Log inSubmit server
Reversecore MCP logo

Reversecore MCP

Reverse engineering MCP server for malware analysis, forensics, vulnerability research, and source code auditing.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Reversecore MCP

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "reversecore-mcp": {
      "command": "uvx",
      "args": [
        "reversecore-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 114 tools correctly (7d ago).

Overview

Reversecore MCP MCP server exposes 151 security analysis tools to MCP-compatible assistants such as Claude and Cursor. It covers static and dynamic binary analysis, malware triage, vulnerability research, digital forensics, SAST, reporting, and MITRE ATT&CK mapping through structured tool results. The server runs in Python 3.10–3.12 over stdio or HTTP/SSE and is suited to workflows that need multiple analysis engines behind a natural-language interface.

Use cases

  • Decompile suspicious binaries and extract behavior indicators
  • Scan samples with YARA and map findings to MITRE ATT&CK
  • Analyze memory images, PCAP files, and disk artifacts
  • Audit Python and C/C++ source for vulnerability patterns
  • Generate triage reports and SIGMA rules

Key features

  • 151 structured MCP analysis tools
  • Static, dynamic, and symbolic binary analysis
  • Malware, forensics, and vulnerability research workflows
  • Python and C/C++ source auditing
  • MITRE ATT&CK mapping and security reporting
  • stdio and HTTP/SSE transport support

Tools114

What Reversecore MCP lets your agent do. Expand a tool for its parameters.

Verified live~16.5k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

8/8 checks healthy over the last 39d

What it can do

From the 114 tools this server returned when we ran it.

Runs commands · 4Writes files · 1Handles credentials · 1Makes network requests · 3Read-only tools · 109
Network at startup2 connections
Files written at startup30

Observed 2026-10-15 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9d ago via OSV.dev · reversecore-mcp (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars211Stargazers on the source repository.
Last commitTodayMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed114Callable tools this server registers over MCP.
Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

How Reversecore MCP works

What Reversecore MCP does

Reversecore MCP MCP server gives an MCP-compatible AI client a single interface for reverse engineering and security analysis. Its catalog contains 151 tools covering binary analysis, malware investigation, vulnerability research, digital forensics, source-code auditing, and report generation. Claude and Cursor are named as example clients.

The project is intended for analysts who want an assistant to coordinate several analysis steps rather than manually invoke each command-line utility. A request can be decomposed into operations such as decompiling a function, extracting indicators, mapping findings to MITRE ATT&CK, and producing a triage report.

How it works

Reversecore MCP MCP server is implemented with FastMCP and supports Python 3.10, 3.11, and 3.12. Clients communicate with it through MCP over stdio or HTTP/SSE. Tools return typed ToolSuccess or ToolError results, allowing an assistant to inspect structured output and use it in later calls.

The architecture also includes guided prompts for 22 analysis modes and 11 URI-based resources. Resources can expose per-binary information such as strings, indicators of compromise, assembly, and control-flow data. Shared components provide input and path validation, safe subprocess execution, timeouts, structured errors, metrics, audit logging, caching, and analysis memory backed by SQLite. Redis-backed task and cache components are also listed in the architecture.

Setup and configuration

The documented runtime requires Python 3.10–3.12. The package is published on PyPI, and the repository also provides a Docker image through GitHub Container Registry.

Optional symbolic execution support depends on Python version: the angr engine is installed for Python 3.12 and newer when a compatible secure release is available, while Python 3.10 and 3.11 installations omit it.

Tools and capabilities

Reversecore MCP MCP server groups its tools into these areas:

  • Static analysis: disassembly, decompilation, binary parsing, string extraction, packer detection, capability detection, and firmware scanning.
  • Dynamic and symbolic analysis: ESIL emulation, symbolic execution, taint analysis, and fuzzing-harness generation.
  • Malware analysis: IOC extraction, YARA scanning, dormant-backdoor detection, vaccine generation, and vulnerability hunting.
  • Vulnerability research: dangerous-API detection, ROP gadget discovery, heap analysis, crash triage, and proof-of-concept generation.
  • Forensics and auditing: Volatility3 memory analysis, Scapy PCAP analysis, Sleuth Kit disk analysis, artifact correlation, Python AST scanning, and C/C++ pattern scanning.
  • Reporting: session-based reports, MITRE ATT&CK mapping, SIGMA rules, VEX reports, and email delivery.

The listed analysis engines include Radare2, r2ghidra, LIEF, Capstone, YARA, CAPA, angr, Qiling, Volatility3, Scapy, DIE, Binwalk, Sleuth Kit, pwntools, ROPgadget, and Keystone.

Limitations and notes

Tool availability can vary by Python version because angr is omitted from Python 3.10 and 3.11 installations. Review the project’s authoritative tool catalog for individual parameters before building an automated workflow.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Reversecore MCP

Reversecore MCP is an MCP server that connects AI assistants such as Claude and Cursor to 151 reverse-engineering and security-analysis tools. Its main capabilities include binary disassembly and decompilation, malware and IOC analysis, vulnerability research, digital forensics, source auditing, MITRE ATT&CK mapping, and report generation through structured results.

The server supports Python 3.10–3.12 and is published on PyPI, with a container available through GitHub Container Registry.

Yes, Cursor is named as a supported example of an MCP-compatible AI client.

It provides 151 tools for static and dynamic analysis, malware investigation, vulnerability research, forensics, SAST, and reporting. Listed engines and capabilities include Radare2, YARA, LIEF, CAPA, Volatility3, Scapy, Binwalk, Sleuth Kit, symbolic execution, IOC extraction, and MITRE ATT&CK mapping.

Symbolic execution support is installed on Python 3.12 and newer when a compatible secure release is available.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewReversecore MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/reversecore-mcp?style=directory)](https://allmcps.com/mcp/reversecore-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/reversecore-mcp"><img src="https://allmcps.com/api/badge/reversecore-mcp?style=directory" alt="Reversecore MCP on AllMCPs" /></a>