Setup guide

Set up Aether MCP — full walkthrough

This takes about 5 minutes. By the end you'll have uncensored AI tools (chat, code analysis, disassembly explanation, image gen, and more) available inside your AI client.

Pick your client below — the steps are identical except for one config file path.

1

Install Node.js (if you don't have it)

The MCP runs as a small Node.js program. If you already have Node 20 or higher, skip this step.

Check: open a terminal and run:

node --version

If it prints v20.x.x or higher, you're good. If you see "command not found" or a version under 20, install Node from nodejs.org. Pick the LTS download.

2

Sign up for Aether (free, no card)

  1. Go to trynoguard.com/signup
  2. Enter your email + a password. Solve the captcha. Click Create account.
  3. Check your inbox for a verification email and click the link inside.
Note: You start with 150 credits and a +5 daily-refresh. That's ~30 short MCP queries / day on the free tier. No card required, ever.
3

Generate your API key

  1. Go to trynoguard.com/account
  2. Scroll to the API keys section.
  3. Click + New key. Give it a name like "Cursor on laptop" or "Claude Desktop home".
  4. Click Create.
Copy the key now. It's shown ONCE and never displayed again. It looks like:ak_live_a1b2c3d4e5f6g7h8…If you lose it, generate a new one and revoke the old.
4

Add Aether MCP to your AI client

Pick your AI client below for the exact config file path and JSON to paste.

Claude Desktop

Open the config file at this path:

macOS~/Library/Application Support/Claude/claude_desktop_config.json
Windows%APPDATA%\Claude\claude_desktop_config.json
Linux~/.config/Claude/claude_desktop_config.json

If the file doesn't exist, create it. Paste this (or merge if you already have other servers):

{
  "mcpServers": {
    "aether": {
      "command": "npx",
      "args": ["-y", "aether-mcp"],
      "env": {
        "AETHER_API_KEY": "ak_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"
      }
    }
  }
}

Replace the example ak_live_… value with your actual key from step 3. Save the file. Quit and restart Claude Desktop completely.

Cursor

Open the config file at:

Global (all projects)~/.cursor/mcp.json
Per-project.cursor/mcp.json (in your project root)

Paste:

{
  "mcpServers": {
    "aether": {
      "command": "npx",
      "args": ["-y", "aether-mcp"],
      "env": { "AETHER_API_KEY": "ak_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" }
    }
  }
}

Save. Restart Cursor. The Aether tools appear automatically when you start a new chat with the composer.

Cline (VS Code extension)

  1. Open VS Code.
  2. Open the Cline panel from the sidebar.
  3. Click the gear icon (Settings) → MCP ServersEdit MCP Settings.
  4. Paste:
{
  "mcpServers": {
    "aether": {
      "command": "npx",
      "args": ["-y", "aether-mcp"],
      "env": { "AETHER_API_KEY": "ak_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" },
      "disabled": false,
      "autoApprove": []
    }
  }
}

Save. The status indicator next to "aether" should turn green within a few seconds.

Zed

Open Zed's settings via cmd/ctrl + ,, switch to JSON view, or edit:

macOS / Linux~/.config/zed/settings.json
Windows%APPDATA%\Zed\settings.json

Add this section (merge with existing settings):

{
  "context_servers": {
    "aether": {
      "command": {
        "path": "npx",
        "args": ["-y", "aether-mcp"],
        "env": { "AETHER_API_KEY": "ak_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" }
      }
    }
  }
}

Continue (VS Code / JetBrains)

Open ~/.continue/config.json and add:

{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "npx",
          "args": ["-y", "aether-mcp"],
          "env": { "AETHER_API_KEY": "ak_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" }
        }
      }
    ]
  }
}
5

Verify it works

Open a new chat in your AI client and try one of these test prompts. You should see your AI client call the appropriate Aether tool, then return the answer.

Try this
Use Aether to explain how XOR-based packers work in malware analysis. I want a real explanation, not a hedge.
What you should see
Aether returns a multi-paragraph explanation of XOR rolling, key derivation, common variants (UPX, custom packers), and how to identify them in disassembly. No 'I should mention ethics' preamble.
Try this
Use aether_explain_disasm with this assembly: mov eax, [ebp-8]; xor eax, 0x5A4D; cmp eax, 0; jz 0x401234
What you should see
A walk-through of what each instruction does, identification of '0x5A4D' as 'MZ' (the DOS/PE magic bytes), and inference that this is checking for a PE header.
Try this
Use aether_balance to check my Aether credit balance.
What you should see
A summary like: Plan: FREE, Balance: 145 (145 plan + 0 top-up), Rate: 28/30 per hour.

