Reversecore MCP

Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "reversecore-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "reversecore-mcp"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

Reversecore MCP

AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol

An MCP server that gives AI assistants like Claude and Cursor the ability to perform reverse engineering, malware analysis, vulnerability research, digital forensics, and source code auditing through natural language.

What is Reversecore MCP?
Architecture
Tool Catalog (120 Tools)
Guided Analysis Prompts (22 Modes)
MCP Resources (11 URIs)
Quick Start
Connect to Your AI Client
Configuration
Security Model
Development
CI/CD Pipeline
Docker Build Architecture
System Requirements
Project Structure
Error Handling
Adding New Tools
Contributing
Documentation
License

What is Reversecore MCP?

Reversecore MCP is a Model Context Protocol server that wraps 120 analysis tools into a single interface that AI assistants can call through natural language.

Instead of learning the command-line syntax for a dozen different tools, you describe what you want:

Code

"Decompile the main function of this malware sample, extract all network IOCs,
 map the behavior to MITRE ATT&CK, and generate a triage report."

The AI assistant breaks this into tool calls:

Code

r2_decompile("sample.exe", "main")
  → extract_iocs("sample.exe")
    → add_mitre_technique(technique_id="T1071.001", ...)
      → create_analysis_report(template_type="quick_triage")

Each tool returns a structured ToolResult (either ToolSuccess or ToolError) with typed data that the AI can reason about, chain into follow-up queries, or render for the user.

What it covers

Domain	What you can do
Static analysis	Disassembly, decompilation (r2ghidra), binary parsing (LIEF), packer detection (DIE), capability detection (CAPA), string extraction, firmware scanning (binwalk)
Dynamic & symbolic	ESIL emulation, angr symbolic execution, taint analysis, fuzzing harness generation
Malware analysis	IOC extraction, YARA scanning, dormant backdoor detection, adaptive vaccine generation, autonomous vulnerability hunting
Vulnerability research	Dangerous API detection, ROP gadget discovery, heap exploit analysis, crash triage, PoC generation
Digital forensics	Memory forensics (Volatility3), PCAP analysis (Scapy), disk forensics (Sleuth Kit), artifact correlation
Source code audit	Python AST scanning, C/C++ regex pattern scanning
Reporting	Session-based reports with MITRE ATT&CK mapping, SIGMA rule generation, VEX reports, email delivery

Architecture

server.ts

AI Client (Claude / Cursor / any MCP-compatible client)
        │  MCP Protocol (stdio or HTTP/SSE)
        ▼
┌──────────────────────────────────────────────────────┐
│                   FastMCP 3.4.4 Server               │
│          120 registered tools · Fully async          │
│                  Python 3.10–3.12                    │
├────────────────────┬─────────────────────────────────┤
│   Guided Prompts   │  Dynamic Resources              │
│  (22 analysis      │  (11 URI-based: per-binary      │
│   modes)           │   strings, IOCs, ASM, CFG, …)   │
├────────────────────┴─────────────────────────────────┤
│                  Core Infrastructure                 │
│  Config · Security · Validators · Exceptions (17)    │
│  R2 Pool · Metrics · Memory (SQLite) · Task Queue    │
│  MITRE Mapper · Evidence Engine · Resilience Layer   │
│  Arch Registry (x86/ARM/MIPS/RISC-V/PPC)            │
│  Result Cache (SHA256) · Analysis Cache (Redis+SQL)  │
│  SAST (Python AST + C/C++ Regex) · Plugin System     │
├──────────────────────────────────────────────────────┤
│                 Analysis Engines                     │
│  Radare2 6.0.4     │  YARA 4.3.1 · LIEF · Capstone  │
│  r2ghidra           │  CAPA · angr · Qiling          │
│  Volatility3 · Scapy│ DIE · Binwalk · Sleuth Kit    │
│  pwntools · ROPgadget│ Keystone (assembler)          │
└──────────────────────────────────────────────────────┘

Core Infrastructure (37 modules)

The reversecore_mcp/core/ directory contains the shared infrastructure that all tools build on:

