mcp-reverse aggregates 59 reverse-engineering backends, 111 native MCP tools, and a 4,200-skill knowledge base behind a single connection for authorized binary analysis.
| Tool | 1llu50ry/mcp-reverse — TypeScript MCP server unifying reverse-engineering and debugging backends for AI clients |
| Category | Reverse engineering orchestration / MCP server infrastructure |
| Primary Use | Point Claude Code, Codex, or Cursor at a single MCP endpoint to run static triage (analyze_binary), consensus decompilation (smart_decompile), and bm25_search over curated RE knowledge |
| Safe Use | Authorized security research, anti-cheat engineering, malware analysis, CTF work, and defensive analysis of binaries you own or are explicitly authorized to examine; the project's ethics section states it is not a cheat and writes no code into any game |
| Telemetry Note | Runs entirely locally over stdio or HTTP; defenders should note that MCP client logs, docker compose activity, and the 3.3 GiB working tree are the observable footprints on an analyst workstation |
mcp-reverse is one of the more ambitious answers to a problem every reverse engineer knows: the modern toolchain is a pile of disconnected singletons. A typical engagement touches Ghidra, IDA, Binary Ninja, radare2, x64dbg, WinDbg, GDB, LLDB, Cheat Engine, Frida, and a stack of format parsers for PE, ELF, Mach-O, and DEX. The project's core thesis is that an MCP client — Claude Code, Codex, Cursor, Copilot CLI — should be able to drive all of that through one connection instead of the human shuffling between windows. The README frames this as collapsing a day of tool-switching into a single MCP session, and the architecture diagram backs that claim up with concrete numbers: 111 native tools, 59 aggregated backends, and a 4,200+ skill corpus.
Internally the server splits into four layers. The first is the MCP hub, whose smart_decompile primitive is the cleverest piece: it probes which backends are alive and cascades through IDA → Ghidra → Binary Ninja → RetDec before giving up. There is also hub_consensus_call, which fans a request like matcher=decompile out to every connected backend and surfaces disagreements between decompilers — genuinely useful for authorized analysts, since divergent pseudocode often flags obfuscation or a mis-typed function signature. The second layer is the set of native parsers (PE, ELF, Mach-O including fat and arm64e slices, DEX, WASM, Minidump, ZIP, .NET, IL2CPP metadata) so that many questions never need an external backend at all.
The third layer is what the author calls the agent mesh, and it is the part that separates this project from simpler bridge projects like GhidraMCP or ida-pro-mcp. Multiple MCP clients can join a shared mesh with DMs, channels, task handoff, adversarial voting, a shared key-value knowledge base, and named locks for coordination. The README's example — Alice hands driver unpacking to Bob while Cursor reviews the result — is workflow orchestration, not tooling, and it is implemented with zero-dependency JSON persistence rather than a heavyweight message broker. For a defensive team doing triage, this means a Claude Code session can delegate struct recovery to a Codex session while both share state.
The fourth layer is the skill library: roughly 246 hand-written deep references (the README also cites 177 in the features section, so treat the exact split as evolving) covering anti-cheat internals for BattlEye, EAC, Vanguard, VAC, FACEIT, Byfron, Ricochet, and mhyprot, plus 3,985 archived open-source projects with full source dumps prefixed ags-. Search is exposed as a bm25_search MCP tool ranking the corpus by BM25 relevance, which is a pragmatic choice — no embeddings dependency, deterministic ranking, and it works offline. The v5.0.0 release notes are worth reading for engineering discipline alone: the working tree shrank from 19 GiB to 3.3 GiB via gzipped source archives, an 83 percent reduction that signals the maintainers actually care about clone times.
The feature matrix goes well beyond what the game-hacking framing suggests. The verticals table maps the same substrate onto malware analysis (PE, minidump, Rich Header, Debug Directory parsers plus YARA, Volatility, angr, Qiling backends), mobile security (Mach-O, DEX, APK, JADX, Frida, Magisk), firmware and IoT (ELF, Unicorn, angr), and CTF work (pwndbg, GEF, AFL++, honggfuzz, LibAFL, ret-sync behind the hub). The comparison table in the README positions it against GhidraMCP (5 tools, 1 backend), ida-pro-mcp (~50 tools, 1 backend), and REA (~40 tools, 3 backends), none of which have multi-agent support. That comparison is self-serving but factually plausible given the scope described.
Now the uncomfortable part, which an operator should evaluate honestly. The agent catalog includes roles like cheat-developer (ESP, aimbot, overlay rendering), driver-developer, dma-specialist, and hypervisor-researcher, and the subagent list contains entries like stack-spoofer, shellcode-encoder, syscall-stub-generator, and a detection-assessor that evaluates detection risk per anti-cheat system. There is also an exploit-chain-builder plugin. The maintainers are explicit in the ethics section that this exists for security research, cheat detection, and defensive engineering — understanding bypass vectors to harden against them — and equally explicit that it is not a cheat, writes no code into any game, and automates no play. The yara-generator plugin that produces detection rules from cheat patterns supports the defensive reading, but the dual-use surface is real and should be scoped to lab and authorized-assessment environments.
From a defensive analyst's chair, the knowledge base is arguably the most valuable component. Having 3,900+ archived game-security source trees searchable from one BM25 query means that when a suspicious sample references a known injection technique or a specific anti-cheat's structures, an analyst can cross-reference prior art in seconds. The offset-finder subagent does the same for game offsets across the archive, and binary-differ tracks how offsets shift between game updates — a workflow anti-cheat vendors themselves run continuously. These are the same workflows blue teams use to keep detection signatures current.
Setup is conventional for a TypeScript MCP server. A git clone followed by npm install, npx tsc, and npm test gets you a build the README says should pass its test suite (the badge claims 91/91). Wiring it into a client is a one-entry MCP config pointing at dist/index.js in stdio mode, or docker compose up for the HTTP variant if you prefer container isolation. A CLI mode via ./bin/mcp-reverse.mjs lets you run stats, search, or tools without any MCP client at all — handy for scripting or inventory checks before granting an AI client access.
The project is MIT-licensed, written in TypeScript, sits at 423 stars, and ships multi-arch Docker support plus a zero-count npm audit badge, with SECURITY.md and a code of conduct in place. Its practical value for a professional is architectural: it standardizes how AI assistants touch RE tooling, adds consensus and cross-validation across decompilers, and makes a large curated corpus queryable. Use it where you have authorization — your own binaries, engagement scope, malware triage, or CTF targets — and treat the dual-use agent catalog as a reason for careful scoping rather than a reason to ignore a genuinely well-engineered piece of infrastructure.
1llu50ry/mcp-reverse.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.