---

Why this exists

Reverse engineering a modern game involves five static tools (Ghidra, IDA, Binary Ninja, radare2, Hopper), three debuggers (x64dbg, WinDbg, GDB/LLDB), a hex-editor, a memory scanner (Cheat Engine), an instrumentation framework (Frida), and a stack of format parsers (PE, ELF, Mach-O, DEX, Minidump, Unity AssetBundle, UE .pak). Switching between them costs hours. Teaching a model to drive even one of them well costs more.

This server:

1. Aggregates 59 existing RE / debug MCP backends behind one connection — smart_decompile picks IDA when running, falls back to Ghidra, then Binja, then RetDec.
2. Ships 111 native MCP tools so most answers don't need an external backend at all — PE / ELF / Mach-O / DEX / WASM / Minidump / ZIP / .NET / IL2CPP metadata parsers, AoB signature scan, Shannon entropy, crypto-constant identification, PDB70 → Microsoft symbol server URL.
3. Lets Claude, Codex, and Cursor collaborate through a shared mesh — DM, channels, task handoff, adversarial voting, shared KV knowledge-base, named locks for coordination. Zero-dep JSON persistence.
4. Curates 4,200+ skills — 246 hand-written deep references on anti-cheat (BattlEye, EAC, Vanguard, VAC, FACEIT, Byfron, Ricochet, mhyprot) and 3,985 archived open-source projects with full source dumps.

If you're on security-research, cheat-detection, defensive-engineering, or game-SDK work — this collapses a day of tool-shuffling into one MCP connection.

30-second quickstart

# clone + build
git clone https://github.com/1llu50ry/mcp-reverse && cd mcp-reverse
npm install && npx tsc
npm test            # 20/20 should pass

# wire into Claude Code / Codex / Cursor (stdio mode)
# (add this JSON to your client's MCP config)
#   { "mcp-reverse": { "command": "node", "args": ["/path/to/dist/index.js"] } }

# OR run over HTTP (Docker-friendly)
docker compose up

# OR drive it from the CLI (no MCP client needed)
./bin/mcp-reverse.mjs stats
./bin/mcp-reverse.mjs search battleye
./bin/mcp-reverse.mjs tools    # list every registered MCP tool

Point your MCP client at it, then ask any of:

• "Analyze C:\game\binary.exe and tell me what packer it uses." → calls analyze_binary (entropy + Rich Header + Debug Directory + imports + crypto constants)
• "Decompile 0x401000 using every connected backend and spot disagreements." → hub_consensus_call matcher=decompile
• "Alice, hand off driver.sys unpacking to Bob; Cursor review the result." → mesh orchestration
• "BM25 search 'battleye shellcode detection'." → bm25_search ranks 4,230 docs by BM25 relevance

Architecture

flowchart LR
  subgraph clients[" MCP clients "]
    C1[Claude Code]
    C2[Codex / ChatGPT]
    C3[Cursor]
    C4[Copilot CLI]
    C5[custom]
  end

  subgraph server[" mcp-reverse (this repo) "]
    direction TB
    T[111 MCP tools]
    M[Agent Mesh<br/>DM · channels · tasks · votes · KB · locks]
    H[MCP Hub<br/>smart_decompile · consensus_call]
    N[Native parsers<br/>PE · ELF · Mach-O · DEX · WASM · Minidump · ZIP · .NET]
    S[Skill library<br/>4,200+ docs · BM25]
  end

  subgraph backends[" 59 RE / debug MCP backends "]
    B1[Ghidra · IDA · Binja]
    B2[x64dbg · WinDbg · GDB · LLDB]
    B3[Cheat Engine · Frida]
    B4[PCILeech · Memflow]
    B5[Volatility · YARA · angr]
  end

  C1 & C2 & C3 & C4 & C5 -->|stdio or HTTP| server
  server -->|hub_connect| B1 & B2 & B3 & B4 & B5

Verticals

The game-hacking framing is historical — the tooling covers every RE discipline:

Vertical	Why this project fits	Docs
🎮 Game security + anti-cheat	4,200+ hand-written skills across BattlEye, EAC, Vanguard, VAC, FACEIT, Byfron, Ricochet, mhyprot, Hyperion.	this README
🦠 Malware analysis	PE / minidump / Rich Header / Debug Directory parsers + 59-backend hub (YARA, Volatility, angr, Qiling).	docs/verticals/malware-analysis.md
📱 Mobile security (iOS + Android)	Mach-O (fat + arm64e) + DEX + APK parsers + Hopper + Frida + JADX + Magisk + idevice MCPs.	docs/verticals/mobile-security.md
🔧 Firmware / IoT	ELF + Qiling + Unicorn + angr for embedded.	docs/verticals/firmware-iot.md
🏁 CTF / exploit development	pwndbg + GEF + angr + AFL++ + honggfuzz + LibAFL + Unicorn + ret-sync all behind one hub.	docs/verticals/ctf-pwn.md

Comparison

Project	Scope	Tools	Backends	Multi-agent	Skills archive
mcp-reverse (this repo)	Game RE + anti-cheat + mesh orchestration	111	59	✅	4,200+
GhidraMCP	Ghidra bridge	5	1	—	—
ida-pro-mcp	IDA bridge	~50	1	—	—
SuperghidraMCP	pyghidra	38	1	—	—
REA	Cross-stack RE (native + Electron + .NET)	~40	3	—	—
Vibe-RE	PE triage pipeline	~30	1	—	—

Ethics & responsible use

This project exists for security research, cheat detection, defensive engineering, game-preservation, and reverse-engineering education. Specifically:

• Anti-cheat engineers use it to understand bypass vectors and harden their systems.
• Red teams use it on binaries they are authorized to analyze.
• Students use it to learn how PE / ELF / IL2CPP / UE4 / Source2 actually work.
• Preservation groups use it to document archived game ecosystems.