Module	Purpose
`config.py`	Pydantic BaseSettings with 34+ environment variables
`security.py`	Input sanitization, command argument validation
`validators.py`	File and binary path validation with TOCTOU mitigation, symlink resolution
`r2_pool.py`	Thread-safe Radare2 connection pool with configurable size
`r2_helpers.py`	Structured Radare2 output parsing
`metrics.py`	Per-tool execution times, call counts, error rates, cache statistics
`memory.py`	Async SQLite-backed AI memory store for persisting analysis findings across sessions
`mitre_mapper.py`	MITRE ATT&CK technique ID mapping engine
`evidence.py`	Evidence classification system: `OBSERVED`, `INFERRED`, `POSSIBLE`
`resilience.py`	Retry, circuit-breaker, and timeout decorator patterns
`task_queue.py`	Background task queue via Redis + arq
`extension_registry.py`	Plugin registration and lifecycle management
`arch_registry.py`	Multi-architecture mapping (x86, x86_64, ARM32, ARM64, MIPS, RISC-V, PPC → r2 arch/bits/registers)
`result_cache.py`	SHA256-based tool result caching decorator (`@cache_tool_result`)
`analysis_cache.py`	Multi-level decompilation cache (L1: Redis, L2: SQLite)
`result.py`	`ToolSuccess` / `ToolError` Pydantic models
`exceptions.py`	17 exception classes with `RCMCP-E*` error codes
`decorators.py`	`@log_execution`, `@track_metrics`
`error_handling.py`	`@handle_tool_errors` decorator
`error_formatting.py`	Structured error response formatting
`execution.py`	Safe subprocess execution with timeout and output limits
`command_spec.py`	Command specification for subprocess calls
`loader.py`	Dynamic tool module loader
`plugin.py`	Plugin base class
`extension.py`	Extension base class
`container.py`	Container/sandbox execution support
`audit.py`	Audit logging
`binary_cache.py`	Binary file caching
`json_utils.py`	JSON serialization via orjson (3-5x faster than stdlib json)
`logging_config.py`	Loguru-based structured logging
`report_generator.py`	Report rendering engine (Markdown, PDF via xhtml2pdf)
`resource_manager.py`	MCP resource lifecycle management
`sast/python_ast_scanner.py`	Python AST-based vulnerability scanner
`sast/regex_scanner.py`	C/C++ regex-based vulnerability scanner
`sast/rule_manager.py`	SAST rule loading and management

Tool Catalog (120 Tools)

Every tool returns a structured ToolResult — either a ToolSuccess with typed data or a ToolError with an RCMCP-E* error code. Tools are organized into 8 plugins.

🔍 Static Analysis Plugin (24 tools)

Read the full README →View source on GitHub →

Related MCP Servers

View all in Developer Tools View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Reversecore MCP

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "reversecore-mcp": { "command": "npx", "args": ["-y", "Reversecore MCP"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/reversecore-mcp?style=directory)](https://allmcps.com/mcp/reversecore-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/reversecore-mcp"><img src="https://allmcps.com/api/badge/reversecore-mcp?style=directory" alt="Reversecore MCP on AllMCPs" /></a>

Technical Specs & Signals

CategoryDeveloper Tools

27Quality signal: Emerging · 27/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools11/30

Adoption & activity1/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

AllMCPs Server

The official MCP server for AllMCPs.com - submit and manage tools directly from your AI. The open directory for MCP servers. Connect Claude, Cursor, Windsurf, and AI agents to databases, tools, files, and APIs. Explore 10,000+ servers. AllMCPs is the premier, open directory for discovering, evaluating, and installing Model Context Protocol (MCP) servers to equip AI agents and LLMs with real-world superpowers.

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge and attach your website — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 💻 Developer Tools →Best MCP servers for Developers →Alternatives to Reversecore MCP →Install in Claude Desktop Install in Cursor Install in VS Code

Reversecore MCP

Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "reversecore-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "reversecore-mcp"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

Reversecore MCP

AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol

What is Reversecore MCP?
Architecture
Tool Catalog (120 Tools)
Guided Analysis Prompts (22 Modes)
MCP Resources (11 URIs)
Quick Start
Connect to Your AI Client
Configuration
Security Model
Development
CI/CD Pipeline
Docker Build Architecture
System Requirements
Project Structure
Error Handling
Adding New Tools
Contributing
Documentation
License

What is Reversecore MCP?

