Best for
- Security researchers and malware analysts
- Teams that need natural-language orchestration across analysis engines
- Developers performing binary, firmware, vulnerability, or forensic analysis
R
Reversecore MCP
Community
AI-powered reverse engineering and security analysis
GitHub source repository ↗
54FMRS · D
The supplied sources describe Reversecore MCP as an MIT-licensed open-source security-analysis server, version 3.0.3, distributed through PyPI and OCI packages. It offers broad coverage and a substantial toolchain, with path validation, input sanitization, structured errors, rate limiting, and optional sandboxing. It is intended for professional security workflows, so users should still configure isolation and access controls independently when handling untrusted samples.
Reversecore MCP gives AI assistants Model Context Protocol access to reverse engineering, malware analysis, vulnerability research, digital forensics, and source-code security auditing. It integrates Radare2, r2ghidra, YARA, LIEF, Capstone, angr, Volatility3, Scapy, Sleuth Kit, and other engines through 120 tools, 22 guided analysis modes, and 11 MCP resources.
Tools
run_file
Identifies file type, architecture, and compiler fingerprints.
run_strings
Extracts ASCII and Unicode strings.
parse_binary_with_lief
Parses PE, ELF, and Mach-O headers, sections, imports, exports, and TLS data.
run_capa
Detects binary capabilities such as encryption or persistence.
Radare2_analyze_binary
Runs full Radare2 automatic analysis on a binary.
Radare2_decompile_function
Decompiles a selected function into pseudo-C using r2ghidra.
extract_iocs
Extracts IOCs including IPs, URLs, domains, hashes, registry keys, and cryptocurrency addresses.
run_yara
Scans files with custom rule files and built-in rulesets.
memory_analyze
Analyzes memory dumps with Volatility3.
pcap_analyze
Analyzes PCAP protocol breakdowns and anomalies with Scapy.
audit_source_code
Scans Python, C, and C++ source code for dangerous patterns using AST and regex analysis.
create_analysis_report
Creates full-analysis, quick-triage, IOC-summary, or executive-brief reports.
Setup
Docker is recommended for the complete toolchain: mount a local sample directory at /app/workspace and reference samples by filename inside the container. You can also install reversecore-mcp from PyPI or run it from source; local mode requires Radare2, while full forensics support requires additional external tools. The server supports stdio and can also be configured for HTTP/SSE mode.
claude_desktop_config.json
{"mcpServers":{"reversecore":{"command":"docker","args":["run","-i","--rm","-v","/path/to/your/samples:/app/workspace","-e","REVERSECORE_WORKSPACE=/app/workspace","-e","MCP_TRANSPORT=stdio","ghcr.io/sjkim1127/reversecore_mcp:latest"]}}}
Fit and risk
Not for
- General development tasks without security-analysis requirements
- Users who want to handle untrusted samples without an isolated environment
- Users seeking only basic file operations or general database capabilities
Required permissions
- Access to the configured analysis workspace and sample files
- A mounted local sample directory for Docker deployments
- Optional API-key, upload-size, and rate-limit configuration in HTTP mode
- Optional Redis, SQLite memory storage, and container sandbox access
Risks and side effects
- Samples may be malicious or exploitative and should be analyzed in an isolated environment.
- PoC generation, ROP construction, and vulnerability-research tools can create misuse risks.
- Sandbox execution is disabled by default; dynamic analysis may run on the host unless enabled.
- Misconfigured HTTP, uploads, or workspace mounts can increase file or network exposure.
- Results can include inference; the project distinguishes OBSERVED, INFERRED, and POSSIBLE evidence.
Troubleshooting
- In Docker mode, verify that the sample directory is mounted and use container filenames or paths.
- For local installation, verify Radare2 with r2 --version.
- If capabilities are missing, check YARA, Volatility3, Scapy, Sleuth Kit, GDB, and other backend dependencies.
- For HTTP mode, check MCP_TRANSPORT, MCP_HOST, MCP_PORT, and API-key settings.
- For long-running jobs, check the default timeout, Redis task queue, and container CPU and memory limits.
Use cases
Static malware analysis and IOC extraction
Binary disassembly, decompilation, and control-flow analysis
Vulnerability research, patch diffing, and fuzzing
Memory, disk, network, and artifact forensics
Python, C, and C++ source-code security auditing
Generating YARA, SIGMA, VEX, and analysis reports
Supported clients
Claude DesktopFull support
CursorFull support