# ntobjmanager-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/lupingQAQ/ntobjmanager-mcp  
**GitHub Stars:** 16  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/ntobjmanager-mcp

## Description
Stateful Windows RPC attack-surface research for AI agents: 22 tools on NtObjectManager.

## Claude Desktop Quick Installation
No confirmed install details yet, so no config is published. Follow the setup steps in the repository above.

## Documentation

## What ntobjmanager-mcp MCP server does

The ntobjmanager-mcp MCP server exposes NtObjectManager and NtCoreLib capabilities to MCP clients for Windows RPC attack-surface research. It connects agents to the local RPC runtime through a persistent PowerShell process, allowing parsed server objects, connected clients, and stored variables to remain available between tool calls. The server also supports a persistent guest runspace for PowerShell execution inside a lab virtual machine.

Its intended use is authorized research and validation on Windows systems. The repository includes an authorization policy and audit logging: every tool call is appended to `output/mcp_audit.log`. The project is categorized under 🔒 Security because its tools inspect RPC interfaces, endpoints, access controls, task exposure, and related attack-surface conditions.

## How it works

The ntobjmanager-mcp MCP server runs over stdio. Python renders PowerShell command templates, and a persistent `powershell.exe` process executes them using encoded commands and completion markers. Server state is held in a PowerShell structure containing cached servers, live clients, and variables.

A typical investigation parses a PE file, inspects its interfaces, discovers local or remote endpoints, connects a client, lists opnum-mapped methods, and invokes selected procedures. Results can be retained with `store_as` and passed into later calls with `{"__var__":"name"}`. This preserves raw RPC objects, including context handles, instead of forcing each call through a serialization boundary.

The VM bridge follows the same stateful model. `rpc_vm_start_listener` starts the guest HTTP engine, while `rpc_vm_exec` runs PowerShell in the guest. The documented `vmrun` fallback does not preserve state.

## Setup and configuration

Install PowerShell 5.1, Python 3.10 or newer, the NtObjectManager PowerShell module, and the Python dependencies from `requirements.txt`. The documented module setup uses:

```powershell
Install-Module NtObjectManager -Scope CurrentUser -Force
pip install -r requirements.txt
python server.py
```

The final command starts the stdio MCP server. The README shows a Claude Code registration using `claude mcp add`, and a local MCP configuration example for another client. A Windows environment is required for the PowerShell and NtObjectManager workflow.

## Tools and capabilities

The ntobjmanager-mcp MCP server provides tools in several groups:

- Parse PE files, cache RPC servers, inspect interfaces, query EPM endpoints, enumerate running servers, connect or disconnect clients, list methods, and invoke procedures.
- Execute persistent PowerShell in a lab VM and start the guest listener.
- Scan context handles, inventory RPC exposure, run primitive-only fuzzing, find interfaces associated with stopped services, inspect ETW reports for unreachable servers, and audit interface security.
- Decode `RpcServerRegisterIf3` flags, export generated C# client code, construct NDR structures, test ALPC port squatting, and enumerate user-startable tasks.
- Manage cached state and stored session variables.

The fuzzing tool defaults to dry-run mode and classifies results as allowed, denied, or errored. RPC endpoint queries can target local or remote systems, subject to the environment and permissions.

## Limitations and notes

This tooling is for controlled, authorized environments; its functions include live RPC connections, fuzzing, ALPC operations, and VM execution. Administrative access is required for the ETW unreachable-server workflow. Static findings do not by themselves establish exploitability: the project’s documented test round included false positives, authorization gates, and cases where the NDR layer could not prove that handles had multiple types.

The README reports a 150-entry eviction cap for cached state. Fuzzing is conservative by default, but changing execution parameters can alter system behavior. Review the project’s security policy before connecting to production hosts or services.

_Full upstream README: https://allmcps.com/mcp/ntobjmanager-mcp/readme_