Memory Shell MCP, developed by Ruoji6, is a free MCP server designed for detecting and cleaning in-memory web shells. Built primarily with Python 3.12, it targets security professionals, system administrators, and developers focused on web security. The tool connects to systems to identify and remove persistent threats, specifically Java in-memory webshells. Its capabilities include automated scanning, source code analysis, and direct cleanup operations, making it a specialized utility for maintaining system integrity against advanced web-based attacks.

What does Memory Shell MCP connect to?

Memory Shell MCP connects to target systems to perform detection and cleanup of in-memory web shells. It functions as an MCP server, specifically designed for Java in-memory webshells, built on FastMCP. The tool supports remote execution via SSH, allowing SSH parameters to be passed through AI dialogue, such as with Claude Desktop. This capability enables interaction with remote environments to scan for and remove malicious code residing in memory, focusing on maintaining the integrity of web applications against stealthy, persistent threats.

Core features and tools

Memory Shell MCP provides a complete detection process for in-memory web shells. This process includes Scan detection to identify potential threats across systems, Source code analysis for deeper investigation into discovered anomalies, and Clear in-memory webshell for direct remediation. While the specific callable tools exposed by the MCP server for direct invocation via the MCP protocol are not detailed, these documented steps outline the primary functions. The tool's core strength lies in its ability to identify and remove these stealthy threats from running systems, ensuring web application security.

Who is it for?

Memory Shell MCP is intended for security professionals, system administrators, and developers who focus on web security, particularly concerning in-memory web shells. Its specialized function addresses a critical area of web application defense against advanced threats that reside in server memory. The tool supports those needing automated methods for identifying and eliminating advanced persistent threats within server memory. This is not the right fit if your primary concern is not Java in-memory web shell detection and cleanup.

How to get started

Access is granted through standard SSH authentication mechanisms for remote execution, with parameters passed via AI dialogue.

Use cases

• Automated detection of in-memory web shells.
• Automated cleanup of detected in-memory web shells.
• Source code analysis for web shell detection.

Memory Shell MCP offers a specialized solution for identifying and removing in-memory web shells, a critical security challenge. Its design as an MCP server, built with Python 3.12, targets security experts and system administrators. The tool's ability to perform scan detection, source code analysis, and direct cleanup makes it a valuable asset.