Reversecore MCP is a Model Context Protocol server that wraps 120 analysis tools into a single interface that AI assistants can call through natural language.

Instead of learning the command-line syntax for a dozen different tools, you describe what you want:

Code

"Decompile the main function of this malware sample, extract all network IOCs,
 map the behavior to MITRE ATT&CK, and generate a triage report."

The AI assistant breaks this into tool calls:

Code

r2_decompile("sample.exe", "main")
  → extract_iocs("sample.exe")
    → add_mitre_technique(technique_id="T1071.001", ...)
      → create_analysis_report(template_type="quick_triage")

Each tool returns a structured ToolResult (either ToolSuccess or ToolError) with typed data that the AI can reason about, chain into follow-up queries, or render for the user.

What it covers

Domain	What you can do
Static analysis	Disassembly, decompilation (r2ghidra), binary parsing (LIEF), packer detection (DIE), capability detection (CAPA), string extraction, firmware scanning (binwalk)
Dynamic & symbolic	ESIL emulation, angr symbolic execution, taint analysis, fuzzing harness generation
Malware analysis	IOC extraction, YARA scanning, dormant backdoor detection, adaptive vaccine generation, autonomous vulnerability hunting
Vulnerability research	Dangerous API detection, ROP gadget discovery, heap exploit analysis, crash triage, PoC generation
Digital forensics	Memory forensics (Volatility3), PCAP analysis (Scapy), disk forensics (Sleuth Kit), artifact correlation
Source code audit	Python AST scanning, C/C++ regex pattern scanning
Reporting	Session-based reports with MITRE ATT&CK mapping, SIGMA rule generation, VEX reports, email delivery

Architecture

server.ts

AI Client (Claude / Cursor / any MCP-compatible client)
        │  MCP Protocol (stdio or HTTP/SSE)
        ▼
┌──────────────────────────────────────────────────────┐
│                   FastMCP 3.4.4 Server               │
│          120 registered tools · Fully async          │
│                  Python 3.10–3.12                    │
├────────────────────┬─────────────────────────────────┤
│   Guided Prompts   │  Dynamic Resources              │
│  (22 analysis      │  (11 URI-based: per-binary      │
│   modes)           │   strings, IOCs, ASM, CFG, …)   │
├────────────────────┴─────────────────────────────────┤
│                  Core Infrastructure                 │
│  Config · Security · Validators · Exceptions (17)    │
│  R2 Pool · Metrics · Memory (SQLite) · Task Queue    │
│  MITRE Mapper · Evidence Engine · Resilience Layer   │
│  Arch Registry (x86/ARM/MIPS/RISC-V/PPC)            │
│  Result Cache (SHA256) · Analysis Cache (Redis+SQL)  │
│  SAST (Python AST + C/C++ Regex) · Plugin System     │
├──────────────────────────────────────────────────────┤
│                 Analysis Engines                     │
│  Radare2 6.0.4     │  YARA 4.3.1 · LIEF · Capstone  │
│  r2ghidra           │  CAPA · angr · Qiling          │
│  Volatility3 · Scapy│ DIE · Binwalk · Sleuth Kit    │
│  pwntools · ROPgadget│ Keystone (assembler)          │
└──────────────────────────────────────────────────────┘

Core Infrastructure (37 modules)

The reversecore_mcp/core/ directory contains the shared infrastructure that all tools build on:

