mcp-capstone

MCP server that exposes Capstone 5.0.7 disassembly framework functionalities as tools and resources, enabling LLMs to perform binary disassembly, reverse engineering, and instruction analysis.

Install

Terminal

pip install mcp-capstone

Usage

CLI

bash

mcp-capstone

Python

server.ts

from mcp_capstone import disasm, get_version

# Get version
version = get_version()
print(f"Capstone {version['major']}.{version['minor']}")

# Disassemble x86-64 code
instructions = disasm("8b440404", arch="x86", mode="64")
for insn in instructions:
    print(f"0x{insn['address']:x}: {insn['mnemonic']} {insn['op_str']}")

Supported Architectures

x86 (16/32/64-bit)
ARM (ARM, Thumb, ARM mode)
AArch64 (ARMv8)
MIPS (MIPS32/64, MIPS2/3, R6)
PowerPC (32/64-bit, SPE, QPX)
RISC-V (RV32/64GC)
SPARC (V8/V9)
SystemZ
M68K (68000-68060)
M680X (6301/6309/6800/6805/6808/6809/6811/CPU12/HCS08)
TriCore
TMS320C64X
WebAssembly
XCore
BPF (Classic/Extended)
EVM (Ethereum Virtual Machine)

Tools

Tool	Description
`get_version`	Get Capstone version
`check_support`	Check architecture support
`list_architectures`	List all architectures
`disasm`	Full disassembly with details
`disasm_lite`	Lightweight disassembly
`disasm_quick`	Quick disassembly
`get_architectures`	All architecture constants
`get_modes`	All mode constants
`get_options`	All option constants
`get_operands`	All operand type constants
`get_groups`	All instruction group constants
`get_errors`	All error constants

Development

bash

git clone https://github.com/daedalus/mcp-capstone.git
cd mcp-capstone
pip install -e ".[test]"

# run tests
pytest

# format
ruff format src/ tests/

# lint
ruff check src/ tests/

# type check
mypy src/

mcp-name: io.github.daedalus/mcp-capstone