SkillFoxx

Reversecore MCP

MCP server for reverse engineering and malware analysis: decompilation, YARA, forensics and evidence-backed reports

  • 221 ★ on the repository
  • Last commit
  • MIT
MCP server

Broad access

Why this level

  • The server runs analysis tools over other people's binaries, including malicious ones, and reads the files you point it at
  • Samples on the host without a container can damage the machine itself
All reasons and checks

sjkim1127/reversecore_mcpAuthor:sjkim1127

Install

Manual install

pipx run reversecore-mcp setup

Finds installed clients and registers the server with settings backups.

Access and checks

How we review

Broad accessThe tool can change data, run commands or handle secrets.

  • The server runs analysis tools over other people's binaries, including malicious ones, and reads the files you point it at
  • Samples on the host without a container can damage the machine itself

This is third-party code. Review the repository files before installing.

What it does

Reversecore MCP brings disassemblers, decompilers, YARA scanners and forensic tools into one place for an AI agent. You describe the task in words, for example decrypt the config in this sample and collect the IOCs, and the server runs the tools and returns a structured result with byte-level evidence so the agent does not invent findings. Inside are Radare2, YARA, LIEF and Capstone. The server analyzes binaries, including stripped Go and Rust, Electron ASAR bundles and Unity games, helps with crash analysis and with reconstructing a function checked in the ESIL emulator. The tools run on your machine or in an isolated Docker container. To save context there is a mode with 15 core tools and the rest on demand.

Who it is for. Malware analysts and vulnerability researchers who examine suspicious samples and incidents together with an agent.

Good fit when

  • A suspicious installer goes to the agent, which checks `app.asar` for insecure window settings and IPC handlers
  • The agent decompiles a config decryption function and checks a Python decryptor in the emulator
  • You need to collect IOCs from a sample, map behavior to MITRE ATT&CK and produce a report
  • A crash dump is reduced to a cause with a pointer into the code

Not a fit when

  • You only need documentation or source code with no binaries: binary analysis tools are overkill
  • Malware samples would be handled on a work machine with no isolation: a Docker container is provided for that
  • You need a fast response on little memory: the full tool set is heavy, the 15-tool mode fits better

Example request

Analyze sample.bin: decompile the config decryption function, collect IOCs and map the behavior to MITRE ATT&CK

MCP

Transport
stdio
Authentication
not required

Limitations

The server takes apart other people's binaries and malware samples, so work with them in a Docker container or on a separate machine. Installation pulls in Radare2 and other dependencies, with details in `docs/getting-started/installation.md`. The README gives the tool count inconsistently, 186 and 194, so rely on `docs/TOOLS.md`. ESIL emulation checks a function's behavior without running the sample on the host, but the result depends on the file architecture. The license is MIT and the documentation also exists in Korean, Japanese and Chinese.

How to disable. Remove the server from your clients and stop the Docker container. The backups of client configurations made by the installer sit next to the originals.

FAQ

How do I install Reversecore MCP in Claude Code?

Run `pipx run reversecore-mcp setup`: the installer finds Cursor, Claude Code, Windsurf, Claude Desktop, Codex and Cline and registers the server with a settings backup.

How do I reduce context usage?

Run the setup with `--tiered`: the client keeps 15 core tools and 8 domain sub-agents and the rest are called on demand.

What does it do besides decompilation?

YARA scanning, stripped Go and Rust recovery, Electron ASAR and Unity audits, crash analysis and digital forensics.

Does the sample run on my machine?

ESIL emulation runs code in an isolated CPU and memory state without executing the sample on the host. A Docker container is provided for the other tools.

Can it be installed as a skill?

Yes, `npx skills add sjkim1127/Reversecore_MCP` installs the agent skill, which needs the MCP server connected.

Discussion

No questions or reviews yet.

MCP servers

An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research

MCP serverBroad access1.4K

MCP server and CLI for reverse engineering: an agent inspects binaries, JavaScript apps, APKs and websites on your machine and returns the evidence

MCP serverBroad access454.8K

RE-MCP opens IDA Pro and Ghidra to an agent in headless mode: functions, decompiler, cross-references, types and patching.

MCP serverBroad access179

A Ghidra MCP server: the agent decompiles, renames variables, builds cross references and works through a binary via a set of small tools

MCP serverBroad access958

REA, Reverse Engineering Assistant

Reverse Engineering Assistant (REA)

REA analyzes PE, ELF and Mach-O binaries, firmware and APKs in pure Rust and writes reports in Markdown, PDF and JSON.

MCP serverExtended access109

A skills router for authorized reverse engineering, pentest, CTF and threat analysis: it picks a methodology for the task and checks available tools

SkillBroad access44.6K

README in short

The text presents a binary and malware analysis server, shows two end-to-end scenarios with tool chains, lists supported targets and context-saving techniques. Installation, client setup, the security model and the tool catalog follow.

README badge

Report a problem