Reversecore_MCP is a Model Context Protocol server exposing 186 reverse-engineering tools to AI agents for authorized malware triage, decompilation, and vulnerability research with byte-level evidence.
| Tool | sjkim1127/Reversecore_MCP — MCP server wrapping 186 reverse-engineering and forensic tools behind an AI-agent interface |
| Category | Reverse engineering / MCP server / SAST and malware analysis automation |
| Primary Use | Authorized malware triage, decompilation via r2ghidra, crash analysis, and digital forensics driven by natural-language prompts |
| Safe Use | Intended for defenders and authorized security professionals analyzing samples in labs, isolated Docker containers, or sanctioned incident-response and code-audit engagements |
| Telemetry Note | Runs locally or in isolated containers; the emphasis on ESIL emulation over live execution means suspicious code is not run on the host, aiding safe forensic observation |
Reversecore_MCP is a security-first Model Context Protocol server that packages 186 analysis tools into a single interface so AI clients like Cursor, Claude Code, Windsurf, Claude Desktop, OpenAI Codex, Antigravity, and Cline/Roo Code can drive full binary investigations in natural language. Rather than manually orchestrating disassemblers, decompilers, YARA scanners, and forensic utilities, the analyst states an investigation goal — for example, decompiling a payload and mapping behaviors to MITRE ATT&CK — and the agent chains the appropriate tools. Written in Python (3.10–3.12) under an MIT license, the project sits at around 220 stars on GitHub and is published to PyPI as reversecore-mcp.
The architecture claim that stands out in the README is verifiability: every tool invocation returns a structured ToolResult — ToolSuccess or ToolError — carrying byte-level provenance, including cache handles like evidence_id values that downstream steps can reference. This directly attacks the hallucination problem in AI-assisted reverse engineering. Instead of trusting a model's narrative about a binary, the agent is forced to cite decompiled lines, addresses, and emulation verdicts that were actually produced by deterministic engines underneath. For professional triage, that evidence chain is what makes agent output defensible in a report.
The underlying engine stack is a familiar one for RE practitioners: Radare2 with r2ghidra for decompilation across x86, x64, ARM32, ARM64, MIPS, RISC-V, and PowerPC, LIEF for binary format parsing, YARA and CAPA for behavioral capability mapping, DIE for packer identification, angr with pwntools and ROPgadget for symbolic execution and crash work, plus Volatility3, Scapy, Sleuth Kit, and Binwalk for memory, network, and disk forensics. What Reversecore_MCP adds is the orchestration layer — a catalog of 186 tools, 34 guided analysis prompt modes, and 11 MCP resource URIs that make this machinery addressable by an LLM.
One of the most interesting workflows documented is cryptor and DGA recovery. Modern malware families encrypt their C2 configurations or generate domains algorithmically, and hand-translating decompiled C into a Python decryptor is notoriously error-prone thanks to 32/64-bit integer wraparound and shift semantics. The reconstruct_feature_code tool decompiles a routine via r2ghidra, synthesizes a clean Python function, and then verifies behavioral equivalence inside Radare2's ESIL CPU emulator — an isolated register and memory state with zero host execution of the malware. The README shows an equivalence verdict with branch parity and evaluated test vectors, which is exactly the kind of check a human analyst would otherwise do by hand and sometimes get wrong.
Coverage of modern runtime targets is a differentiator. The server ships pure-Python static parsers for stripped Go binaries (recovering package and function names from .gopclntab across go1.2 through go1.20+), Rust binaries (dependency trees via .dep-v0 / cargo-auditable metadata), Electron app.asar archives, and Unity IL2CPP builds. These require no Go, Rust, or Unity SDKs installed, which matters because cross-platform ransomware written in stripped Go and trojanized Electron installers are increasingly common in real incident response. The inspect_electron_asar example maps ipcMain handler surface and flags misconfigurations like nodeIntegration: true and sandbox: false — a legitimate supply-chain and client-security audit capability.
The crash-triage workflow chains several tools into a defensive pipeline: cve_triage_crash classifies an ASan or GDB log into a bug class and CWE, taint_trace verifies whether untrusted network input reaches a dangerous sink (the README example confirms a recv() to memcpy() path with an unbounded length field), dormant_detector hunts orphan functions with time-bomb triggers, and adaptive_vaccine synthesizes a YARA detection rule with wildcarded displacement masking. This is detection engineering as much as reverse engineering — the output is defensive tooling, not exploitation material.
Context efficiency is treated as a first-class engineering problem rather than an afterthought. The README is candid that MCP servers advertising 180+ verbose tool schemas and dumping 50,000-line decompilations can exhaust an LLM's context window in two turns. Reversecore_MCP counters with a four-layer optimization architecture built around a tiered router: a --tiered setup mode exposes 15 core security tools plus 8 domain sub-agents while keeping all 186 tools callable on demand, reportedly cutting token usage by 94.4%. The inspect_analysis_view tool pages through exact pseudo-C lines on demand using an evidence_id, so the agent streams only the decompiled range it currently needs.
Installation is deliberately low-friction. A zero-install path via pipx run reversecore-mcp setup auto-detects installed AI clients and registers the server with configuration backups; there is also a one-line shell installer for macOS/Linux and an agent-skill route via npx skills add sjkim1127/Reversecore_MCP. Docker images are published at ghcr.io, which aligns with the security model of running untrusted samples inside isolated containers rather than on the analyst's host. The project's hygiene signals are unusually strong for this space: CI/CD on every push, a claimed 3,086 passing tests at 88% coverage, an OpenSSF Scorecard badge, and third-party safety verification badges.
For defenders, the tool's posture toward execution matters. The flagship verification path runs reconstructed routines in the ESIL emulator with isolated register and memory state, explicitly avoiding host execution of live malware. That makes Reversecore_MCP a reasonable fit for SOC and CERT workflows where suspicious samples must be characterized without giving them a real CPU. The forensics side — process and code-injection hunting in RAM dumps, PCAP DNS and C2 stream reconstruction, NTFS MFT and deleted-file recovery — rounds out the triage story into full incident-response scope.
Where this sits in a professional workflow is best understood as a force multiplier for a lone analyst or small team. It does not replace judgment: equivalence verdicts, taint confirmations, and dormant-logic findings still need human review before they land in a report or a detection rule goes to production. But by making every intermediate artifact addressable, cacheable, and paged, Reversecore_MCP turns the tedious chaining of r2, r2ghidra, angr, and Volatility3 sessions into something an agent can execute reproducibly while the analyst supervises the evidence trail — a pattern that is likely to define reverse-engineering tooling over the next few years.
Watch points remain. Wrapping powerful engines behind an LLM means prompt-driven automation can still misinterpret binaries, so the byte-level provenance model deserves scrutiny in real use — verify that reported addresses and verdicts match the underlying tool output. And as with any MCP server granted filesystem access to samples, deployment should respect the container isolation the project itself recommends. Within those bounds, for authorized assessments, lab research, and defensive malware triage, Reversecore_MCP is one of the more thoughtfully engineered entries in the rapidly growing MCP security-tooling niche.
sjkim1127/Reversecore_MCP.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.