Qu1cksc0pe

You can get:

• What DLL files are used.
• Functions and APIs.
• Sections and segments.
• URLs, IP addresses and emails.
• Android permissions (Dangerous/Special/Info).
• MITRE ATT&CK mappings (Windows + Linux static analysis).
• File extensions and their names.
• Embedded executables/exploits. And so on...

Qu1cksc0pe aims to get even more information about suspicious files and helps user realize what that file is capable of.

Qu1cksc0pe Can Analyze Currently

MCP Server

Qu1cksc0pe ships an MCP server (Modules/mcp_server.py) that exposes its static-analysis features as tools for MCP-aware clients (Claude Code, Claude Desktop, etc.). It shells out to qu1cksc0pe.py the same way the Web UI does, so it needs no code changes to stay in sync with the CLI, and it only imports the mcp package itself at startup (the individual analyzers' own dependencies are only needed once a tool actually runs).

Install the extra dependency (already included in requirements.txt):

pip install "mcp>=2.0.0"

Launch it through the --mcp flag, same as every other Qu1cksc0pe command:

python3 qu1cksc0pe.py --mcp

Transport defaults to streamable-http (binds 127.0.0.1:8765/mcp), so the server is a persistent process any number of clients can attach to and detach from independently -- run it once in its own terminal, point clients at http://127.0.0.1:8765/mcp. Override with:

SC0PE_MCP_TRANSPORT=stdio python3 qu1cksc0pe.py --mcp   # traditional one-client-per-process model

A project-level .mcp.json is included so Claude Code picks the server up automatically for this repo. It pins stdio explicitly (via env), since Claude Code spawns and owns a fresh process per session rather than attaching to one you started yourself:

{
  "mcpServers": {
    "qu1cksc0pe": {
      "command": "python3",
      "args": ["qu1cksc0pe.py", "--mcp"],
      "env": { "SC0PE_MCP_TRANSPORT": "stdio" }
    }
  }
}

If python3 on your PATH isn't the interpreter with Qu1cksc0pe's dependencies installed (common on Windows, or with multiple Python installs), change command to the full path of the right python/python.exe, or run python3 -c "import mcp" first to check.

Tools: analyze_file, analyze_document, analyze_archive, detect_packer, detect_language, extract_iocs, check_resources, check_signatures, scan_hash, scan_virustotal, configure_virustotal_api_key, configure_ai_api_key, update_hash_database, list_supported_file_types. Each tool validates its input file/folder locally (rejecting files >= 50MB, since the CLI would otherwise prompt interactively) before invoking the CLI, and returns the resulting JSON report(s) plus captured console output. Interactive-only features (--watch dynamic analysis, --ui, --install) are intentionally not exposed as tools.

The five analysis tools that support ai=True also take an ai_provider argument ("auto"/"ollama" (default, local), "claude", "openai", "deepseek", "kimi", or "glm") -- see AI Analysis Providers below. Configure a cloud key first with configure_ai_api_key(provider="claude", api_key="...") (or whichever provider).

Logs: every tool call and CLI dispatch (command, duration, exit code, reports collected) is logged to stderr and to sc0pe_reports/mcp/mcp_server.log. Set SC0PE_MCP_LOG_LEVEL=DEBUG for full stderr output too, or SC0PE_MCP_LOG_FILE=0 to disable the file sink.

AI Analysis Providers

--ai (and the MCP tools' ai=True) summarizes a generated report with an LLM. Ollama (local) is the default; five cloud backends are also supported.

Ollama needs no key -- install Ollama and select the model via [Ollama] model in Systems/Multiple/multiple.conf. For a cloud provider, either set its env var above, or save a key through the interactive key manager:

python qu1cksc0pe.py --key_init
# >>> Qu1cksc0pe API Key Manager
#   1) VirusTotal
#   2) Claude (Anthropic)
#   3) OpenAI
#   4) DeepSeek
#   5) Kimi (Moonshot AI)
#   6) GLM (Zhipu AI)
#   0) Exit

--key_init --key_provider <name> (e.g. --key_provider claude) skips the menu and prompts for just that one key -- useful for scripts (this is what the MCP server's configure_ai_api_key/configure_virustotal_api_key tools do under the hood).

# Explicit provider selection (auto/ollama is the default -- no flag needed for local analysis)
python qu1cksc0pe.py --file suspicious_file --analyze --ai --ai_provider claude

The default (auto/unset) is unchanged from prior versions: Ollama, falling back to a heuristic summary if it's unavailable. Cloud providers are strictly opt-in -- report data is only sent off-machine if you explicitly pass --ai_provider <name> or set SC0PE_AI_PROVIDER. See the Environment Variables table for model/base-URL/timeout/token tuning per provider.

Usage

python qu1cksc0pe.py --file suspicious_file --analyze

# Launch Web UI
python3 qu1cksc0pe.py --ui

Screenshot

Updates

01/09/2026

• New feature: malicious JavaScript can now be emulated automatically during HTML/JS/HTA analysis by a native, bounded abstract interpreter. Browser, WSH, ActiveX, Node.js network/process/filesystem/registry APIs and decoded eval layers are modeled entirely in memory; sample code, commands, files, and network requests are never executed on the host.

25/08/2026

• New feature: Office VBA projects and plaintext VBScript/VBA-family files are now emulated automatically in a native, in-memory sandbox during --docs analysis. The normal static scan still runs, and JSON reports include the emulation findings, IOC event trace, network requests, process attempts, persistence activity, and virtual files.
• New feature: added AppleScript source analysis to Modules/apple_analyzer.py, including execution, network, credential-access, collection, persistence, defense-evasion, filesystem, shell-command, URL, and YARA indicators. Use --analyze; AppleScript is never executed through osascript.
• New feature: added dedicated Windows Batch analysis for .bat/.cmd files, with execution, persistence, defense-evasion, download/network, obfuscation, IOC, and YARA detection.

12/08/2026

• New feature: added an MCP server (--mcp, Modules/mcp_server.py, .mcp.json) exposing Qu1cksc0pe as tools for MCP clients like Claude Code, defaulting to streamable-http (persistent, multi-client; stdio/sse also available) with logging to stderr and sc0pe_reports/mcp/mcp_server.log (SC0PE_MCP_LOG_LEVEL/SC0PE_MCP_LOG_FILE). See the "MCP Server" section above.
• New feature: --ai now supports Claude, OpenAI, DeepSeek, Kimi, and GLM as alternative backends to Ollama via --ai_provider/SC0PE_AI_PROVIDER (or the MCP tools' ai_provider argument). Ollama stays the local-only default unless a cloud provider is explicitly selected; see "AI Analysis Providers" above.
• New feature: `--