Reversecore MCP

AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol

An MCP server that gives AI assistants like Claude and Cursor the ability to perform reverse engineering, malware analysis, vulnerability research, digital forensics, and source code auditing through natural language.

Table of Contents

• What is Reversecore MCP?
• Architecture
• Tool Catalog (120 Tools)
• Guided Analysis Prompts (22 Modes)
• MCP Resources (11 URIs)
• Quick Start
• Connect to Your AI Client
• Configuration
• Security Model
• Development
• CI/CD Pipeline
• Docker Build Architecture
• System Requirements
• Project Structure
• Error Handling
• Adding New Tools
• Contributing
• Documentation
• License

What is Reversecore MCP?

Reversecore MCP is a Model Context Protocol server that wraps 120 analysis tools into a single interface that AI assistants can call through natural language.

Instead of learning the command-line syntax for a dozen different tools, you describe what you want:

"Decompile the main function of this malware sample, extract all network IOCs,
 map the behavior to MITRE ATT&CK, and generate a triage report."

The AI assistant breaks this into tool calls:

r2_decompile("sample.exe", "main")
  → extract_iocs("sample.exe")
    → add_mitre_technique(technique_id="T1071.001", ...)
      → create_analysis_report(template_type="quick_triage")

Each tool returns a structured ToolResult (either ToolSuccess or ToolError) with typed data that the AI can reason about, chain into follow-up queries, or render for the user.

What it covers

Architecture

AI Client (Claude / Cursor / any MCP-compatible client)
        │  MCP Protocol (stdio or HTTP/SSE)
        ▼
┌──────────────────────────────────────────────────────┐
│                   FastMCP 3.4.4 Server               │
│          120 registered tools · Fully async          │
│                  Python 3.10–3.12                    │
├────────────────────┬─────────────────────────────────┤
│   Guided Prompts   │  Dynamic Resources              │
│  (22 analysis      │  (11 URI-based: per-binary      │
│   modes)           │   strings, IOCs, ASM, CFG, …)   │
├────────────────────┴─────────────────────────────────┤
│                  Core Infrastructure                 │
│  Config · Security · Validators · Exceptions (17)    │
│  R2 Pool · Metrics · Memory (SQLite) · Task Queue    │
│  MITRE Mapper · Evidence Engine · Resilience Layer   │
│  Arch Registry (x86/ARM/MIPS/RISC-V/PPC)            │
│  Result Cache (SHA256) · Analysis Cache (Redis+SQL)  │
│  SAST (Python AST + C/C++ Regex) · Plugin System     │
├──────────────────────────────────────────────────────┤
│                 Analysis Engines                     │
│  Radare2 6.0.4     │  YARA 4.3.1 · LIEF · Capstone  │
│  r2ghidra           │  CAPA · angr · Qiling          │
│  Volatility3 · Scapy│ DIE · Binwalk · Sleuth Kit    │
│  pwntools · ROPgadget│ Keystone (assembler)          │
└──────────────────────────────────────────────────────┘

Core Infrastructure (37 modules)

The reversecore_mcp/core/ directory contains the shared infrastructure that all tools build on:

Tool Catalog (120 Tools)

Every tool returns a structured ToolResult — either a ToolSuccess with typed data or a ToolError with an RCMCP-E* error code. Tools are organized into 8 plugins.

🔍 Static Analysis Plugin (24 tools)