name: reversecore-mcp description: Reverse engineer native binaries (PE/ELF/Mach-O), stripped Go and Rust executables, Electron ASAR desktop apps, Unity IL2CPP games, network PCAPs, and memory dumps with Reversecore_MCP. Use summary-first paging, r2ghidra decompilation, ESIL emulation, and feature code reconstruction with behavioral equivalence verification. metadata: version: "1.0.0"

Reversecore_MCP Agent Skill

Use Reversecore_MCP whenever a task requires analyzing compiled binaries, decompiling native code, unpacking Electron .asar applications, recovering stripped Go/Rust or Unity IL2CPP metadata, triaging crashes/vulnerabilities, analyzing malware/forensics artifacts, or reconstructing binary features into clean C/Python code.

1. Quick Setup & Connection

If Reversecore_MCP tools are not yet registered in the current client environment, configure them with a single command:

# Automatic multi-client setup (Cursor, Claude Code, Windsurf, Claude Desktop, Codex, Gemini, Kimi)
python -m reversecore_mcp setup

# Or enable Tiered Mode (15 core/router tools, >94% prompt token reduction)
python -m reversecore_mcp setup --tiered

2. Route the Target First

Choose the initial tool directly from the target artifact type:

• Unknown Binary / Executable Triage:
  1. run_file(file_path) — identify file format, architecture, and ABI.
  2. parse_binary_with_lief(file_path) — inspect sections, imports, exports, and security mitigations (ASLR, DEP/NX, PIE, Canary).
• Stripped Go or Rust Binary:
  • inspect_go_rust_binary(file_path, detail="summary") — recovers gopclntab function names, Go buildinfo modules, Rust .dep-v0 (cargo-auditable) crate graphs, and demangled _ZN...E symbols without needing a disassembler.
• Electron Application (app.asar):
  • inspect_electron_asar(file_path, detail="summary") — parses Chromium Pickle headers in pure Python, inventories bundled JS/JSON/native .node files, audits BrowserWindow security flags (nodeIntegration, contextIsolation), extracts ipcMain/ipcRenderer channels, and optionally unpacks sources via extract_path.
• Unity IL2CPP Game (global-metadata.dat + libil2cpp.so / GameAssembly.dll):
  • inspect_unity_il2cpp(metadata_path, binary_path=..., detail="summary") — validates 0xFAB11BAF sanity magic, extracts C# string literals, namespaces, class names, and method identifiers, or flags encrypted metadata headers.
• Native Function Disassembly & Decompilation (Radare2 + r2ghidra):
  • Radare2_open_file(file_path) -> Radare2_list_functions(file_path)
  • r2_decompile(file_path, function_address, detail="summary") or Radare2_decompile_function(file_path, address, detail="summary").
• Feature Reconstruction & Behavioral Equivalence Loop:
  • reconstruct_feature_code(file_path, address_or_symbol, target_language="python", test_inputs=[...]) — decompiles the target routine, synthesizes idiomatic modern C or Python code, checks structural branch/API parity, and verifies behavioral equivalence via Radare2 ESIL emulation.
• Vulnerability Research & Crash Triage:
  • vulnerability_hunter(file_path), triage_crash(file_path, crash_log=...), build_rop_chain(file_path), or call_expert_agent(agent_name="vulnerability_hunter", ...).
• Malware & DFIR Forensics:
  • extract_iocs(file_path), run_capa_quick(file_path), dormant_detector(file_path), pcap_analyze(pcap_path), memory_analyze(dump_path).

3. Work Summary-First & Paginate via evidence_id

To prevent LLM context window overflow on large binaries:

1. Call with detail="summary": Tools such as Radare2_disassemble, Radare2_disassemble_function, Radare2_decompile_function, r2_decompile, Radare2_list_strings, Radare2_list_all_strings, memory_extract_strings, inspect_go_rust_binary, inspect_electron_asar, and inspect_unity_il2cpp return high-level metrics plus a retained evidence_id (e.g. ev_8f3a92b1c4d0).
2. Paginate & Filter with inspect_analysis_view:

   {
     "evidence_id": "ev_8f3a92b1c4d0",
     "facet": "strings",
     "offset": 0,
     "limit": 50,
     "filter_query": "https://"
   }
   

3. Discover On-Demand Documentation: Whenever encountering an unfamiliar format or workflow, call search_guidance(query="...") followed by read_guidance_section(locator="...") instead of guessing tool parameters.

