# ntobjmanager-mcp

This server connects AI agents to the NtObjectManager PowerShell module for Windows RPC research. It helps inspect exposed interfaces, check ALPC ports, and study context handles.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 16
- Author: lupingQAQ
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/lupingQAQ/ntobjmanager-mcp
- Updated: 2026-09-30
- HTML: https://affpapa.org/en/nevibecode/mcp/ntobjmanager-mcp

## What it does

The server exposes 24 tools to an AI agent for inspecting Windows RPC interfaces via James Forshaw's NtObjectManager. Unlike a generic script runner, it maintains a persistent `powershell.exe` process. Because the runspace stays active across calls, parsed servers and active RPC sessions survive in `$RPCMCP`.

Under the hood, `server.py` dispatches commands via `ps_engine.py` using PowerShell templates from `snippets.py`. The suite includes PE parsing for RPC servers, endpoint mapper queries, ALPC security audits, and reflection-based method execution. Testing inside a guest lab VM relies on `vm_listener.ps1` to keep state alive without spawning new shells.

Setup requires Python 3.10+, PowerShell 5.1, and the `NtObjectManager` PowerShell module installed on the host. Running `rpc_etw_unreachable` fails without administrator privileges. Every executed action is written to `output/mcp_audit.log`.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- Parse PE binaries to extract registered RPC interfaces
- Inspect live endpoints and query the RPC Endpoint Mapper
- Invoke RPC methods while keeping connection state across calls
- Find unregistered interfaces belonging to stopped Windows services
- Audit context handles for potential type confusion patterns

## Example prompts
- Parse `C:\Windows\System32\srvsvc.dll` using `rpc_parse` and list the discovered RPC interfaces.
- Query local endpoints via `rpc_query_endpoints` to see registered bindings.
- Run `rpc_find_hijackable` to locate unregistered interfaces on stopped services.

## Similar
- [windows-hardening](https://affpapa.org/en/nevibecode/skills/windows-hardening.md) — skill · 388 installs
- [powershell-security-hardening](https://affpapa.org/en/nevibecode/agents/powershell-security-hardening.md) — subagent · 194 installs
- [powershell-5.1-expert](https://affpapa.org/en/nevibecode/agents/powershell-51-expert.md) — subagent · 196 installs
- [windows-builder](https://affpapa.org/en/nevibecode/skills/windows-builder.md) — skill · 2700 installs
- [game-automation](https://affpapa.org/en/nevibecode/skills/game-automation.md) — skill · 1500 installs
- [excel-cli](https://affpapa.org/en/nevibecode/skills/excel-cli.md) — skill · 1000 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md