Ntobjmanager MCP

🛰️ NtObjectManager-MCP

Stateful Windows RPC Research MCP — 2024–2026 CVE methodologies as one-click tools

🌐 [中文版](README.zh-CN.md)

---

What is NtObjectManager-MCP?

A Model Context Protocol server that gives an AI agent live, stateful access to Windows RPC attack-surface research, built on James Forshaw's NtObjectManager (NtCoreLib).

Three things a generic PowerShell MCP cannot do — and the reason this exists:

1. Stateful RPC connections — a persistent PowerShell engine keeps parsed RpcServer objects and *connected RPC clients* alive across tool calls: rpc_connect once, rpc_call many times (auth handshakes, context-handle chains, session variables survive).
2. CVE methodology as fixed tools — the standard hunting workflows from 2024–2026 public research are one-click, not prompt-engineering.
3. Stateful execution inside a lab VM — the same one-engine principle applied in the guest: rpc_vm_exec keeps variables and connected RPC clients alive across calls through a single persistent guest runspace, never a fresh shell per call (the vmrun fallback is reported as stateful: false).

┌────────────────────────────────────────────────────────────────────┐

│ AI Agent (Claude Code / OpenCode / any MCP client) │ │ │ MCP (stdio, 24 tools) │ │ ▼ │ │ server.py ── snippets.py (PS templates, @@TOKEN@@ + ps_str escape)│ │ │ │ │ ▼ │ │ ps_engine.py ── persistent powershell.exe (base64 + __MCP_DONE__) │ │ │ state: $RPCMCP = @{ Servers; Clients; vars } │ │ ▼ │ │ NtObjectManager / NtCoreLib ──► RPC runtime (ALPC / pipe / TCP) │ └────────────────────────────────────────────────────────────────────┘

Tool Matrix (24)

Core stateful pipeline

VM lab bridge (stateful guest execution)

2024–2026 CVE methodology tools

Every tool call is appended to output/mcp_audit.log.

Field-Tested (real machine, full hunting round)

🚀 Quick Start

# 1) Prerequisites (one-time)

Install-Module NtObjectManager -Scope CurrentUser -Force pip install -r requirements.txt # mcp>=1.2.0 (1.x / 2.x compatible)

2) Verify — three suites, all green

python tests\smoke_test.py # 17 checks (live MCP stdio round-trip) python tests\var_test.py # 10 checks (store_as / var mechanics) python tests\audit.py # 43 checks (edge cases, hostile paths, concurrency)

3) Run the server

python server.py # stdio MCP

Claude Code:

claude mcp add ntobjectmanager-rpc -- python C:\path\to\ntobjmanager-mcp\server.py

Any MCP client (e.g. OpenCode opencode.json):

{

"mcp": { "ntobjectmanager-rpc": { "type": "local", "command": ["python", "C:\\path\\to\\ntobjmanager-mcp\\server.py"], "enabled": true } } }

Example: context-handle type confusion (CVE-2025-48815 pattern)

1. rpc_parse  C:\Windows\System32\target.dll  [symbol_path optional]

1. rpc_scan_context_handles ["C:\\Windows\\System32\\target.dll"]
2. rpc_get_interface target_0 → producer ([out] ctx) / consumer ([in] ctx) pairs
3. rpc_connect s1 target_0 → auto-discovers binding via EPM
4. rpc_methods s1 → opnum-mapped signatures
5. rpc_call s1 XsOpenPrinter-like args store_as="h" → keep the raw handle object
6. rpc_call s1 XsClosePrinter-like [{"var":"h"}] → feed it to the other type

store_as / {"__var__"} is the core chain primitive: RPC return objects flow between calls without serialization round-trips, which is exactly what producer→consumer handle-confusion testing needs.

📁 Project Structure

ntobjmanager-mcp/

├── server.py # 24 MCP tools + audit logging wrapper ├── snippets.py # PowerShell templates (@@TOKEN@@ render + ps_str escaping) ├── ps_engine.py # Persistent engine: base64 cmds + __MCP_DONE__ markers, timeouts ├── wrapper.ps1 # PS-side loop (state lives in $RPCMCP) ├── vm_listener.ps1 # Persistent guest HTTP bridge (stateful VM exec) ├── tests/ │ ├── smoke_test.py # 17 checks — live stdio end-to-end │ ├── var_test.py # 10 checks — store_as/var object passing │ ├── audit.py # 43 checks — hostile inputs, concurrency, engine kill/restart │ ├── hunt.py # Full dogfood hunting round (safe policy) │ ├── hunt2_static.py # Deep-dive: symbols + producer/consumer map │ ├── hunt2_wide.py # 51-module sweep │ └── hunt2_probe.py # Safe runtime probes (exposure / task cross-ref) ├── ARCHITECTURE.md # Engine protocol + design decisions ├── CHANGELOG.md # Decision history (R1–R13) ├── SECURITY.md # Authorized-use policy + MSRC disclosure ├── CONTRIBUTING.md # Development invariants └── LICENSE # MIT

🛡️ Honest Capability Boundaries

📖 Documentation

• ARCHITECTURE.md — engine protocol, state model, design decisions
• CHANGELOG.md — R1–R13 decision history incl. two PS 5.1 marshaling bugs
• SECURITY.md — authorized use, VM isolation, MSRC disclosure
• CONTRIBUTING.md — development invariants and test requirements

⚠️ Disclaimer

For lawful security research, education, and authorized testing only. rpc_call invokes real RPC methods and can crash services — run it against an isolated VM, never a production or daily-driver host. Vulnerabilities found through this tool must follow responsible disclosure (MSRC).

📄 License

MIT — Copyright (c) 2026 ntobjmanager-mcp Contributors