Module	Purpose
`config.py`	Pydantic BaseSettings with 34+ environment variables
`security.py`	Input sanitization, command argument validation
`validators.py`	File and binary path validation with TOCTOU mitigation, symlink resolution
`r2_pool.py`	Thread-safe Radare2 connection pool with configurable size
`r2_helpers.py`	Structured Radare2 output parsing
`metrics.py`	Per-tool execution times, call counts, error rates, cache statistics
`memory.py`	Async SQLite-backed AI memory store for persisting analysis findings across sessions
`mitre_mapper.py`	MITRE ATT&CK technique ID mapping engine
`evidence.py`	Evidence classification system: `OBSERVED`, `INFERRED`, `POSSIBLE`
`resilience.py`	Retry, circuit-breaker, and timeout decorator patterns
`task_queue.py`	Background task queue via Redis + arq
`extension_registry.py`	Plugin registration and lifecycle management
`arch_registry.py`	Multi-architecture mapping (x86, x86_64, ARM32, ARM64, MIPS, RISC-V, PPC → r2 arch/bits/registers)
`result_cache.py`	SHA256-based tool result caching decorator (`@cache_tool_result`)
`analysis_cache.py`	Multi-level decompilation cache (L1: Redis, L2: SQLite)
`result.py`	`ToolSuccess` / `ToolError` Pydantic models
`exceptions.py`	17 exception classes with `RCMCP-E*` error codes
`decorators.py`	`@log_execution`, `@track_metrics`
`error_handling.py`	`@handle_tool_errors` decorator
`error_formatting.py`	Structured error response formatting
`execution.py`	Safe subprocess execution with timeout and output limits
`command_spec.py`	Command specification for subprocess calls
`loader.py`	Dynamic tool module loader
`plugin.py`	Plugin base class
`extension.py`	Extension base class
`container.py`	Container/sandbox execution support
`audit.py`	Audit logging
`binary_cache.py`	Binary file caching
`json_utils.py`	JSON serialization via orjson (3-5x faster than stdlib json)
`logging_config.py`	Loguru-based structured logging
`report_generator.py`	Report rendering engine (Markdown, PDF via xhtml2pdf)
`resource_manager.py`	MCP resource lifecycle management
`sast/python_ast_scanner.py`	Python AST-based vulnerability scanner
`sast/regex_scanner.py`	C/C++ regex-based vulnerability scanner
`sast/rule_manager.py`	SAST rule loading and management

Tool Catalog (120 Tools)

Every tool returns a structured ToolResult — either a ToolSuccess with typed data or a ToolError with an RCMCP-E* error code. Tools are organized into 8 plugins.

🔍 Static Analysis Plugin (24 tools)

Read the full README →View source on GitHub →

Related MCP Servers

View all in Developer Tools View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Reversecore MCP

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "reversecore-mcp": { "command": "npx", "args": ["-y", "Reversecore MCP"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/reversecore-mcp?style=directory)](https://allmcps.com/mcp/reversecore-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/reversecore-mcp"><img src="https://allmcps.com/api/badge/reversecore-mcp?style=directory" alt="Reversecore MCP on AllMCPs" /></a>

Technical Specs & Signals

CategoryDeveloper Tools

27Quality signal: Emerging · 27/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools11/30

Adoption & activity1/15

Community engagement0/10

★ Featured

AllMCPs Server

Explore Server →

Own this project?

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 💻 Developer Tools →Best MCP servers for Developers →Alternatives to Reversecore MCP →Install in Claude Desktop Install in Cursor Install in VS Code

Reversecore MCP

Quick Install

Client Config & Setup

Documentation Overview

Reversecore MCP

Table of Contents

What is Reversecore MCP?

What it covers

Architecture

Core Infrastructure (37 modules)

Tool Catalog (120 Tools)

🔍 Static Analysis Plugin (24 tools)

Related MCP Servers

Reviews

Frequently Asked Questions about Reversecore MCP

AllMCPs Directory Badge

Technical Specs & Signals

AllMCPs Server

Own this project?

Share & Embed

Explore more

Reversecore MCP

Quick Install

Client Config & Setup

Documentation Overview

Reversecore MCP

Table of Contents

What is Reversecore MCP?

What it covers

Architecture

Core Infrastructure (37 modules)

Tool Catalog (120 Tools)

🔍 Static Analysis Plugin (24 tools)

Related MCP Servers

Reviews

Frequently Asked Questions about Reversecore MCP

AllMCPs Directory Badge

Technical Specs & Signals

AllMCPs Server

Own this project?

Share & Embed

Explore more