Reverse Engineering MCP
About
Production grade MCP for Reverse Engineering (includes almost all necessary tools)
Details
- Author
- president-xd
- Categories
- Other, Developer Tools, Security
Jump to
Setup
Install Reverse Engineering MCP in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/president-xd/revula
Follow the installation instructions in the repository README, then restart your MCP client.
Production-grade MCP server for universal reverse engineering automation.
Connect Claude Desktop, MCP-compatible IDEs, or custom tooling to a broad reverse engineering backend through theModel Context Protocol.
- How It Connects (Important)
- Claude Desktop
- Claude Code (CLI)
- VS Code (GitHub Copilot)
- Cursor
- Windsurf (Codeium)
- Continue.dev
- Zed
- Custom / Other Clients
- Universal Setup Script
- Binary Parsing:PE/ELF/Mach-O via LIEF with hash computation and suspicious indicator detection
- Disassembly:Multi-backend support including Capstone (always available), radare2, and objdump for x86/x64/ARM/MIPS/RISC-V
- String Extraction:FLOSS integration, regex fallback, 17 classifier patterns (URLs, IPs, crypto, registry keys)
- Entropy Analysis:Shannon entropy with sliding window, per-section analysis, and packing detection
- Symbol Extraction:DWARF, PDB, LIEF universal; function prologue scanning for stripped binaries
- YARA Scanning:Inline rules, file/directory rules, and community rules support
- Capa Integration:ATT&CK mapping, MBC behaviors, capability enumeration
- Decompilation:Ghidra (headless), RetDec, Binary Ninja with caching
- GDB Adapter:Full GDB/MI protocol with breakpoints, stepping, registers, memory, backtrace, and heap inspection
- LLDB Adapter:Native SB API integration for macOS/Linux debugging
- Frida Adapter:Spawn/attach, script injection, function interception, memory scan/dump, and RPC exports
- Code Coverage:DynamoRIO drcov, Frida Stalker block tracing, and coverage analysis
- APK Parsing:Manifest extraction, permission analysis, component enumeration, and resource inspection
- DEX Analysis:Class/method listing, bytecode stats, and string extraction
- Decompilation:jadx/apktool integration, smali disassembly/assembly/patching
- Native Binary Analysis:ARM/AArch64 .so analysis with JNI detection
- Device Interaction:ADB bridge with 12 actions (logcat, install, shell, dumpsys, screenshot)
- Frida for Android:Root bypass, crypto hooking, SSL pinning bypass, API tracing, and memory dump
- Traffic Interception:tcpdump/mitmproxy integration with SSL key extraction
- Repack and Sign:APK rebuild with smali patches, zipalign + apksigner
- Security Scanners:MobSF, Quark-Engine, Semgrep, and manifest vulnerability detection
- Rizin/r2:Automated analysis with 13 actions and binary diffing
- GDB Enhanced:Heap analysis, ROP gadget finding, exploit helpers (pattern create/find, checksec)
- QEMU:User-mode emulation (4 actions) and full system emulation (5 actions)
- ROP Chain Builder:Multi-architecture gadget finding (x86/x64/ARM/ARM64) with semantic classification, automatic chain generation for execve/mprotect/syscalls, bad-char avoidance, and pwntools script generation
- Heap Exploitation:Malloc chunk analysis, bin classification (tcache/fastbin/smallbin/largebin), fake chunk generation, safe-linking encode/decode for glibc 2.32+, and technique templates (House of Force, Tcache Poisoning, Fastbin Dup, Unsafe Unlink)
- Libc Database:Symbol/offset extraction, libc identification from leaked addresses, ASLR defeat helpers (base calculation, GOT-to-libc, PLT-to-GOT), and one-gadget RCE finder
- Shellcode:Generation, encoding, bad-char analysis, extraction, and emulation testing
- Format String:Offset calculation, write payload generation, GOT overwrite, and address leaking
- Detection:Scan for anti-debug, anti-VM, anti-tamper, and packing indicators
- Bypass Generation:Frida/GDB/patch/LD_PRELOAD scripts for ptrace, IsDebuggerPresent, timing, and VM checks
- Triage:Multi-hash, IoC extraction, suspicious import scoring, and risk assessment
- Sandbox Queries:VirusTotal, Hybrid Analysis, and MalwareBazaar API integration
- YARA Generation:Auto-generate YARA rules from binary artifacts
- Config Extraction:C2 URLs, IPs, domains, encryption keys, and mutexes
