Open Reverselab

What open-reverselab does

open-reverselab combines an MCP tool collection, a security knowledge base, command-line workflows, and a Windows desktop workspace for target-based analysis. It is intended for examining files, directories, URLs, and security cases across several domains:

• Windows PE and other binaries
• Android APKs
• Web and CTF targets
• Cryptography and network protocols
• Malware research and defensive analysis

The repository includes more than 100 MCP tools and a runnable knowledge base with red-team and blue-team material. Articles are organized by track and can be related through attack and defense metadata. Representative tools include kb_router, http_probe, run_ctf_tool, android_app_baseline, triage_pe, ghidra_headless_analyze, sample_full_workup, and solve_crypto_from_evidence.

How it works

An MCP client opens the repository's tool project and invokes local analysis commands. The CLI defaults to the blue track; clients can select the red track or both tracks through REVERSELAB_MODE, the --track option, or MCP track-selection tools. Knowledge-base routing can therefore be performed for a specific security perspective rather than relying on a single global workflow.

The desktop application presents analysis as Goals inside managed workspaces. It can run red and blue strategies independently or in parallel, retain logs and reports, and keep original samples separate from working copies. Goal execution is bounded by default to 10 minutes and 32,000 tokens, while failed routes and repeated actions can influence subsequent planning.

Setup and configuration

Clone the repository and run the platform-specific starter script, or prepare the MCP project directly with uv:

uv sync --project tools/skills/mcp/ReverseLabToolsMCP
uv run --project tools/skills/mcp/ReverseLabToolsMCP python scripts/misc/mcp_smoke_check.py --write-report

Python 3.10 or newer is required for the desktop workflow, and the python command must be available on PATH. MCP clients use uv and the dependencies in tools/skills/mcp/ReverseLabToolsMCP. Install only the tool groups needed for a task using the supplied Windows options or POSIX bootstrap scripts.

The Windows desktop release also requires Microsoft Edge WebView2. Configure an OpenAI-compatible chat-completions endpoint and model in the application settings before running model-assisted Goals. Ghidra, Frida, x64dbg, and other third-party tools are installed separately.

Tools and capabilities

• Route knowledge-base queries by domain and security track.
• Probe web and CTF targets with HTTP-oriented tools.
• Establish Android application baselines and unpack cryptographic material.
• Triage PE files and run headless Ghidra analysis.
• Perform broader sample workups and Rizin-based analysis.
• Run local health, dependency, and MCP smoke checks.
• Preserve workspace artifacts, reports, logs, and evidence on disk.

Limitations and notes

The Windows release provides a native desktop application; macOS and Linux use the source-based CLI and MCP workflow rather than a native desktop build. Desktop execution currently uses bounded Python observations. Knowledge-base references to MCP tools do not automatically create desktop adapters for debuggers, devices, or hardening tools.

Workspace files remain on disk, but model-assisted desktop runs send task context and selected evidence to the configured endpoint. Python actions execute with the current user's permissions, so local tool access and file operations should be evaluated before connecting the server to an agent. Keep personal workspaces outside the installation directory when using the packaged desktop application.