Reversecore MCP
AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol
An MCP server that gives AI assistants like Claude and Cursor the ability to perform reverse engineering, malware analysis, vulnerability research, digital forensics, and source code auditing through natural language.
Table of Contents
- What is Reversecore MCP?
- Architecture
- Tool Catalog (151 Tools)
- Guided Analysis Prompts (22 Modes)
- MCP Resources (11 URIs)
- Quick Start
- Connect to Your AI Client
- Configuration
- Security Model
- Development
- CI/CD Pipeline
- Docker Build Architecture
- System Requirements
- Project Structure
- Error Handling
- Adding New Tools
- Contributing
- Documentation
- License
What is Reversecore MCP?
Reversecore MCP is a Model Context Protocol server that wraps 151 analysis tools into a single interface that AI assistants can call through natural language.
Instead of learning the command-line syntax for a dozen different tools, you describe what you want:
"Decompile the main function of this malware sample, extract all network IOCs,
map the behavior to MITRE ATT&CK, and generate a triage report."
The AI assistant breaks this into tool calls:
r2_decompile("sample.exe", "main")
→ extract_iocs("sample.exe")
→ add_mitre_technique(technique_id="T1071.001", ...)
→ create_analysis_report(template_type="quick_triage")
Each tool returns a structured ToolResult (either ToolSuccess or ToolError) with typed data that the AI can reason about, chain into follow-up queries, or render for the user.
What it covers
| Domain | What you can do |
|---|---|
| Static analysis | Disassembly, decompilation (r2ghidra), binary parsing (LIEF), packer detection (DIE), capability detection (CAPA), string extraction, firmware scanning (binwalk) |
| Dynamic & symbolic | ESIL emulation, angr symbolic execution, taint analysis, fuzzing harness generation |
| Malware analysis | IOC extraction, YARA scanning, dormant backdoor detection, adaptive vaccine generation, autonomous vulnerability hunting |
| Vulnerability research | Dangerous API detection, ROP gadget discovery, heap exploit analysis, crash triage, PoC generation |
| Digital forensics | Memory forensics (Volatility3), PCAP analysis (Scapy), disk forensics (Sleuth Kit), artifact correlation |
| Source code audit | Python AST scanning, C/C++ regex pattern scanning |
| Reporting | Session-based reports with MITRE ATT&CK mapping, SIGMA rule generation, VEX reports, email delivery |
Architecture
AI Client (Claude / Cursor / any MCP-compatible client)
│ MCP Protocol (stdio or HTTP/SSE)
▼
┌──────────────────────────────────────────────────────┐
│ FastMCP 3.4.4 Server │
│ 151 registered tools · Fully async │
│ Python 3.10–3.12 │
├────────────────────┬─────────────────────────────────┤
│ Guided Prompts │ Dynamic Resources │
│ (22 analysis │ (11 URI-based: per-binary │
│ modes) │ strings, IOCs, ASM, CFG, …) │
├────────────────────┴─────────────────────────────────┤
│ Core Infrastructure │
│ Config · Security · Validators · Exceptions (17) │
│ R2 Pool · Metrics · Memory (SQLite) · Task Queue │
│ MITRE Mapper · Evidence Engine · Resilience Layer │
│ Arch Registry (x86/ARM/MIPS/RISC-V/PPC) │
│ Result Cache (SHA256) · Analysis Cache (Redis+SQL) │
│ SAST (Python AST + C/C++ Regex) · Plugin System │
├──────────────────────────────────────────────────────┤
│ Analysis Engines │
│ Radare2 6.0.4 │ YARA 4.3.1 · LIEF · Capstone │
│ r2ghidra │ CAPA · angr · Qiling │
│ Volatility3 · Scapy│ DIE · Binwalk · Sleuth Kit │
│ pwntools · ROPgadget│ Keystone (assembler) │
└──────────────────────────────────────────────────────┘