4. Epistemological Discipline (Anti-Hallucination Contract)

Every reverse engineering report or reconstruction must separate three epistemic categories:

1. Observations: Facts directly proven by raw tool bytes, addresses, or instructions.
2. Inferences: Analytical hypotheses derived from observations (e.g. algorithm identification from constants).
3. Residual Unknowns: Unresolved indirect calls (call rax), stripped external imports, unexecuted branches, or truncated pages.
4. No Proof of Absence: Never claim a binary lacks a behavior solely because a summary or filtered view did not show it.

English · 한국어 · 日本語 · 简体中文

Reversecore MCP

AI-Powered Binary Reverse Engineering, Malware Analysis & Vulnerability Research via MCP

An enterprise-grade Model Context Protocol server for malware triage, decompilation, modern runtime security auditing (Go/Rust, Electron, Unity), crash analysis, and digital forensics — backed by verifiable byte-level evidence.

Quick Start · Security Analysis Workflows · Supported Targets · Context Efficiency · Tool Catalog (186 Tools) · FAQ

⚡ Instant One-Line Setup

Automatically detects installed AI clients (Cursor, Claude Code, Windsurf, Claude Desktop, OpenAI Codex, Antigravity, Cline/Roo Code) and registers Reversecore MCP with automatic configuration backups:

# Option 1: Zero-install CLI setup (Recommended)
pipx run reversecore-mcp setup

# Option 2: One-line shell installer (macOS / Linux)
curl -fsSL https://raw.githubusercontent.com/sjkim1127/Reversecore_MCP/main/install.sh | bash

# Option 3: Install Agent Skill (skills.sh / Cursor / Claude Code / Codex)
npx skills add sjkim1127/Reversecore_MCP

💡 Reduce LLM context token usage by 94.4%: Run pipx run reversecore-mcp setup --tiered to expose 15 core security tools + 8 domain sub-agents while keeping all 186 tools callable on demand.

Table of Contents

• What is Reversecore MCP?
• 🛡️ Security Analysis Workflows
• What You Can Analyze
• ⚡ Context Efficiency: Tiered Router, Compact Schema & Paging
• Architecture
• Tool Catalog (186 Tools)
• Guided Analysis Prompts (34 Modes)
• MCP Resources (11 URIs)
• Quick Start
• Connect to Your AI Client
• Configuration
• Security Model
• Development
• CI/CD Pipeline
• Docker Build Architecture
• System Requirements
• Project Structure
• Error Handling
• Adding New Tools
• Contributing
• Documentation
• License

What is Reversecore MCP?

Reversecore MCP is a Model Context Protocol server that wraps 186 analysis tools into a unified interface for AI-assisted security research, malware triage, vulnerability discovery, and digital forensics.

Instead of manually switching between disassemblers, decompilers, YARA scanners, and forensics utilities, you describe your investigation goal in natural language:

"Decompile the main payload of this suspicious sample, recover its custom string decryption
 routine, extract all C2 IOCs, map behaviors to MITRE ATT&CK, and generate a triage report."

Each tool runs locally (or inside an isolated Docker container) and returns a structured ToolResult (ToolSuccess or ToolError) with byte-level provenance so the AI can chain multi-step security investigations without hallucinating findings.

🛡️ Security Analysis Workflows

Workflow 1: Malware Cryptor / DGA Recovery & Safe Emulation Verification

Modern malware families encrypt C2 configurations or generate domains dynamically (DGA). Translating decompiled C into a Python decryptor by hand is error-prone due to subtle 32/64-bit integer wrap-around and bitwise shifts. Reversecore MCP reconstructs the routine and verifies 100% behavioral equivalence inside Radare2's ESIL CPU emulator without executing live malware on the host.

