Reversecore MCP

AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol

An MCP server that gives AI assistants like Claude and Cursor the ability to perform reverse engineering, malware analysis, vulnerability research, digital forensics, and source code auditing through natural language.

---

---

Table of Contents

• What is Reversecore MCP?
• Architecture
• Tool Catalog (153 Tools)
• Guided Analysis Prompts (22 Modes)
• MCP Resources (11 URIs)
• Quick Start
• Connect to Your AI Client
• Configuration
• Security Model
• Development
• CI/CD Pipeline
• Docker Build Architecture
• System Requirements
• Project Structure
• Error Handling
• Adding New Tools
• Contributing
• Documentation
• License

---

What is Reversecore MCP?

Reversecore MCP is a Model Context Protocol server that wraps 153 analysis tools into a single interface that AI assistants can call through natural language.

Instead of learning the command-line syntax for a dozen different tools, you describe what you want:

"Decompile the main function of this malware sample, extract all network IOCs,
 map the behavior to MITRE ATT&CK, and generate a triage report."

The AI assistant breaks this into tool calls:

r2_decompile("sample.exe", "main")
  → extract_iocs("sample.exe")
    → add_mitre_technique(technique_id="T1071.001", ...)
      → create_analysis_report(template_type="quick_triage")

Each tool returns a structured ToolResult (either ToolSuccess or ToolError) with typed data that the AI can reason about, chain into follow-up queries, or render for the user.

What it covers

Domain	What you can do
Static analysis	Disassembly, decompilation (r2ghidra), binary parsing (LIEF), packer detection (DIE), capability detection (CAPA), string extraction, firmware scanning (binwalk)
Dynamic & symbolic	ESIL emulation, angr symbolic execution, taint analysis, fuzzing harness generation
Malware analysis	IOC extraction, YARA scanning, dormant backdoor detection, adaptive vaccine generation, autonomous vulnerability hunting
Vulnerability research	Dangerous API detection, ROP gadget discovery, heap exploit analysis, crash triage, PoC generation
Digital forensics	Memory forensics (Volatility3), PCAP analysis (Scapy), disk forensics (Sleuth Kit), artifact correlation
Source code audit	Python AST scanning, C/C++ regex pattern scanning
Reporting	Session-based reports with MITRE ATT&CK mapping, SIGMA rule generation, VEX reports, email delivery

---

Architecture