sjkim1127/reversecore_mcpA security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more.
AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol
An MCP server that gives AI assistants like Claude and Cursor the ability to perform reverse engineering, malware analysis, vulnerability research, digital forensics, and source code auditing through natural language.
Reversecore MCP is a Model Context Protocol server that wraps 151 analysis tools into a single interface that AI assistants can call through natural language.
Instead of learning the command-line syntax for a dozen different tools, you describe what you want:
"Decompile the main function of this malware sample, extract all network IOCs,
map the behavior to MITRE ATT&CK, and generate a triage report."
The AI assistant breaks this into tool calls:
r2_decompile("sample.exe", "main")
→ extract_iocs("sample.exe")
→ add_mitre_technique(technique_id="T1071.001", ...)
→ create_analysis_report(template_type="quick_triage")
Each tool returns a structured ToolResult (either ToolSuccess or ToolError) with typed data that the AI can reason about, chain into follow-up queries, or render for the user.
| Domain | What you can do |
|---|---|
| Static analysis | Disassembly, decompilation (r2ghidra), binary parsing (LIEF), packer detection (DIE), capability detection (CAPA), string extraction, firmware scanning (binwalk) |
| Dynamic & symbolic | ESIL emulation, angr symbolic execution, taint analysis, fuzzing harness generation |
| Malware analysis | IOC extraction, YARA scanning, dormant backdoor detection, adaptive vaccine generation, autonomous vulnerability hunting |
| Vulnerability research | Dangerous API detection, ROP gadget discovery, heap exploit analysis, crash triage, PoC generation |
| Digital forensics | Memory forensics (Volatility3), PCAP analysis (Scapy), disk forensics (Sleuth Kit), artifact correlation |
| Source code audit | Python AST scanning, C/C++ regex pattern scanning |
| Reporting | Session-based reports with MITRE ATT&CK mapping, SIGMA rule generation, VEX reports, email delivery |
AI Client (Claude / Cursor / any MCP-compatible client)
│ MCP Protocol (stdio or HTTP/SSE)
▼
┌──────────────────────────────────────────────────────┐
│ FastMCP 3.4.4 Server │
│ 151 registered tools · Fully async │
│ Python 3.10–3.12 │
├────────────────────┬─────────────────────────────────┤
│ Guided Prompts │ Dynamic Resources │
│ (22 analysis │ (11 URI-based: per-binary │
│ modes) │ strings, IOCs, ASM, CFG, …) │
├────────────────────┴─────────────────────────────────┤
│ Core Infrastructure │
│ Config · Security · Validators · Exceptions (17) │
│ R2 Pool · Metrics · Memory (SQLite) · Task Queue │
│ MITRE Mapper · Evidence Engine · Resilience Layer │
│ Arch Registry (x86/ARM/MIPS/RISC-V/PPC) │
│ Result Cache (SHA256) · Analysis Cache (Redis+SQL) │
│ SAST (Python AST + C/C++ Regex) · Plugin System │
├──────────────────────────────────────────────────────┤
│ Analysis Engines │
│ Radare2 6.0.4 │ YARA 4.3.1 · LIEF · Capstone │
│ r2ghidra │ CAPA · angr · Qiling │
│ Volatility3 · Scapy│ DIE · Binwalk · Sleuth Kit │
│ pwntools · ROPgadget│ Keystone (assembler) │
└──────────────────────────────────────────────────────┘
The server supports Python 3.10–3.12. The optional angr symbolic execution
engine is installed on Python 3.12 and newer, where a secure compatible release
is available; Python 3.10 and 3.11 installs omit angr.
The reversecore_mcp/core/ directory contains the shared infrastructure that all tools build on: