrowdStrike Falcon for security analysis and automation.Jul 2026
- pythonPlug-and-play auth for Python MCP servers.Aug 2025
- auth0-mcp-serverAuth0 MCP Server: Manage Auth0 applications, APIs, actions, logs, and forms using natural languageJul 2026
