🛰️ SpectraProbe

Original open-source static software analysis toolkit

Identify, hash and inspect executables, archives, WebAssembly and JavaScript — from one CLI, one library, and a real MCP server. No cloud. No telemetry. Everything runs locally.

Quick start · What it does · CLI · MCP server · Providers · Library · Scope & ethics

Why

Reverse-engineering and defensive investigation usually mean juggling a dozen single-purpose tools: one for file identification, one for hashing, one for strings, another for PE headers, another for ELF, something else for archives. SpectraProbe unifies the static foundation of that workflow behind one consistent interface, with a data model built for evidence:

• Zero required native dependencies. The PE, ELF, Mach-O, WebAssembly and ZIP parsers are original TypeScript. Install and run.

• One engine, three front ends. The same analysis core powers the CLI, the programmatic library, and an MCP server — so results are identical everywhere.

• Evidence, not vibes. Every conclusion is a finding that cites concrete evidence, labelled verified, inferred or unknown, with explicit limitations. Nothing is invented.

• Graceful degradation. Heavy external tools (Ghidra, radare2, YARA, JADX, …) are optional providers; the core works fully without them and reports exactly what is and isn't installed.

$ spectra inspect ./sample.exe
▌ sample.exe
  format   pe — PE (Portable Executable)
  sha256   9f2c…c4cd
  entropy  6.47 bits/byte

metadata
  [vh] PE PE32+ for x86-64 (AMD64) (DLL)
       subsystem: Windows GUI; entry RVA 0x1240; image base 0x180000000
import
  [vh] Imports 86 functions from 7 libraries
hardening
  [vh] Security flags: dynamic-base (ASLR), nx-compatible (DEP), control-flow-guard

Related MCP server: specmd-mcp

✨ What it does

SpectraProbe performs static analysis only — it reads and parses files, it never executes the software under study.

🚀 Quick start

git clone https://github.com/Ethos6/spectraprobe
cd spectraprobe
npm install
npm run build
npm test            # 38 tests across parsers, pipeline, and the MCP layer

# analyse something real
node dist/cli/cli.js inspect "$(command -v node)"

Install the spectra command globally from the clone:

npm link           # then: spectra inspect ./target

Requires Node.js ≥ 18. Works on Windows 11, Linux and macOS (CI runs on all three).

⌨️ CLI

spectra inspect <target>        Full static analysis (findings, metadata, structure)
spectra strings <file>          Extract printable ASCII/UTF-16 strings
spectra dependencies <target>   Linked libraries / package dependencies
spectra symbols <file>          Exported / dynamic symbols
spectra imports <file>          Imported libraries and functions
spectra js analyze <path>       Analyse a JS/TS file or project
spectra resources <file>        List archive entries / embedded resources
spectra providers               List external providers and availability
spectra report <target>         Full report  (--format markdown|json  --out file)
spectra graph <target>          Emit the knowledge graph as JSON
spectra mcp                     Start the MCP server (stdio)

Common options: --format terminal|json|markdown, --out <file>, --only strings,imports, --min-length <n>, --max-strings <n>, --no-color.

# A whole JS/Node project: dependencies + capability references + module graph
spectra js analyze ./my-app

# A shareable Markdown report for an issue or case file
spectra report ./firmware.bin --format markdown --out firmware.md

# Just the import table of a DLL, as JSON
spectra imports ./library.dll --format json

🔌 MCP server

SpectraProbe speaks the Model Context Protocol over stdio, so any MCP-compatible client or agent can drive the engine. It implements the protocol directly — no SDK dependency.

// add to your MCP client configuration
{
  "mcpServers": {
    "spectraprobe": { "command": "spectra", "args": ["mcp"] }
  }
}

Twelve tools, each backed by the same engine as the CLI:

probe_target · inspect_metadata · extract_strings · inspect_dependencies · inspect_symbols · inspect_imports · analyze_javascript · inspect_resources · search_evidence · create_report · list_providers · get_analysis_status

Each tool has an explicit input schema, returns structured JSON, and reports clear errors for unsupported operations. Requests are processed in order so session-aware tools (search_evidence, get_analysis_status) stay consistent. A quick manual check:

printf '%s\n' \
  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05"}}' \
  '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' \
  '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"probe_target","arguments":{"path":"/bin/ls"}}}' \
  | spectra mcp

🧩 Pluggable providers

Deeper analysis comes from established, independently-licensed tools. SpectraProbe detects and adapts them; it never bundles them, and it keeps working when they are absent.

spectra providers            # shows ✓/✗, version, supported formats, and install notes

Each provider honours the licence and distribution terms of the tool it wraps.

📚 Library API

import { analyzePath, buildGraph, renderReport } from "spectraprobe";

const report = await analyzePath("./sample.exe");
console.log(report.findings.filter((f) => f.category === "import"));

const graph = buildGraph([report]);        // nodes + edges you can render or query
const markdown = renderReport(report, "markdown");

Lower-level parsers are exported too: parsePe, parseElf, parseMacho, parseWasm, readZip, extractStrings, shannonEntropy, hashBuffer, and more.

🏗️ Architecture

ingest ─▶ identify (magic bytes) ─▶ static engines ─▶ evidence/findings ─▶ report
                                     ├─ formats: pe · elf · macho · wasm · zip
                                     ├─ analyze: javascript (acorn) · project walk
                                     └─ providers: yara · radare2 · ghidra · …(optional)
                                                   │
                      session (searchable) ◀───────┤
                      knowledge graph      ◀───────┘
        the same core is exposed by  →  CLI · library · MCP server

Independently testable subsystems, TypeScript strict mode, bounds-checked binary readers, hard timeouts on any external process, and no file is ever executed.

🛡️ Authorized use

SpectraProbe is built for defensive security, debugging, interoperability research, and authorized software investigation. Use it only on:

• software you develop or own,

• open-source software,

• malware/research samples in an environment you control, or

• targets you otherwise have a lawful basis to analyse.

By design, this project is static-only. It deliberately does not include runtime hooking, stealth process/network monitoring, access-control or DRM circumvention, credential capture, or persistence mechanisms. Respect the licences of anything you analyse and of every provider tool you enable. You are responsible for using it lawfully.

✅ Project status

Implemented and tested: ingestion, hashing, entropy, strings/IOCs, PE/ELF/Mach-O/WASM/ZIP parsers, JS/TS analysis, provider detection, evidence model, knowledge graph, sessions, reporting, CLI, and the MCP server (38 passing tests; typechecked; CI on Linux/macOS/Windows × Node 18/20/22).

Planned: optional provider adapters that invoke Ghidra/radare2/JADX for decompilation, richer .NET and DEX structure parsing, and a desktop workspace. Runtime/dynamic analysis is intentionally out of scope.

🤝 Contributing

Issues and PRs welcome — new format parsers, provider adapters, and fixtures especially. See CONTRIBUTING.md. Please include a deterministic test fixture for any new parser.

Related projects

• free-search-api — self-hosted web search API

• free-news-api — news aggregation API

• free-flight-api — live flight tracking API

• free-ocr-api — OCR & document data extraction

If SpectraProbe is useful to you, please ⭐ the repo — it helps other researchers find it.

MIT © Ethos6