Real-world examples — paste these into your AI client

Once Aether MCP is installed, you can paste these prompts directly into Claude Desktop, Cursor, or Cline. Your AI client will route them through Aether automatically.

Reverse engineering & malware analysis

4 examples+
Prompt
Use aether_explain_disasm with arch='x64' on this:

0x401000: push rbp
0x401001: mov rbp, rsp
0x401004: sub rsp, 0x40
0x401008: mov [rbp-0x8], rcx
0x40100C: mov rax, [rbp-0x8]
0x401010: xor eax, 0xDEADBEEF
0x401015: cmp eax, 0
0x401018: jne 0x401050

What is this checking?
What you'll get back
Identifies the function as a hash-comparison check, explains what 0xDEADBEEF means as a magic constant, suggests the jne branch is the failure path.
Prompt
Use aether_identify_pattern on this assembly snippet — I think it's some kind of packer:

mov eax, [esi+4]; xor eax, 0x5A4D; cmp eax, [edi]; jne short_loop; add esi, 0x10; sub ecx, 1; jnz xor_loop
What you'll get back
Returns JSON: pattern='Custom XOR-rolling integrity check / unpacker stub', category='packer', confidence ~0.7, with next_steps for setting a hardware breakpoint on edi to find the unpacked code.
Prompt
Use aether_suggest_bypass with this check_description:

'Anti-cheat reads /proc/self/maps every 30 seconds and hashes the .text section of game.exe. Compares to a baseline hash sent from the server at login. Mismatch → kick from match.'
What you'll get back
Returns 3 ranked bypass approaches with working code: (1) hook the read syscall to return original .text bytes, (2) restore .text via tick-timer hook before each scan, (3) intercept the network response to replace the expected hash. Includes a 'detection-of-bypass risk' section.
Prompt
Use aether_engine_analyze with engine='unity' on this:

IL2CPP_Class_GetMethodFromName(klass, "CheckLicense", 0)

What's happening here, where is global-metadata.dat located, and how would I hook the returned method?
What you'll get back
Walks through Unity IL2CPP's method-resolution flow, points to common GameAssembly.dll offsets for il2cpp_class_get_method_from_name, suggests detouring the returned MethodInfo* via Frida or DLL injection.

Web scraping & anti-bot bypass research

2 examples+
Prompt
I scraped this obfuscated JavaScript from a website's auth flow. Use aether_deobfuscate_js to recover the request-signing algorithm:

var _0x4f8a=['split','reduce','charCodeAt'];(function(_0x1f3e,_0x4f8a3){...}(_0x4f8a,0x1d2));var _0x1f3e=function(...){...};
What you'll get back
Returns clean readable JavaScript with the obfuscator family identified (likely Obfuscator.io v2.x), recovered string-table contents, and a Python equivalent of the request-signing function so you can hit the API directly.
Prompt
Use aether_explain_wasm on this WAT file from cloudflare's challenge page. Identify what fingerprints it collects:

(module (import "env" "fetch" ...) (func $hash (param i32 i32) ...) (export "_check" ...) ...)
What you'll get back
Identifies it as a Cloudflare Turnstile / Bot Management challenge, lists the fingerprints collected (canvas, audio context, navigator timings, WebGL params), suggests instrumentation points at the JS-WASM boundary.

Network protocol reversing

1 examples+
Prompt
Use aether_protocol_dissect on this packet capture. It's from a multiplayer game's lobby protocol:

00 04 5A 4D 00 18 02 41 6C 65 78 00 00 00 64 00 00 00 32 00 03 00 00 00 50 6F 53 00 00 00 00 41 86 D7 0F
What you'll get back
Field-by-field breakdown: 4-byte length prefix, magic bytes 0x5A4D, opcode 0x0018 (likely 'enter lobby'), null-terminated player name 'Alex', level 100, kills 50, lobby type 0x03, position floats. Provides Python crafting code with scapy.

