ntobjmanager-mcp — Claude Code MCP server: setup and features
This server connects AI agents to the NtObjectManager PowerShell module for Windows RPC research. It helps inspect exposed interfaces, check ALPC ports, and study context handles.
Open on GitHubWhat ntobjmanager-mcp does
The server exposes 24 tools to an AI agent for inspecting Windows RPC interfaces via James Forshaw's NtObjectManager. Unlike a generic script runner, it maintains a persistent powershell.exe process. Because the runspace stays active across calls, parsed servers and active RPC sessions survive in $RPCMCP.
Under the hood, server.py dispatches commands via ps_engine.py using PowerShell templates from snippets.py. The suite includes PE parsing for RPC servers, endpoint mapper queries, ALPC security audits, and reflection-based method execution. Testing inside a guest lab VM relies on vm_listener.ps1 to keep state alive without spawning new shells.
Setup requires Python 3.10+, PowerShell 5.1, and the NtObjectManager PowerShell module installed on the host. Running rpc_etw_unreachable fails without administrator privileges. Every executed action is written to output/mcp_audit.log.
What it helps with
- Parse PE binaries to extract registered RPC interfaces
- Inspect live endpoints and query the RPC Endpoint Mapper
- Invoke RPC methods while keeping connection state across calls
- Find unregistered interfaces belonging to stopped Windows services
- Audit context handles for potential type confusion patterns
Example prompts for the agent
- Parse
C:\Windows\System32\srvsvc.dllusingrpc_parseand list the discovered RPC interfaces. - Query local endpoints via
rpc_query_endpointsto see registered bindings. - Run
rpc_find_hijackableto locate unregistered interfaces on stopped services.
How to install ntobjmanager-mcp
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about ntobjmanager-mcp
How to install ntobjmanager-mcp in Claude Code?
First install the module with Install-Module NtObjectManager -Scope CurrentUser -Force and Python packages using pip install -r requirements.txt. Then register it by running claude mcp add ntobjectmanager-rpc -- python C:\path\to\ntobjmanager-mcp\server.py.
What does ntobjmanager-mcp do?
It gives AI agents 24 tools to explore Windows RPC attack surfaces using the NtObjectManager library. Because it runs a persistent PowerShell process, active connections and parsed objects stay loaded between tool calls.
Does ntobjmanager-mcp require administrator privileges?
Most inspection tools and EPM queries run under standard user rights. Elevated administrator privileges are only needed for rpc_etw_unreachable, which collects ETW traces.
