Open-ReverseLab is a GPL-3.0 knowledge base and MCP server exposing 100+ reverse-engineering tools for Ghidra, Frida, and x64dbg, designed for authorized researchers and CTF work.
| Tool | LING71671/open-reverselab — open-source AI reverse-engineering agent platform and MCP server wrapping Ghidra, Frida, x64dbg, rizin and a 180-article knowledge base |
| Category | AI-assisted reverse engineering platform / MCP tool server |
| Primary Use | Triaging binaries and automating analysis chains in authorized labs via sample_full_workup, triage_pe, ghidra_headless_analyze and other MCP tools callable from Claude Code or Codex |
| Safe Use | Intended for authorized security assessments, CTF challenges, isolated malware-analysis labs, and defensive research on samples you own or are licensed to analyze |
| Telemetry Note | All outputs land in fixed directories (exports/, reports/, notes/); the env snapshot at ~/.open-reverselab/env/env.md records host toolchains, giving defenders a clear local footprint to audit |
open-reverselab positions itself not as a single tool but as a complete laboratory: an opinionated, runnable knowledge base coupled with an MCP server that exposes more than 100 callable analysis tools to AI agents. Written in Python and licensed under GPL-3.0, the project has accumulated over 1,100 stars and explicitly targets Claude Code, Codex, OpenCode, and any other Model Context Protocol-compatible agent. The core idea is that reverse-engineering knowledge should be executable rather than merely readable — every KB article follows a fixed structure of Scenario → Input signal → Method → Attack chain → MCP tool mapping, so both a human analyst and an agent can start from any observable signal and walk a documented chain to concrete evidence.
The knowledge base itself is substantial: 180+ articles spread across five boards organized by attack surface rather than by tooling. The ctf-website board covers web attack surfaces across 26 categories and 118 articles, from SQLi and SSRF to JWT, OAuth, and CAPTCHA handling. The apk-reverse board handles Android work — APK, DEX, jadx, smali, and native .so analysis — while pe-reverse covers Windows binaries, x64dbg, Ghidra, Procmon, and packer detection. A general board rounds things out with crypto, protocol, firmware, JTAG, and even SDR topics. This breadth matters because it means an agent arriving with an unknown artifact can be routed by the kb_router MCP tool to the right technique cluster automatically.
The MCP layer is where the project becomes operationally interesting. Tools such as triage_pe, ghidra_headless_analyze, android_app_baseline, android_frida_*, die_scan, rizin_*, python_re_tool_*, and http_probe are invoked through a single reverse_lab_tools MCP server, and the flagship entry point is sample_full_workup, which chains triage, static analysis, and reporting into one agent-callable routine. The README is refreshingly honest about verification: mcp_smoke_check.py --write-report performs real MCP invocations and writes a smoke report, and the recommended workflow insists you verify invocation whenever you switch machines or change configs. This is a mature answer to the common failure mode of agent frameworks that silently call nothing.
Repository layout follows what the author calls directory-as-convention: samples/ holds originals and a _quarantine/ area and is never modified, exports/ receives tool outputs including IOC, YARA, Sigma, and Ghidra summaries, patches/ stores patch artifacts with originals preserved, and reports/, notes/, cases/, and projects/ complete the picture. This immutability discipline is good tradecraft for authorized analysis — evidence integrity depends on the original sample never being touched, and the convention enforces it structurally rather than by policy alone. The cases/ directory is a lightweight index, with explicit guidance not to commit large samples or full PCAPs.
Onboarding is deliberately role-based rather than platform-based. Windows users can double-click START_HERE.bat, which checks Python, uv, Git, and the MCP server, then runs real smoke calls and writes reports/misc/first-run-report.json and mcp-smoke-report.json; macOS and Linux users get the equivalent via ./START_HERE.sh. Board-level installs are modular: install_tools.ps1 -CTF pulls web tooling like sqlmap, nuclei, ffuf, and jwt_tool; -Android fetches apktool, jadx, frida, and uber-apk-signer; -Windows gets cutter, pe-bear, and procmon; and -Common installs Ghidra with Maven. Post-install, lab_healthcheck.py, ai_toolcheck.py --board misc, and public_release_check.py confirm the environment is sane.
The agent integration path is thought through in detail. A documented context chain — CLAUDE.md → AGENTS.md → AI-USAGE.md → boards/<board>/AI-USAGE.md — tells the agent how to load knowledge progressively, and new_task.py --board ctf-website --name <name> scaffolds a task workspace. Notably, the project ships an environment snapshot protocol: on first open, the agent inspects your OS, toolchains, libraries, devices, and network, caching the result at ~/.open-reverselab/env/env.md with sensitive variables redacted (keys marked SET, proxy credentials stripped). The snapshot is host-level, shared across sessions, expires after seven days, and is never committed — a privacy-conscious design that still deserves scrutiny from anyone cautious about agents probing their host.
One operational caveat the README handles head-on: installing the CTF board pulls ExploitDB samples and payload documentation, which Windows Defender will flag. The maintainers recommend minimal, targeted path exclusions — for example excluding only tools/ctf-website/exploitdb — rather than whitelisting the whole repository, and they enumerate the specific paths likely to trip detections such as the NoSQL injection technique article and docs/llms-full.txt. For a defensive audience this is useful intelligence: the tool's footprint on a host is predictable and documented, and the recommended exclusions themselves are observable configuration changes worth monitoring.
From a defensive-research perspective, the value proposition is the evidence-chain mindset. The stated goal — from an input signal to an evidence chain, every step runnable — maps cleanly onto how malware analysts and authorized assessors actually work, and the structured exports/ of YARA and Sigma rules means analysis output is directly consumable by detection engineering pipelines rather than trapped in prose. The PUBLICATION.md guidance on what is safe to publish versus what stays in private cases, plus an AI/ML training protections clause, shows the project is thinking about responsible disclosure of findings, not just tooling.
Where does it fit in a professional workflow? For a CTF player it is a searchable, runnable playbook across web, Android, and PE domains. For a researcher triaging a sample, sample_full_workup plus the board AI-USAGE.md documents give a repeatable first-pass methodology. For an agent developer, the MCP surface and the smoke-test discipline make it one of the more rigorous examples of wiring reverse-engineering tools into Model Context Protocol clients. The Sentry sponsorship (error monitoring and performance tracing for the toolchain, since August 2026) and an active Discord community suggest ongoing maintenance rather than a drive-by dump of scripts.
Caveats worth flagging: the project bundles offensive web-testing content by design, so it belongs on isolated analysis machines or dedicated VMs, not general-purpose workstations, particularly given the recommended antivirus exclusions. The host-level environment snapshot, however well-redacted, means an agent is actively probing your system, and reviewers should read AGENTS.md before first run. Within authorized boundaries — your own lab, your own samples, engagement-scoped targets — open-reverselab is a well-architected attempt to make reverse-engineering knowledge executable, and its conventions around immutable samples, structured exports, and verifiable MCP calls set a standard other agent platforms would do well to copy.
LING71671/open-reverselab.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.