reversecore-mcp 3.0.2

A security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more.

Reversecore MCP

Security-first Model Context Protocol server for reverse engineering, malware analysis, digital forensics, vulnerability research, and SAST.

Reversecore MCP gives MCP-compatible AI agents structured access to Radare2, r2ghidra, YARA, LIEF, Capstone, angr, Qiling, Volatility3, Scapy, and additional analysis engines. It is designed around explicit workspace boundaries, input validation, non-root containers, and security regression testing.

Installation

Full container image — recommended

The container image includes the supported native toolchain and is the most reproducible installation method:

docker run -i --rm \
  -v /absolute/path/to/samples:/app/workspace \
  -e REVERSECORE_WORKSPACE=/app/workspace \
  -e MCP_TRANSPORT=stdio \
  ghcr.io/sjkim1127/reversecore_mcp:2.1.0

Python package

Install the MCP server and all Python feature extras from PyPI:

pip install "reversecore-mcp[full]"

Native programs such as Radare2, YARA, Graphviz, Binwalk, and The Sleuth Kit must be installed separately when using the Python package directly.

Run the stdio server with:

MCP_TRANSPORT=stdio \
REVERSECORE_WORKSPACE=/absolute/path/to/samples \
reversecore-mcp

MCP client configuration

{
  "mcpServers": {
    "reversecore": {
      "command": "reversecore-mcp",
      "env": {
        "MCP_TRANSPORT": "stdio",
        "REVERSECORE_WORKSPACE": "/absolute/path/to/samples"
      }
    }
  }
}

Capabilities

• Static analysis, disassembly, decompilation, cross-references, and CFG recovery
• Malware triage, IOC extraction, YARA scanning, and MITRE ATT&CK mapping
• Symbolic execution, emulation, fuzzing harness generation, and ROP analysis
• Memory, disk, network, and host-artifact forensics
• Python and C/C++ source-code security analysis
• Structured evidence, session tracking, metrics, and report generation

Security model

Reversecore MCP processes potentially hostile binaries. Use a dedicated workspace and prefer the hardened container configuration for untrusted samples. The project CI includes dependency auditing, CodeQL, secret scanning, container scanning, path-boundary tests, fuzzing, and network-isolation checks.

Detailed configuration, tool documentation, Docker Compose profiles, and client examples are available in the GitHub repository.

Registry identity

• MCP Registry name: io.github.sjkim1127/reversecore-mcp
• PyPI package: reversecore-mcp
• OCI image: ghcr.io/sjkim1127/reversecore_mcp

License

MIT