Prompt:

"Analyze the config decryption function at 0x401180 in sample.bin, write a safe Python
 decryptor script, and verify with ESIL emulation that its output matches the binary."

Agent Tool Chain & Verified Output:

1. r2_decompile("sample.bin", "0x401180", detail="summary")
   └─ Returns compact complexity/API summary + cache handle: evidence_id="ev_9a4c102f8b11"

2. inspect_analysis_view(evidence_id="ev_9a4c102f8b11", facet="lines", offset=0, limit=40)
   └─ Streams exact pseudo-C lines on demand without exhausting context window

3. reconstruct_feature_code(
       file_path="sample.bin",
       address_or_symbol="sym.decrypt_word",
       target_language="python",
       test_inputs=["0x0", "0xff", "0xffff"]
   )
   ├─ Decompilation & Synthesis: r2ghidra -> clean Python function (decrypt_word)
   ├─ Binary Emulation: Radare2 ESIL VM (isolated register/memory state, zero host execution)
   ├─ Equivalence Verdict: VERIFIED (branch_parity: true, test_vectors_evaluated: 3, emulation_successful: true)
   └─ Reconstructed Code:
        def decrypt_word(param_1: Any = 0, param_2: Any = 0, *args: Any, **kwargs: Any) -> Any:
            uVar1 = (param_1 ^ param_2) * 0x45d9f3b
            return uVar1 >> 0x10 ^ uVar1

Workflow 2: Modern Runtime Threat & Supply-Chain Auditing (Go/Rust, Electron ASAR, Unity)

Threat actors increasingly write cross-platform ransomware in stripped Go/Rust or distribute trojanized Electron (app.asar) desktop installers. Reversecore MCP provides built-in pure-Python static parsers to recover stripped symbols and audit runtime security boundaries:

Prompt:

"Audit this suspicious installer's app.asar for insecure BrowserWindow settings and
 suspicious IPC handlers, and recover function symbols from its bundled stripped Go helper."

Agent Tool Chain & Verified Output:

1. inspect_electron_asar("app.asar", search_pattern="ipcMain|child_process|shell")
   ├─ Format: Chromium Pickle ASAR (header_size: 48,210 bytes, 642 files)
   ├─ Exposed IPC Handlers: 14 channels mapped across main and preload scripts
   └─ Security Audit Findings:
        • [HIGH] nodeIntegration: true detected in BrowserWindow configuration
        • [MEDIUM] sandbox: false detected in renderer window options

2. inspect_go_rust_binary("helper_daemon.elf")
   ├─ Runtime Detected: Go (gopclntab magic 0xfffffff1, Go 1.22)
   ├─ Symbol Recovery: 148 stripped package/function names recovered from .gopclntab
   └─ Suspicious Packages Identified:
        • main.establishBeaconLoop @ 0x48a200
        • main.encryptLocalVolume  @ 0x48b940

Workflow 3: Zero-Day Crash Triage, Taint Analysis & Adaptive YARA/Vaccine Generation

From an ASan/GDB crash log or a packed binary with dormant logic bombs, Reversecore MCP chains crash classification, source-to-sink taint reachability, and automated detection rule synthesis.

Prompt:

"Triage this ASan crash log on daemon.bin, verify whether untrusted network input reaches
 the vulnerable memcpy sink, scan for dormant backdoors, and generate a YARA rule."

Agent Tool Chain & Verified Output:

1. cve_triage_crash(crash_log_or_text=asan_log)
   └─ Bug Class: heap-buffer-overflow (READ) | CWE-125 | Faulting Function: parse_packet+0x84

2. taint_trace("daemon.bin", function_name="parse_packet", verify_with_angr=True)
   └─ Source→Sink Confirmed: recv() → memcpy() at 0x402190 (unbounded length field)

3. dormant_detector("daemon.bin")
   └─ Discovered 1 orphan function (0x404800) with time-bomb trigger (cmp eax, 0x67758ac0)

4. adaptive_vaccine(threat_report={...}, action="both")
   ├─ Generated YARA detection rule with wildcarded address displacement masking
   └─ Synthesized binary mitigation patch neutralizing the vulnerable/malicious branch

What You Can Analyze