Perception RE MCP Server
Bridges Claude Code to Perception.cx reverse engineering tools via AngelScript WebSocket, providing 35+ tools for process manipulation, memory operations, disassembly, scanning, and more.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
verifizieren
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
attach_processAttach to a target process by name or PID for memory inspection
detach_processDetach from the currently attached process
process_infoGet info about the currently attached process (PID, base address, PEB, alive status)
is_valid_addressCheck if an address is valid in the target process
read_memoryRead raw bytes from process memory. Returns hex-encoded data.
read_valuesRead typed values from memory. Types: u8, u16, u32, u64, i8, i16, i32, i64, f32, f64
read_stringRead an ANSI/UTF-8 string from memory
read_wstringRead a UTF-16 (wide) string from memory
read_pointer_chainFollow a chain of pointers from a base address through a series of offsets. Returns the final address and value.
read_structRead a structured set of fields from memory. Define fields with offset, type, and name.
read_pointer_arrayRead an array of pointers from memory
write_memoryWrite raw hex bytes to process memory
write_valuesWrite typed values to memory
write_stringWrite an ANSI string to memory (null-terminated)
write_wstringWrite a UTF-16 wide string to memory (null-terminated)
pattern_scanSearch for an IDA-style byte pattern in process memory. Returns first match address.
pattern_scan_allSearch for ALL occurrences of an IDA-style byte pattern
get_moduleGet a module's base address and size
get_exportResolve an exported function address from a module
get_importResolve an import's IAT entry address in a module
disassembleDisassemble instructions at a memory address using Zydis. Returns mnemonic, operands, bytes.
virtual_queryQuery virtual memory region info for an address (base, size, protection, heap likelihood)
get_vad_snapshotGet a snapshot of VAD (Virtual Address Descriptor) entries. Use filters to avoid the 210k+ character response that blows the result size limit.
alloc_vmAllocate RWX virtual memory in the target process
free_vmFree previously allocated virtual memory in the target process
get_tebsGet all Thread Environment Block (TEB) addresses for the target process
scan_valueScan entire process memory for a specific value. Returns array of addresses where value was found. Use page_offset/page_limit to paginate when count is large.
find_xrefsFind cross-references to a target address within a memory region. Searches for relative offsets and absolute pointers.
analyze_vtableRead and analyze a virtual function table. Returns array of function pointers with optional disassembly of each entry.
read_rttiRead MSVC Run-Time Type Information from an object's vtable pointer. Returns class name and hierarchy.
generate_signatureGenerate an IDA-style byte signature from code at an address, wildcarding relocatable parts.
find_function_boundsAttempt to find the start and end of a function containing the given address
analyze_functionDisassemble and analyze an entire function. Returns all instructions, basic blocks, and call targets.
dump_memory_regionDump a memory region for comparison. Stores snapshot internally for diff_memory.
diff_memoryCompare two memory snapshots (taken with dump_memory_region) and show differences
scan_pointer_toScan for pointers pointing to a target address. Use page_offset/page_limit to paginate large result sets.
find_string_refsSearch for references to strings in code. Finds LEA instructions loading string addresses.
emulate_codeEmulate x86_64 code using Unicorn engine. Map memory, set registers, run code, read results.
assembleAssemble x86_64 instructions using Zydis encoder. Returns hex bytes.
hex_dumpRead memory and format as a traditional hex dump with ASCII display
scan_heap_regionsScan a caller-supplied list of heap regions for a value via direct memory reads. More targeted than full-process scan_value. Build the region list from get_vad_snapshot with heap_only+compact+min_size filters.
read_and_filter_pointersRead count pointers at base+i*stride, dereference each at deref_offset, and return only those where the dereferenced value equals vtable_check_addr. Replaces a manual loop of read_values + vtable checks.
cs2_get_interfaceGet a CS2 interface pointer by name from a module
cs2_schema_dumpDump CS2 schema system (all classes and field offsets)
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
ws: Memory exhaustion DoS from tiny fragments and data chunks
ws: Uninitialized memory disclosure
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
44/44 tools missing one or more hints — attach_process (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); detach_process (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); process_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +41 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
40/44 tool handlers declare input schemas (91%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 0/44 tool handlers wrap calls in try/catch (0%)
Wrap each tool handler body in try/catch and return a structured error response.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 4 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/verifizieren/perception-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check