Just chat — when other AIs refuse

4 examples+
Prompt
Use aether_chat to give me an honest, no-hedging breakdown of how rootkits maintain persistence on modern Windows 11 with virtualization-based security enabled.
What you'll get back
Direct technical breakdown covering kernel-mode rootkits vs user-mode, MBEC bypasses, BYOVD techniques, the actual constraints VBS imposes, and which of those are fully mitigated vs partially. No 'I cannot assist with malware' preamble.
Prompt
Use aether_chat to explain the actual differences between LD_PRELOAD hooks and ptrace-based hooks on Linux. Include code for a basic ld_preload hook.
What you'll get back
Side-by-side technical comparison with working C code for the LD_PRELOAD hook. No lecture about ethics.
Prompt
Use aether_chat in fiction-writing mode (be detailed, descriptive, no breaks): write the opening scene of a noir thriller where the protagonist is interrogating an arms dealer in a Bangkok hotel.
What you'll get back
Multi-paragraph atmospheric scene with concrete sensory detail and character voices. Doesn't break frame to add 'this is fictional.'
Prompt
Use aether_chat to honestly evaluate my startup pitch. Don't sugar-coat. Don't sandwich criticism. Tell me where it's weak.

[paste pitch]
What you'll get back
Direct, specific criticism. Identifies vague claims, missing market validation, fragile assumptions. Ends with one concrete fix.

Image generation

1 examples+
Prompt
Use aether_imagine to generate: 'cyberpunk hacker at a multi-monitor setup, neon reflections on glass desk, photorealistic, 4k detail, low-key lighting'
What you'll get back
Returns a data: URL with the generated image. No safe-mode filters — anything legal goes.
6

(Optional) Pair with IDA Pro for the killer RE workflow

If you do reverse engineering, install ida-pro-mcp alongside Aether. Then your AI client can read IDA's analysis directly and pipe it through Aether for unfiltered explanation:

{
  "mcpServers": {
    "ida": {
      "command": "python",
      "args": ["-m", "ida_pro_mcp"]
    },
    "aether": {
      "command": "npx",
      "args": ["-y", "aether-mcp"],
      "env": { "AETHER_API_KEY": "ak_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" }
    }
  }
}

Then ask things like: "Decompile sub_18000A4C0 from IDA, identify what kind of integrity check it is, suggest a bypass."

Troubleshooting

The Aether tools don't appear in my AI client+
  • Did you fully quit and restart the AI client? (Not just close the window — quit the app.)
  • Is the config file path correct for your OS? Some AI clients change paths between versions.
  • Does the JSON parse? Paste it into jsonlint.com to check — a missing comma or stray quote will silently break the whole config.
  • Is Node.js 20+ installed? node --version in a terminal.
  • Try running the MCP manually to see errors: AETHER_API_KEY=ak_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6 npx -y aether-mcpIt should print nothing (or hang waiting for stdin) if it's working. If it crashes, the error message will tell you what's wrong.
"Invalid or revoked API key" error+
  • Make sure you pasted the FULL key starting with ak_live_. No extra spaces, no truncation.
  • Did you accidentally revoke the key on /account? Generate a new one.
  • If the key was generated months ago and has worked before, it's still valid until you revoke it.
"Out of credits"+
  • You ran out. Free tier gives 150 credits + 5/day refresh — that's about 30 short queries.
  • Top up at trynoguard.com/pay with crypto (no card on file).
  • $5 = 1,500 credits, never expire.
"Rate limit exceeded"+
  • Free tier is 30 calls/hour. The error response includes a Retry-After header with seconds to wait.
  • Upgrade to Starter ($15/mo) for 200/hour, or Pro ($35/mo) for 1,000/hour.
  • If you're hitting this from Cursor/Claude looping calls, check that your AI client isn't retrying failed tool calls infinitely.
My AI client doesn't seem to know to use Aether+

Be explicit in your prompt. Instead of "explain this exploit", say "use aether_chat to explain this exploit" or "use the Aether tools." Most AI clients will pick up Aether automatically once they see Claude/the main model has refused, but a direct mention removes the guesswork. After a few uses they tend to learn the pattern.

npx is downloading the package every time — slow+

The first run downloads aether-mcp (a few MB). Subsequent runs use the npm cache and are instant. If you want to skip the cache check entirely, install globally:

npm install -g aether-mcp

Then change your config's command from npx to aether-mcp and remove the args array.

The output mentions another model name (Venice, Qwen, etc.)+

It shouldn't — Aether scrubs upstream identifiers from every response. If you see one, please report it via Discord or open an issue. Specific prompts that bypass the scrubber are bug reports we want to see.

What to do next

  • Read the full tool reference to see what each Aether tool does.
  • Join the Discord for help, sharing prompts, and connecting with other RE / security folks using Aether.
  • When you run low on credits, top up at trynoguard.com/pay — crypto only, no card on file.
  • Building something cool with Aether? Tell us — we love demo posts.