Spec Driven Development
作者：formulahendry
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
在你的电脑上运行★ 440MIT14个月前更新
安装
BinSight
概览
作者提供的说明（英文原文）
The AI X-ray for any file: what is it, what does it hide, what changed. Built on REA.
PopNx MCP 的三大支柱
这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。
- 用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
- 我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
- 使用情况i尚未统计★ –
它能帮你做什么
我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。
- 连接方式: 在你的电脑上运行
- 传输方式: stdio
- 分类: 其他
安装
选择你使用的 AI 应用，然后复制设置。
安装之前
- 基础检查：1 项中通过 1 项
- 在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
- 注册中心没有列出需要填写的密钥。
你需要
- npm已安装 Node.js（用于 npx 命令）
你用的是哪个应用？
在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。
打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json
{
"mcpServers": {
"binsight": {
"command": "npx",
"args": [
"-y",
"binsight",
"mcp"
]
}
}
}在终端中运行这条命令
claude mcp add binsight -- npx -y binsight mcp或者自己复制设置
粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json
{
"mcpServers": {
"binsight": {
"command": "npx",
"args": [
"-y",
"binsight",
"mcp"
]
}
}
}浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。
或者自己复制设置
粘贴到项目中的 .vscode/mcp.json
{
"servers": {
"binsight": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"binsight",
"mcp"
]
}
}
}浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。
这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。
你的选择通过 Cookie 保存在这台设备上，无需账户。
这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。
它能做什么
它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。
基础检查i
我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月7日
- ✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 Alessiolucini 验证，该账户拥有此仓库
- … 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
- … 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
- – 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
- – 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
- … 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表
与“其他”中的其他服务器比较i
- 星标数多于此分类中其他 18348 个服务器的 0%
- 发布到注册中心的时间比此分类中其他 18348 个服务器的 68% 更新
- 基础检查结果等于或优于此分类中其他 18348 个服务器的 100%
与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。
常见问题
BinSight 安全吗？
它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。
它需要哪些密钥或代码？
注册中心没有列出必需的密钥，不过有些服务器会在首次使用时要求你登录。
它在我的电脑上运行还是在云端？
它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。
它还在维护吗？
GitHub 仓库最后更新于–，最新版本（6.6.0）于20天前进入注册中心。
哪些应用可以使用它？
支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Node.js。
有什么可以替代它？
同一分类中有：Spec Driven Development, Remote Desktop Commander, 好縮 Short
替代选择
同一分类中其他作者的服务器，按星标数排序。
如何看卡片：★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i
Remote Desktop Commander
作者：desktop-commander
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
在云端运行★ 211前天更新
安装
好縮 Short
作者：gooonamee
Smart URL shortener: create, tag and track short links on s.gooo.name.
在云端运行今天更新
安装
作者的 README
打开 README
按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。
BinSight
The AI X-ray for any file. Point it at a binary and ask: what is it, what does it hide, and what changed?
Offline · cross-platform · with evidence. It never runs the file.
Built on REA (morluto/rea) · MIT
Most files are black boxes: an .exe you downloaded, a firmware dump, a driver, a game, an ECU calibration, an app update. BinSight opens the box — statically, on your own machine, without ever running the file — and answers the three questions that matter, in plain language and with the evidence to back them up.
You: What is this file? Is it hiding anything? And what changed vs the old version?BinSight: PE/Windows x64, compiled with MSVC, UPX-packed (entropy 7.9), imports consistent with network + process injection, Authenticode signature present, and vs the previous build 3 regions changed — here are the offsets. All static, all offline, with evidence.
The three questions
🔎 What is it?
triage_file and inspect_executable read ELF, PE/Windows and Mach-O (and raw blobs) and tell you the type, architecture, entry point, imports/exports, sections, hashes, and a compiler/packer fingerprint — without starting Ghidra or IDA, on macOS, Windows or Linux.
🕵️ What does it hide?
detect_binary_toolchain, measure_binary_entropy, classify_import_capabilities, identify_crypto_constants, extract_binary_strings, inspect_code_signature and scan_embedded_content surface packing, high-entropy regions, imported capabilities (network, process, crypto…), IOC strings, embedded files, and whether a signature is real — reported as evidence and inference, never as a verdict.
🔁 What changed?
compare_binaries diffs any two files byte-for-byte and explains the change — which regions moved, what was zeroed or maxed out, the before/after values. Works on app updates, drivers, firmware and ECU calibration dumps alike. compare_executables adds import/export/section/hardening deltas for executables.
All 17 tools
| Tool | What it answers |
|---|---|
| `triage_file` | One call: type, hashes, structure, entropy, packing, capabilities, signature, strings, next steps |
| `generate_triage_report` | A shareable Markdown triage report |
| `compare_binaries` | Diff any two files and explain what changed (firmware, ECU dumps, updates) |
| `compare_executables` | Diff two executables: imports, exports, sections, hardening, entropy |
| `inspect_executable` | Sections, imports, exports, libraries, symbols, entry point, overlay — ELF/PE/Mach-O |
| `inspect_binary_hardening` | checksec for every OS: PIE, canary, NX, RELRO, CFG, ASLR, hardened runtime |
| `measure_binary_entropy` | File / section / block Shannon entropy + chi-square |
| `detect_binary_toolchain` | Compiler, packer, installer, language (UPX, MSVC, PyInstaller, Go…) |
| `extract_binary_strings` | ASCII/UTF-16 strings classified into IOCs (URL, IP, path, registry…) |
| `identify_crypto_constants` | AES S-box, SHA/MD5, CRC32, ChaCha, curve parameters… |
| `classify_import_capabilities` | Capabilities inferred from imports ("consistent with", never a verdict) |
| `scan_byte_patterns` | Byte / hex-wildcard / text / regex search, no provider needed |
| `compute_similarity_hashes` | imphash, Rich hash, symhash, telfhash, ssdeep, TLSH |
| `inspect_code_signature` | Authenticode + Mach-O code signature — on any host |
| `scan_embedded_content` | binwalk-style embedded-file identification (offsets only) |
| `generate_sbom` | CycloneDX / SPDX component inventory from embedded metadata |
| `recover_go_symbols` | Function names from a stripped Go pclntab |
Every result separates observations, inferences and unknowns, carries file offsets, and states its limitations. Detection only — nothing is unpacked, decrypted, cracked or executed.
Quickstart
npx binsight triage-file /path/to/file --jsonnpx binsight compare-binaries /path/to/old /path/to/new --json npx binsight generate-triage-report /path/to/file --json
Register BinSight as an MCP server for your AI agent, then just ask it in plain language ("what is this file, what does it hide, what changed?"):
npx binsight setupBinSight supports the same agents as REA — see supported agents; other clients can use manual MCP registration.
Verified against the reference tools
BinSight's parsers and hashes are checked against the tools analysts already trust: imphash matches `pefile` byte-for-byte, structure matches LIEF / readelf / otool, and hardening and packing results match checksec and Detect It Easy on a real corpus of ELF, PE and Mach-O binaries.
Documentation
- Static intelligence suite: the 17 tools, with CLI and MCP examples.
- Tool catalog: generated inventory of tools, providers and CLI commands.
- Installation and setup: providers, agents and manual registration.
Built on REA
BinSight builds on REA and adds the static intelligence suite above. REA is MIT-licensed; this project keeps that license and attribution. This is not an official REA release — for REA itself, go to morluto/rea.
License
MIT. See LICENSE. Portions © the REA authors.