Pure-Nim network enumeration and remote execution toolkit

nimux - Native Operator Toolkit

nimux is a native command surface for authorized security assessments. It combines network enumeration, lightweight web discovery, credential validation, Active Directory operations, Kerberos workflows, remote execution, file movement, secrets collection, DCSync, GPO operations, database clients, and SOCKS routing into one Pure-Nim toolkit.

Current release: v1.0.7

You are on the official public repository for nimux.

Website: https://nimux.wiki
Documentation: https://docs.nimux.wiki
Source: https://github.com/blue0x1/nimux

Notice

nimux is built for authorized testing only. Do not use it against third-party systems without written permission. Developers are not responsible for misuse, damage, or legal consequences.

Documentation

Usage examples, command references, and workflow notes are maintained in the documentation:

https://docs.nimux.wiki

AI Integrations

Agent guidance and MCP integration files are available in SKILLS.md and integrations/.

The core nimux binary remains independent. AI integrations should call nimux as the native execution engine, prefer --json, use --dry-run before supported writes, and require explicit approval for execution or changes.

MCP Wrapper

nimux-mcp is a separate MCP stdio wrapper for AI clients.

Location:

integrations/mcp/nimux-mcp

Build:

cd integrations/mcp/nimux-mcp
nimble build -y

Example MCP client config:

{
  "mcpServers": {
    "nimux": {
      "command": "/path/to/nimux/integrations/mcp/nimux-mcp/nimux_mcp",
      "env": {
        "NIMUX_BIN": "/usr/local/bin/nimux",
        "NIMUX_MCP_POLICY": "/path/to/policy.json"
      }
    }
  }
}

The wrapper supports MCP Content-Length framed JSON-RPC, local newline-delimited JSON-RPC tests, policy checks, approval gates, redaction, progress notifications, and SOCKS pivot metadata.

https://docs.nimux.wiki/mcp-integration

Installation

Nimble

Nimble builds nimux from source, so native development libraries must be installed first. On Kali, Debian, or Ubuntu:

sudo apt update
sudo apt install -y build-essential ca-certificates git libssl-dev libkrb5-dev
nimble install nimux

Do not run Nimble with sudo. If Nimble reports an SSL certificate error, refresh the system CA store before retrying:

sudo apt install --reinstall ca-certificates
sudo update-ca-certificates
nimble refresh

MinGW-w64 is optional for the base installation, but is required by execution paths that build Windows helper binaries:

sudo apt install -y mingw-w64

Download Release

Prebuilt release assets are available on GitHub:

https://github.com/blue0x1/nimux/releases

Download the latest Linux binary or Debian package from the releases page.

Install the Debian package:

sudo dpkg -i nimux_*_amd64.deb
sudo apt --fix-broken install

Use the standalone Linux binary:

chmod +x nimux
./nimux --help
./nimux --version

Docker

The public container image is available from GitHub Container Registry:

docker run --rm -it --network host ghcr.io/blue0x1/nimux:latest --help

Run a scan:

docker run --rm -it --network host ghcr.io/blue0x1/nimux:latest \
  scan 10.10.10.0/24 --port 445,389,5985 --open

Run lightweight web discovery:

nimux http app.example.local --dirs words.txt --workers 100 --status 200,301,302,403 --baseline
nimux http app.example.local --dirs words.txt --auto-calibrate --recursion --depth 2 --extract-links
nimux http app.example.local --files words.txt --extensions php,txt,bak --workers 100 --filter-regex 'Not Found' -fs 325
nimux http 192.0.2.10 --vhosts vhosts.txt -d app.example.local --workers 100 --resume seen.jsonl --json
nimux dns app.example.local --subdomains subdomains.txt --workers 200 --json

Run read-only SMB spidering:

nimux smb files01.example.local --shares
nimux smb files01.example.local --spider --share Public --max-depth 3
nimux smb files01.example.local --spider --interesting --size-limit 10485760

Run the MCP wrapper:

docker run --rm -i --network host --entrypoint nimux_mcp \
  ghcr.io/blue0x1/nimux:latest

Arch Linux AUR

nimux is available on the AUR:

https://aur.archlinux.org/packages/nimux

Install with an AUR helper:

yay -S nimux

Or build manually:

git clone https://aur.archlinux.org/nimux.git
cd nimux
makepkg -si

BlackArch

nimux is available in BlackArch:

sudo pacman -S nimux

Build From Source

git clone https://github.com/blue0x1/nimux
cd nimux
nimble build -y

Requirements:

Nim 1.6.10 or newer
OpenSSL development libraries
Kerberos libraries
MinGW-w64 for Windows helper builds used by some execution paths

Debian Package

Build a local Debian package from source:

dpkg-buildpackage -us -uc -b
sudo apt install ../nimux_*.deb

Offline BloodHound inspection

bh reads saved BloodHound ZIPs locally. It provides inventory, collection coverage, object search, and direct/nested group membership inspection:

nimux bh collection.zip --summary
nimux bh collection.zip --interesting
nimux bh collection.zip --high-value
nimux bh collection.zip --search alice
nimux bh collection.zip --inspect '[email protected]'
nimux bh collection.zip --summary --json
nimux bh collection.zip --graph --high-value
nimux bh --help

--interesting highlights critical objects, privileged accounts, password-policy exceptions, stale activity, and collection gaps. --high-value shows objects flagged or classified as high-value by well-known domain SIDs.

Graph output

Add --graph to print a directed relationship graph in the terminal. No browser, database, or network connection required. Output stays in normal terminal scrollback and can be redirected.

nimux bh collection.zip --interesting --graph --limit 0
nimux bh collection.zip --graph --from '[email protected]' --to 'DOMAIN [email protected]'
nimux bh collection.zip --graph --inspect '[email protected]'

Scope to a single object with --user, --computer, or --group:

nimux bh collection.zip --user alice --interesting
nimux bh collection.zip --computer dc01 --interesting
nimux bh collection.zip --group 'HELP DESK' --interesting

Supported input: single-volume, unencrypted ZIP with BloodHound JSON schema v5 or v6. No external tools required; analysis runs entirely in-process.

Developer checks:

nim c -r tests/test_bloodhound.nim
nim c -r tests/check_bloodhound_archives.nim /path/to/collection.zip

nimux v1.0.3