- Extraction:binwalk scan/extract, entropy analysis, and filesystem identification
- Vulnerability Scanning:Hardcoded credentials, known CVEs, unsafe functions, and weak crypto
- Base Address Detection:String reference analysis for firmware base address recovery
- PCAP Analysis:tshark-based with 8 actions (summary, flows, DNS, HTTP, TLS, filter, export, IoC)
- Protocol Dissection:Binary structure inference, field boundary detection, and pattern analysis
- Protocol Fuzzing:Mutation-based, boundary testing, field-specific, and template fuzzing
- Packer Detection:UPX, Themida, VMProtect, ASPack, PECompact, MPRESS, and more
- UPX Unpacking:Static unpacking with automatic backup
- Dynamic Unpacking:Frida-based memory dump with OEP detection
- PE Rebuild:Fix section alignments, imports, and entry point after memory dump
- String Deobfuscation:XOR brute force, ROT variants, Base64, RC4, and stack string reconstruction
- Control Flow Flattening Detection:OLLVM-style CFF pattern identification
- Opaque Predicate Detection:Always-true/false branch identification
- angr Integration:Path exploration, constraint solving, CFG generation, and vulnerability scanning
- Triton DSE:Dynamic symbolic execution with concrete and symbolic state
- APK/DEX:Android analysis including manifest, permissions, native libs, and DEX parsing
- .NET IL:Assembly metadata, type/method listing, and IL disassembly
- Java Class:Class file parsing, javap integration, and bytecode disassembly
- WebAssembly:WASM section parsing, import/export extraction, and disassembly
- Hex Tools:Hexdump, pattern search (IDA-style wildcards), and binary diff
- Crypto:Hashing (MD5/SHA/TLSH/ssdeep), XOR analysis, and crypto constant scanning
- Patching:Binary patching with backup and NOP-sled support
- Network:PCAP analysis with protocol stats, DNS extraction, and C2 beacon detection
- Server Status:Version, tool count, cache stats, rate limit stats, and available tools
- Cache Management:View stats, clear cache, and invalidate specific entries
- Python 3.11 or later
- Linux recommended (macOS and WSL2 supported)
- pip(oruv/pipxfor isolated installs)
# Clone git clone https://github.com/president-xd/revula.git cd revula # Option 1: Automated install (recommended) bash scripts/install/install_all.sh # Option 2: Manual install pip install -e . # Option 3: Install with all optional dependencies pip install -e ".[full]" # Verify installation python scripts/test/validate_install.py
The automated installer handles Python version checks, dependency installation, external tool detection, and configuration file generation.
python -c "from revula.config import get_config, format_availability_report; print(format_availability_report(get_config()))"
This prints a table showing which external tools and Python modules are detected on your system.
Revula can be run in Docker for an isolated, stdio-only environment with core and common optional dependencies pre-configured:
# Build the Docker image docker build -t revula:latest . # Quick test docker run --rm --entrypoint python revula:latest -c "import revula; print(revula.__version__)" docker run --rm --entrypoint python revula:latest -c "from revula.server import _register_all_tools; from revula.tools import TOOL_REGISTRY; _register_all_tools(); print(TOOL_REGISTRY.count())" # Run in stdio mode (for local MCP clients) docker run -i --rm -v $(pwd)/workspace:/workspace -v revula-data:/root/.revula revula:latest # Revula transport is stdio-only (no HTTP/SSE mode) # Run it attached to your MCP client process # (for Docker usage, run your MCP client inside the same container/environment)
What's included in the Docker image:
- All core Python dependencies (capstone, LIEF, pefile, yara)
- angr symbolic execution engine
- Frida dynamic instrumentation
- Ghidra headless analyzer
- GDB/LLDB, radare2, rizin (+ rz-diff), binutils
- ADB and Android tools (apktool, jadx, aapt, apksigner, smali/baksmali)
- FLARE tools (FLOSS, capa)
- RetDec, CFR, Detect-It-Easy (diec), DynamoRIO (drrun), UPX
- Exploit tooling (msfvenom, one_gadget), checksec, mono tools (monodis/ikdasm), llvm-pdbutil
- Network analysis tools (tcpdump, tshark, capinfos)
For complete Docker documentation (stdio mode, volumes, compose usage, and troubleshooting), seeDOCKER.md.