Core Infrastructure (37 modules)
The reversecore_mcp/core/ directory contains the shared infrastructure that all tools build on:
| Module | Purpose |
|---|---|
config.py |
Pydantic BaseSettings with 34+ environment variables |
security.py |
Input sanitization, command argument validation |
validators.py |
File and binary path validation with TOCTOU mitigation, symlink resolution |
r2_pool.py |
Thread-safe Radare2 connection pool with configurable size |
r2_helpers.py |
Structured Radare2 output parsing |
metrics.py |
Per-tool execution times, call counts, error rates, cache statistics |
memory.py |
Async SQLite-backed AI memory store for persisting analysis findings across sessions |
mitre_mapper.py |
MITRE ATT&CK technique ID mapping engine |
evidence.py |
Evidence classification system: OBSERVED, INFERRED, POSSIBLE |
resilience.py |
Retry, circuit-breaker, and timeout decorator patterns |
task_queue.py |
Background task queue via Redis + arq |
extension_registry.py |
Plugin registration and lifecycle management |
arch_registry.py |
Multi-architecture mapping (x86, x86_64, ARM32, ARM64, MIPS, RISC-V, PPC → r2 arch/bits/registers) |
result_cache.py |
SHA256-based tool result caching decorator (@cache_tool_result) |
analysis_cache.py |
Multi-level decompilation cache (L1: Redis, L2: SQLite) |
result.py |
ToolSuccess / ToolError Pydantic models |
exceptions.py |
17 exception classes with RCMCP-E* error codes |
decorators.py |
@log_execution, @track_metrics |
error_handling.py |
@handle_tool_errors decorator |
error_formatting.py |
Structured error response formatting |
execution.py |
Safe subprocess execution with timeout and output limits |
command_spec.py |
Command specification for subprocess calls |
loader.py |
Dynamic tool module loader |
plugin.py |
Plugin base class |
extension.py |
Extension base class |
container.py |
Container/sandbox execution support |
audit.py |
Audit logging |
binary_cache.py |
Binary file caching |
json_utils.py |
JSON serialization via orjson (3-5x faster than stdlib json) |
logging_config.py |
Loguru-based structured logging |
report_generator.py |
Report rendering engine (Markdown, PDF via xhtml2pdf) |
resource_manager.py |
MCP resource lifecycle management |
sast/python_ast_scanner.py |
Python AST-based vulnerability scanner |
sast/regex_scanner.py |
C/C++ regex-based vulnerability scanner |
sast/rule_manager.py |
SAST rule loading and management |
Tool Catalog (151 Tools)
📖 Authoritative Tool Catalog & Parameter Reference (151 Tools) 📊 Tool Profile Footprint & Context Benchmark Matrix
Every tool returns a structured ToolResult — either a ToolSuccess with typed data or a ToolError with an RCMCP-E* error code. Tools are organized into 11 domain plugins across 5 modular execution profiles (full, static, malware, forensics, vuln-research):
| Profile | Registered Tools | Schema Size | LLM Context Saving vs Full | Recommended Domain |
|---|---|---|---|---|
full |
151 | 112.6 KB | Baseline (0%) | Complete enterprise reverse engineering suite |
vuln-research |
103 | 70.2 KB | -37.7% (~10,800 tokens) | Fuzzing, ASan crash triage, CVE hunting, exploit research |
static |
97 | 64.8 KB | -42.5% (~12,200 tokens) | Disassembly, decompilation (r2ghidra), LIEF, static triage |
malware |
65 | 59.4 KB | -47.2% (~13,600 tokens) | Threat triage, YARA scanning, deobfuscation, anti-analysis |
forensics |
57 | 36.4 KB | -67.7% (~19,500 tokens) | Memory forensics (Volatility3), network PCAP (Scapy), disk |
🔍 Static Analysis Plugin (24 tools)
| # | Tool | Backend | Description |
|---|---|---|---|
| 1 | run_strings |
strings CLI |