
Capsulith
Run preserved ARM64 code in Node or a browser; inspect decoded image pixels and initialized memory.

Run preserved ARM64 code in Node or a browser; inspect decoded image pixels and initialized memory.
Rust port of REA, a local-only reverse-engineering tool with CLI/MCP workflows and a native Ghidra worker

Decompile and disassemble Python bytecode (.pyc/.pyo) back to readable source. Supports Python 2.0 - 3.15 (CPython, PyPy and other implementations).…

Python bindings for the Icicle emulator, enabling grey-box firmware fuzzing, binary emulation, and reverse-engineering workflows across x64 and ARM64…

Binary, coverage-guided fuzzer for Windows, macOS, Linux and Android

Standalone emulation and testing harness for Cobalt Strike Aggressor Scripts (.cna) that validates syntax, mocks Beacon APIs, and executes BOFs via…

Standalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and…

Inspect, debug, and visually test Model Context Protocol (MCP) servers from a web UI, CLI, or TUI, with tool/resource exploration, request logging,…

Low-level library for encoding and decoding IA32/Intel64 x86 instructions, exposing APIs for instruction length, operands, categories, control-flow…

Secure code execution

Auto Installer Script for Cuckoo Sandbox

Headless Binary Ninja MCP server — giving AI agents deep reverse-engineering capabilities via 180 tools.

Experimental Linux strace LLM agent

An MCP (Model Context Protocol) server that turns all pybag Windows debugger functions into native MCP tools. It lets MCP-compatible clients (Claude…

MCP server bridging Ghidra's reverse engineering with AI tools: 256 tools for decompilation, P-code emulation, live debugging, data flow analysis,…

A notebook where to writes notes while using rizin!

A notebook where to writes notes while using Rizin & Cutter!

Multi-session IDALib MCP router for coding agents. Analyze multiple binaries in parallel with IDA-compatible reverse engineering tools.