- Docker provides an isolated environment with core tooling pre-installed
- Native installation offers better performance and direct system access
- Choose based on your security and portability requirements
Revula uses stdio transport only.The server reads JSON-RPC from stdin and writes to stdout. Every MCP client listed below launches revula as a local subprocess. There is no HTTP server, no SSE endpoint, and no remote connection.
- Revula must be installed on thesame machinewhere your IDE/client runs.
- If you use a remote server or Docker, you must run both the client and revula inside the same environment (or use SSH piping; seeCustom / Other Clients).
- Every client below uses the samerevulacommand. The only difference iswhereyou put the config.
Make sure revula is installed and the command works:
# Should print the MCP protocol handshake (Ctrl+C to exit) revula # If you installed in a venv, activate it first: source /path/to/venv/bin/activate revula # Or use the full path: /path/to/venv/bin/revula
Ifrevulais not in your PATH, use the full path in every config below.
Status:Fully supported. This is the primary client.
python scripts/setup/setup_claude_desktop.py
This auto-detects your OS, finds the config file, and merges the revula entry. It creates a backup first.
Add to yourclaude_desktop_config.json:
{ "mcpServers": { "revula": { "command": "revula", "args": [] } } }
{ "mcpServers": { "revula": { "command": "/home/you/venvs/revula/bin/revula", "args": [] } } }
{ "mcpServers": { "revula": { "command": "uvx", "args": ["revula"] } } }
After editing:Quit and reopen Claude Desktop. Check the MCP tools icon to confirm 116 tools are available.
Claude Code will start revula as a subprocess when needed.
Edit~/.claude.json(or~/.claude/settings.jsondepending on version):
{ "mcpServers": { "revula": { "command": "revula", "args": [] } } }
Status:Supported. Requires GitHub Copilot extension with MCP support (VS Code 1.99+).
Important:MCP support in VS Code is available through the GitHub Copilot Chat extension. Make sure you have:
- VS Code 1.99 or later
- GitHub Copilot extension installed and active
- MCP enabled in settings:"chat.mcp.enabled": true
Option A: Workspace config (already included in this repo)
{ "servers": { "revula": { "command": "revula", "args": [], "env": {} } } }
Just open this project in VS Code and Copilot will discover the MCP server automatically.
Option B: User-level config (global, all projects)
Open VS Code settings (Ctrl+,) → search "mcp" → editsettings.json:
{ "chat.mcp.enabled": true, "mcp": { "servers": { "revula": { "command": "revula", "args": [], "env": {} } } } }
Option C: Create.vscode/mcp.jsonin any project
Copy the file from this repo or create it manually:
mkdir -p .vscode cat > .vscode/mcp.json << 'EOF' { "servers": { "revula": { "command": "revula", "args": [], "env": {} } } } EOF
After editing:Reload VS Code window (Ctrl+Shift+P→ "Developer: Reload Window"). The MCP tools should appear in Copilot Chat.
Status:Supported. Cursor has built-in MCP support.
Config file:~/.cursor/mcp.json(global) or.cursor/mcp.json(per-project).
This repo ships with.cursor/mcp.jsonfor per-project use.
Option A: Per-project (already included)
{ "mcpServers": { "revula": { "command": "revula", "args": [] } } }
mkdir -p ~/.cursor cat > ~/.cursor/mcp.json << 'EOF' { "mcpServers": { "revula": { "command": "revula", "args": [] } } } EOF
After editing:Restart Cursor. Check Settings → MCP to verify revula appears.
Status:Supported. Windsurf Cascade supports MCP servers.
Config file:~/.codeium/windsurf/mcp_config.json
mkdir -p ~/.codeium/windsurf cat > ~/.codeium/windsurf/mcp_config.json << 'EOF' { "mcpServers": { "revula": { "command": "revula", "args": [] } } } EOF
After editing:Restart Windsurf. The Cascade panel should show revula tools.
Status:Supported. Continue has MCP support in recent versions.
{ "mcpServers": [ { "name": "revula", "command": "revula", "args": [] } ] }
mcpServers: - name: revula command: revula args: []
After editing:Restart your IDE. Continue should detect the MCP server.
Status:Supported. Zed has native MCP support via context servers.
Config file:~/.config/zed/settings.json(Linux/macOS)
{ "context_servers": { "revula": { "command": "revula", "args": [] } } }
After editing:Restart Zed. The context server should appear in the Assistant panel.
Any MCP client that supports stdio transport will work with revula.The protocol is standard JSON-RPC over stdin/stdout.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
