repowisemandiant/capa

mandiant / capa

The FLARE team's open-source tool to identify capabilities in executable files.

Python★ 6,213
Use in your agentAsk this codebase

github.com/mandiant/capaIndexed at a98fd82Up to date with upstream

What is capa?

capa is an open-source tool for identifying capabilities in executable files. It analyzes PE, ELF, .NET module, shellcode, and sandbox report inputs, then reports behaviors such as service installation or HTTP communication. capa is written primarily in Python and runs as a command line tool.

Written by a model from the README and the source

Start reading

Code health

Health scores land with the first index: complexity, duplication, coverage, churn and ownership across every file.

Use mandiant/capa in your agent

Point Claude Code, Cursor, Codex or VS Code at this repository. Your agent gets the index this page is built from: cited answers, callers, history and health for any file.

  1. 1.In Claude, open Customize → Connectors, click +, then Add custom connector. On a Team or Enterprise plan an owner adds it first under Organization settings → Connectors.
  2. 2.Paste the server URL below as the Remote MCP server URL, then click Add.
  3. 3.Click Connect. A Repowise sign-in window opens. Approve access.
  4. 4.Repowise's tools are now available in your Claude chats.

Connect with one click. Sign in with Repowise (OAuth), no API key to copy. Works in Claude on the web, desktop, and mobile.

Docs
bash
https://api.repowise.dev/mcp/mandiant/capa
Editors need an API key: sign in to create one.Sign in to connect

This repo is public, so anyone with a Repowise account and an API key can connect.

Try asking

  • get_overview()
  • get_answer("how is capa put together?")
  • get_why("why is capa structured this way?")

Explore capa

Key features of capa

  • capa identifies capabilities in PE, ELF, .NET module, shellcode, and sandbox report inputs.
  • capa supports dynamic capability detection for CAPE, DRAKVUF, and VMRay report formats.
  • capa uses rules to identify capabilities and allows users to extend recognized behaviors by authoring rules.
  • capa Explorer Web enables interactive exploration of capa results in a browser and supports a standalone HTML file for offline use.
  • The capa Explorer plugin for IDA Pro helps identify interesting program areas and build capa rules from extracted features.
  • capa supports Ghidra through PyGhidra as a feature extraction backend and provides capa explorer for Ghidra.

How mandiant/capa works

Input enters capa through its command line interface as an executable file or supported sandbox report. The capa directory contains the core Python implementation that extracts features and matches them against capability rules. capa rules describe behaviors that the tool can recognize and extend. The tool produces capability results, while the -vv option adds evidence locations for those results. The web directory provides capa Explorer Web for interactively inspecting results in a browser. The doc directory provides installation and usage documentation, and the tests directory contains tests for the code and rules.

mandiant/capa FAQ

What is capa?

capa is an open-source tool that identifies capabilities in executable files. capa reports behaviors such as service installation, HTTP communication, data decoding, and process creation.

How does capa work?

capa analyzes executable files or supported sandbox reports and matches extracted features against capability rules. capa returns detected capabilities, with -vv showing where it found supporting evidence.

What language is capa written in?

capa is written primarily in Python. capa also supports Ghidra through PyGhidra as a feature extraction backend.

How is the capa code organized?

capa holds the core implementation, tests holds test code, scripts holds utility scripts, and web holds the capa Explorer Web interface. Documentation is in doc.

When should I use capa?

Use capa when analyzing an executable or sandbox report to identify capabilities such as persistence, communication, decoding, or process creation.

What license does capa use?

capa uses the Apache-2.0 license.

The summary, features and answers on this page are written by a model from the README and the source, and refreshed with each index.

About this page

Get a page like this for your own codebase

Repowise built this map of mandiant/capa from its source and git history. It parses every symbol, draws the dependency graph, scores each file's health from complexity, duplication, coverage and churn, finds hotspots and owners in the history, and writes documentation for every module. Your coding agent reads the same index over MCP, so its answers cite real files.

Index your repo freeSee how Repowise worksFree for 2 public repos, with a page like this one.

Prefer local? pip install repowise && repowise init indexes your own checkout, no account needed.