Reversecore MCP

Reversecore MCP

AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol

*An MCP server that gives AI assistants like Claude and Cursor the ability to perform reverse engineering, malware analysis, vulnerability research, digital forensics, and source code auditing through natural language.*

---

---

Table of Contents

• What is Reversecore MCP?
• Architecture
• Tool Catalog (179 Tools)
• Guided Analysis Prompts (22 Modes)
• MCP Resources (11 URIs)
• Quick Start
• Connect to Your AI Client
• Configuration
• Security Model
• Development
• CI/CD Pipeline
• Docker Build Architecture
• System Requirements
• Project Structure
• Error Handling
• Adding New Tools
• Contributing
• Documentation
• License

---

What is Reversecore MCP?

Reversecore MCP is a Model Context Protocol server that wraps 179 analysis tools into a single interface that AI assistants can call through natural language.

Instead of learning the command-line syntax for a dozen different tools, you describe what you want:

"Decompile the main function of this malware sample, extract all network IOCs,

map the behavior to MITRE ATT&CK, and generate a triage report."

The AI assistant breaks this into tool calls:

r2_decompile("sample.exe", "main")

→ extract_iocs("sample.exe") → add_mitre_technique(technique_id="T1071.001", ...) → create_analysis_report(template_type="quick_triage")

Each tool returns a structured ToolResult (either ToolSuccess or ToolError) with typed data that the AI can reason about, chain into follow-up queries, or render for the user.

What it covers

---

Architecture

AI Client (Claude / Cursor / any MCP-compatible client)

│ MCP Protocol (stdio or HTTP/SSE) ▼ ┌──────────────────────────────────────────────────────┐ │ FastMCP 3.4.11 Server │ │ 179 registered tools · Fully async │ │ Python 3.10–3.12 │ ├────────────────────┬─────────────────────────────────┤ │ Guided Prompts │ Dynamic Resources │ │ (22 analysis │ (11 URI-based: per-binary │ │ modes) │ strings, IOCs, ASM, CFG, …) │ ├────────────────────┴─────────────────────────────────┤ │ Core Infrastructure │ │ Config · Security · Validators · Exceptions (17) │ │ R2 Pool · Metrics · Memory (SQLite) · Task Queue │ │ MITRE Mapper · Evidence Engine · Resilience Layer │ │ Arch Registry (x86/ARM/MIPS/RISC-V/PPC) │ │ Result Cache (SHA256) · Analysis Cache (Redis+SQL) │ │ SAST (Python AST + C/C++ Regex) · Plugin System │ ├──────────────────────────────────────────────────────┤ │ Analysis Engines │ │ Radare2 6.0.4 │ YARA 4.3.1 · LIEF · Capstone │ │ r2ghidra │ CAPA · angr · Qiling │ │ Volatility3 · Scapy│ DIE · Binwalk · Sleuth Kit │ │ pwntools · ROPgadget│ Keystone (assembler) │ └──────────────────────────────────────────────────────┘

The server supports Python 3.10–3.12. The optional angr symbolic execution engine is installed on Python 3.12 and newer, where a secure compatible release is available; Python 3.10 and 3.11 installs omit angr.

Core Infrastructure (37 modules)

The reversecore_mcp/core/ directory contains the shared infrastructure that all tools build on:

---

Tool Catalog (179 Tools)

📖 [Authoritative Tool Catalog & Parameter Reference (151 Tools)](docs/TOOLS.md)

📊 [Tool Profile Footprint & Context Benchmark Matrix](docs/benchmarks/profile_footprint.md)

Every tool returns a structured ToolResult — either a ToolSuccess with typed data or a ToolError with an RCMCP-E* error code. Tools are organized into 11 domain plugins across 5 modular execution profiles (full, static, malware, forensics, vuln-research):

---

🔍 Static Analysis Plugin (24 tools)

| 20 | generate_fuzzing_harness | Qiling + AFL++ | G